Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

5.7. Active Directory Trust for Legacy Linux Clients

Linux clients running Red Hat Enterprise Linux with SSSD version 1.8 or earlier (legacy clients) do not provide native support for IdM cross-forest trusts with Active Directory. Therefore, for AD users to be able to access services provided by the IdM server, the legacy Linux clients and the IdM server have to be properly configured.
Instead of using SSSD version 1.9 or later to communicate with the IdM server to obtain LDAP information, legacy clients use other utilities for this purpose, for example nss_ldap, nss-pam-ldapd, or SSSD version 1.8 or earlier. Clients running the following versions of Red Hat Enterprise Linux do not use SSSD 1.9 and are therefore considered to be legacy clients:
  • Red Hat Enterprise Linux 5.7 or later
  • Red Hat Enterprise Linux 6.0 – 6.3

Important

Do not use the configuration described in this section for non-legacy clients, that is, clients running SSSD version 1.9 or later. SSSD 1.9 or later provides native support for IdM cross-forest trusts with AD, meaning AD users can properly access services on IdM clients without any additional configuration.
When a legacy client joins the domain of an IdM server in a trust relationship with AD, a compat LDAP tree provides the required user and group data to AD users. However, the compat tree enables the AD users to access only a limited number of IdM services.
Legacy clients do not provide access to the following services:
  • Kerberos authentication
  • host-based access control (HBAC)
  • SELinux user mapping
  • sudo rules
Access to the following services is provided even in case of legacy clients:
  • information look-up
  • password authentication

5.7.1. Server-side Configuration for AD Trust for Legacy Clients

Make sure the IdM server meets the following configuration requirements:
  • The ipa-server package for IdM and the ipa-server-trust-ad package for the IdM trust add-on have been installed.
  • The ipa-server-install utility has been run to set up the IdM server.
  • The ipa-adtrust-install --enable-compat command has been run, which ensures that the IdM server supports trusts with AD domains and that the compat LDAP tree is available.
    If you have already run ipa-adtrust-install without the --enable-compat option in the past, run it again, this time adding --enable-compat.
  • The ipa trust-add ad.example.org command has been run to establish the AD trust.
If the host-based access control (HBAC) allow_all rule is disabled, enable the system-auth service on the IdM server, which allows authentication of the AD users.
You can determine the current status of allow_all directly from the command line using the ipa hbacrule-show command. If the rule is disabled, Enabled: FALSE is displayed in the output: 
[user@server ~]$ kinit admin
[user@server ~]$ ipa hbacrule-show allow_all
  Rule name: allow_all
  User category: all
  Host category: all
  Service category: all
  Description: Allow all users to access any host from any host
  Enabled: FALSE

Note

For information on disabling and enabling HBAC rules, see Configuring Host-Based Access Control in the Linux Domain Identity, Authentication, and Policy Guide.
To enable system-auth on the IdM server, create an HBAC service named system-auth and add an HBAC rule using this service to grant access to IdM masters. Adding HBAC services and rules is described in Configuring Host-Based Access Control section in the Linux Domain Identity, Authentication, and Policy Guide. Note that HBAC services are PAM service names; if you add a new PAM service, make sure to create an HBAC service with the same name and then grant access to this service through HBAC rules.

5.7.2. Client-side Configuration Using the ipa-advise Utility

The ipa-advise utility provides the configuration instructions to set up a legacy client for an AD trust.
To display the complete list of scenarios for which ipa-advise can provide configuration instructions, run ipa-advise without any options. Running ipa-advise prints the names of all available sets of configuration instructions along with the descriptions of what each set does and when it is recommended to be used. 
[root@server ~]# ipa-advise
config-redhat-nss-ldap		: Instructions for configuring a system
				  with nss-ldap as a IPA client.
				  This set of instructions is targeted
				  for platforms that include the
				  authconfig utility, which are all
				  Red Hat based platforms.
config-redhat-nss-pam-ldapd	: Instructions for configuring a system
(...)
To display a set of instructions, run the ipa-advise utility with an instruction set as a parameter: 
[root@server ~]# ipa-advise config-redhat-nss-ldap
#!/bin/sh
# ----------------------------------------------------------------------
# Instructions for configuring a system with nss-ldap as a IPA client.
# This set of instructions is targeted for platforms that include the
# authconfig utility, which are all Red Hat based platforms.
# ----------------------------------------------------------------------
# Schema Compatibility plugin has not been configured on this server. To
# configure it, run "ipa-adtrust-install --enable-compat"
# Install required packages via yum
yum install -y wget openssl nss_ldap authconfig

# NOTE: IPA certificate uses the SHA-256 hash function. SHA-256 was
# introduced in RHEL5.2. Therefore, clients older than RHEL5.2 will not
# be able to interoperate with IPA server 3.x.
# Please note that this script assumes /etc/openldap/cacerts as the
# default CA certificate location. If this value is different on your
# system the script needs to be modified accordingly.
# Download the CA certificate of the IPA server
mkdir -p -m 755 /etc/openldap/cacerts
wget http://idm.example.com/ipa/config/ca.crt -O /etc/openldap/cacerts/ca.crt
(...)
You can configure a Linux client using the ipa-advise utility by running the displayed instructions as a shell script or by executing the instructions manually.
To run the instructions as a shell script:
  1. Create the script file. 
    [root@server ~]# ipa-advise config-redhat-nss-ldap > setup_script.sh
  2. Add execute permissions to the file using the chmod utility. 
    [root@server ~]# chmod +x setup_script.sh
  3. Copy the script to the client using the scp utility. 
    [root@server ~]# scp setup_script.sh root@client
  4. Run the script on the client. 
    [root@client ~]# ./setup_script.sh

    Important

    Always read and review the script file carefully before you run it on the client.
To configure the client manually, follow and execute the instructions displayed by ipa-advise from the command line.