Join Fedora 19 to Active Directory Domain using realmd

by on September 23, 2013 at 4:24 pm

For years, Linux administrators have been successfully using Samba winbind to integrate Linux with Active directory.  While configuring a Linux host to join an Active Directory Domain is pretty simple, it still involves editing a few configuration files manually in most cases.  The new software, realmd, changes all of that, and makes joining a Linux host to an Active Directory Domain easier than ever before!

I have installed F19 stable from Netinstall CD using minimal install, no desktop. Make sure your network and DNS settings are working, obviously.

To successfully join a Windows 2008r2 AD domain using NTLMv2, I have done the following:
yum install realmd
realm discover –verbose

That will tell you what software you need to install (samba-common doesn’t show up, but it will if you try to join a domain and it’s not installed).
yum install sssd oddjob oddjob-mkhomedir adcli samba-common
realm join –client-software=sssd -U mydomainadmin
That should prompt for a password, and if successful, absolutely nothing will be displayed on STDOUT.
To test if you have successfully joined the domain, use
getent passwd EXAMPLE\\mydomainuser
and you should get a long passwd line.

Now, if you want to only allow certain users to log in, you can run the next two commands:
realm deny –all
realm permit

For more information about logins (including groups!), check out the man page for realm.

Bonus tip:  If you are used to adding AD groups to the sudoers file, the format has changed slightly from RHEL / CentOS 6.  Use the following for groups:

%domain\ ALL=(ALL) ALL

, ,

You can skip to the end and leave a response. Pinging is currently not allowed.

  • Chris

    Thank you for your article…
    I was FINALLY able to join my domain. Looks like realm works pretty well

    • Mike

      You’re welcome. Thank you for reading!

  • Craconia

    Thanks for the tutorial ! I’m wondering…Do we get a reminder when the password is about to expire? (like the pop-up we get on Windows informing us of password expiration coming soon?)

    • Mike

      That’s a great question, I’m not sure. My first instinct tells me it probably won’t.

  • Tom Barcia

    When I login to my domain my username is @@ and on the CentOS boxes I have that are AD integrated, this is not the case. Is there a way to change this behavior so that it’s just @?

    • Tom Barcia

      Ok, so the system removed some of the text… The username is username@domain@host rather than username@host. Hopefully it makes more sense now. :-)

      • Mike

        I’m not sure what you’re experiencing or what the problem is. Do you mean to say you have CentOS joined to AD through Samba+Winbind and your Fedora 19 box is displaying username@domain@host at the shell prompt? If that is what you’re asking, then no, I don’t know how to change that.

  • abid

    when i run the script [root@localhost ab]# realm join –client-software=sssd -U ab
    then get error message
    realm: Specify one realm to join

    • Mike

      Did you run realm discover? Also, make sure your DNS is able to resolve your domain.

      • Jiri Jirik

        I ran realm discover and it worked (identified the realm type,name, domain configuration, and required packages), but when running the realm join command I got the same message “Specify on realm to join”. Did you ever resolved it?


        • Mike

          There looks to be a bug that was pushed since I wrote this tutorial. Try –user instead of -U

          • Jiri Jirik

            Thanks for the response. Now I am getting message ‘Unknown option -user”…

          • Mike

            You need to use two dashes, not one. -user vs –user

  • ps

    In this line:
    realm join –client-software=sssd -U mydomainadmin

    Where does ‘mydomainadmin’ come from? I don’t have access to the domain controller, which I think is normal.

    • ps

      disregard, i got it.

  • WDac

    Thanks aslot for the info, i always forgetts due to i spend 9hours at work with MicroSoft OS Desktop and Serves, we have a few CentOS servers but i rarely need to do any work on them, thet just work 24/7 for our system and our customers.

    anyhow i did install Fedroa 20, 4 weeks ago, and then i remember, at least i thought i did remember that i dident had to install any extra packs like samba, kerberos, realmd and so on. but now it’s yum installed and updated.

    thanks for the post, i usuly copy the information and URL and make my privet/personal documentation to read it later if i need, you never know if this site will be up and running next time i need this good info :)

    thanks a lot and i hope its ok to copy your text for personal use?

    if not plz make a TAG / NOTE at the end of your information.

    Best Regards
    WDac @ Sweden.

    • Mike

      I’m glad you found it helpful. You are free to use my information however you wish. If you’re copying large parts of it, just please give me a link back :)

  • Bill

    I had to leave out –client-software=sssd for it to work for me, but it did work.

  • JimmyT

    Great. Thanks. This worked first time perfect. Now I need to create a directory on my Fedora box that is accessable to all users, Windows Domain Users and Linux users.