@@ -22,7 +22,7 @@ Currently Linux distribution can work as member of Active Directory domains, whi
22
22
To complete the authentication flow we assume, you already have:
23
23
24
24
* An Active Directory Domain Services already configured.
25
- * A Linux VM (for the test we use CentosOS based machine).
25
+ * A Linux VM (** for the test we use CentosOS based machine** ).
26
26
* A network infrastructure that allows communication between Active Directory and the Linux VM.
27
27
* A dedicated User Account for read AD objects.
28
28
* The Linux VM need to have these packages installed:
@@ -63,21 +63,21 @@ Review the information that you provided, and if everything is correct, click Fi
63
63
64
64
On your Linux VM, install the following packages: * sssd sssd-tools sssd-ldap openldap-client* :
65
65
66
- ``` console
67
- yum install -y sssd sssd-tools sssd-ldap openldap-clients
66
+ ``` bash
67
+ sudo yum install -y sssd sssd-tools sssd-ldap openldap-clients
68
68
```
69
69
70
70
After the installation check if LDAP search works. In order to check it try an LDAP search following the example below:
71
71
72
- ``` console
73
- ldapsearch -H ldaps://contoso.com -x \
72
+ ``` bash
73
+ sudo ldapsearch -H ldaps://contoso.com -x \
74
74
-D CN=ReadOnlyUser,CN=Users,DC=contoso,DC=com -w Read0nlyuserpassword \
75
75
-b CN=Users,DC=contoso,DC=com
76
76
```
77
77
78
78
If the LDAP query works fine, you will obtain an output with some information like follow:
79
79
80
- ``` console
80
+ ``` config
81
81
extended LDIF
82
82
83
83
LDAPv3
@@ -113,7 +113,7 @@ dSCorePropagationData: 16010101000000.0Z
113
113
> [ !NOTE]
114
114
> If your get and error run the following command:
115
115
>
116
- > ldapsearch -H ldaps://contoso.com -x \
116
+ > sudo ldapsearch -H ldaps://contoso.com -x \
117
117
> -D CN=ReadOnlyUser,CN=Users,DC=contoso,DC=com -w Read0nlyuserpassword \
118
118
> -b CN=Users,DC=contoso,DC=com -d 3
119
119
>
@@ -125,13 +125,13 @@ Create */etc/sssd/sssd.conf* with a content like the following. Remember to upda
125
125
126
126
Command for file creation:
127
127
128
- ``` console
129
- vi /etc/sssd/sssd.conf
128
+ ``` bash
129
+ sudo vi /etc/sssd/sssd.conf
130
130
```
131
131
132
132
Example sssd.conf:
133
133
134
- ``` bash
134
+ ``` config
135
135
[sssd]
136
136
config_file_version = 2
137
137
domains = default
@@ -184,13 +184,13 @@ Save the file with *ESC + wq!* command.
184
184
185
185
Set the permission to sssd.conf to 600 with the following command:
186
186
187
- ``` console
187
+ ``` bash
188
188
chmod 600 /etc/sssd/sssd.conf
189
189
```
190
190
191
191
After that create an obfuscated password for the Bind DN account. You must insert the Domain password for ReadOnlyUser:
192
192
193
- ``` console
193
+ ``` bash
194
194
sss_obfuscate --domain default
195
195
```
196
196
@@ -200,27 +200,27 @@ The password will be placed automatically in the configuration file.
200
200
201
201
Start the sssd service:
202
202
203
- ``` console
204
- service sssd start
203
+ ``` bash
204
+ sudo systemctl start sssd
205
205
```
206
206
207
207
Now configure the service with the * authconfig* tool:
208
208
209
- ``` console
210
- authconfig --enablesssd --enablesssdauth --enablemkhomedir --updateall
209
+ ``` bash
210
+ sudo authconfig --enablesssd --enablesssdauth --enablemkhomedir --updateall
211
211
```
212
212
213
213
At this point restart the service:
214
214
215
- ``` console
215
+ ``` bash
216
216
systemctl restart sssd
217
217
```
218
218
219
219
## Test the configuration
220
220
221
221
The final step is to check that the flow works properly. To check this, try logging in with one of your AD users in Active Directory. We tried with a user called * ADUser* . If the configuration is correct, you will get the following result:
222
222
223
- ``` console
223
+ ``` output
224
224
[centosuser@centos8 ~]su - [email protected]
225
225
Last login: Wed Oct 12 15:13:39 UTC 2022 on pts/0
226
226
[ADUser@Centos8 ~]$ exit
0 commit comments