5.7. Active Directory Trust for Legacy Linux Clients
Linux clients running Red Hat Enterprise Linux with SSSD version 1.8 or earlier (legacy clients) do not provide native support for IdM cross-forest trusts with Active Directory. Therefore, for AD users to be able to access services provided by the IdM server, the legacy Linux clients and the IdM server have to be properly configured.
Instead of using SSSD version 1.9 or later to communicate with the IdM server to obtain LDAP information, legacy clients use other utilities for this purpose, for example
nss-pam-ldapd, or SSSD version 1.8 or earlier. Clients running the following versions of Red Hat Enterprise Linux do not use SSSD 1.9 and are therefore considered to be legacy clients:
- Red Hat Enterprise Linux 5.7 or later
- Red Hat Enterprise Linux 6.0 – 6.3
Do not use the configuration described in this section for non-legacy clients, that is, clients running SSSD version 1.9 or later. SSSD 1.9 or later provides native support for IdM cross-forest trusts with AD, meaning AD users can properly access services on IdM clients without any additional configuration.
When a legacy client joins the domain of an IdM server in a trust relationship with AD, a compat LDAP tree provides the required user and group data to AD users. However, the compat tree enables the AD users to access only a limited number of IdM services.
Legacy clients do not provide access to the following services:
- Kerberos authentication
- host-based access control (HBAC)
- SELinux user mapping
Access to the following services is provided even in case of legacy clients:
- information look-up
- password authentication
5.7.1. Server-side Configuration for AD Trust for Legacy Clients
Make sure the IdM server meets the following configuration requirements:
- The ipa-server package for IdM and the ipa-server-trust-ad package for the IdM trust add-on have been installed.
ipa-server-installutility has been run to set up the IdM server.
ipa-adtrust-install --enable-compatcommand has been run, which ensures that the IdM server supports trusts with AD domains and that the compat LDAP tree is available.If you have already run
--enable-compatoption in the past, run it again, this time adding
ipa trust-add ad.example.orgcommand has been run to establish the AD trust.
If the host-based access control (HBAC)
allow_allrule is disabled, enable the
system-authservice on the IdM server, which allows authentication of the AD users.
You can determine the current status of
allow_alldirectly from the command line using the
ipa hbacrule-showcommand. If the rule is disabled,
Enabled: FALSEis displayed in the output:
[user@server ~]$ kinit admin [user@server ~]$ ipa hbacrule-show allow_all Rule name: allow_all User category: all Host category: all Service category: all Description: Allow all users to access any host from any host Enabled: FALSE
For information on disabling and enabling HBAC rules, see Configuring Host-Based Access Control in the Linux Domain Identity, Authentication, and Policy Guide.
system-authon the IdM server, create an HBAC service named
system-authand add an HBAC rule using this service to grant access to IdM masters. Adding HBAC services and rules is described in Configuring Host-Based Access Control section in the Linux Domain Identity, Authentication, and Policy Guide. Note that HBAC services are PAM service names; if you add a new PAM service, make sure to create an HBAC service with the same name and then grant access to this service through HBAC rules.
5.7.2. Client-side Configuration Using the
ipa-adviseutility provides the configuration instructions to set up a legacy client for an AD trust.
To display the complete list of scenarios for which
ipa-advisecan provide configuration instructions, run
ipa-advisewithout any options. Running
ipa-adviseprints the names of all available sets of configuration instructions along with the descriptions of what each set does and when it is recommended to be used.
[root@server ~]# ipa-advise config-redhat-nss-ldap : Instructions for configuring a system with nss-ldap as a IPA client. This set of instructions is targeted for platforms that include the authconfig utility, which are all Red Hat based platforms. config-redhat-nss-pam-ldapd : Instructions for configuring a system (...)
To display a set of instructions, run the
ipa-adviseutility with an instruction set as a parameter:
[root@server ~]# ipa-advise config-redhat-nss-ldap #!/bin/sh # ---------------------------------------------------------------------- # Instructions for configuring a system with nss-ldap as a IPA client. # This set of instructions is targeted for platforms that include the # authconfig utility, which are all Red Hat based platforms. # ---------------------------------------------------------------------- # Schema Compatibility plugin has not been configured on this server. To # configure it, run "ipa-adtrust-install --enable-compat" # Install required packages via yum yum install -y wget openssl nss_ldap authconfig # NOTE: IPA certificate uses the SHA-256 hash function. SHA-256 was # introduced in RHEL5.2. Therefore, clients older than RHEL5.2 will not # be able to interoperate with IPA server 3.x. # Please note that this script assumes /etc/openldap/cacerts as the # default CA certificate location. If this value is different on your # system the script needs to be modified accordingly. # Download the CA certificate of the IPA server mkdir -p -m 755 /etc/openldap/cacerts wget http://idm.example.com/ipa/config/ca.crt -O /etc/openldap/cacerts/ca.crt (...)
You can configure a Linux client using the
ipa-adviseutility by running the displayed instructions as a shell script or by executing the instructions manually.
To run the instructions as a shell script:
- Create the script file.
[root@server ~]# ipa-advise config-redhat-nss-ldap > setup_script.sh
- Add execute permissions to the file using the
[root@server ~]# chmod +x setup_script.sh
- Copy the script to the client using the
[root@server ~]# scp setup_script.sh root@client
- Run the script on the client.
[root@client ~]# ./setup_script.sh
ImportantAlways read and review the script file carefully before you run it on the client.
To configure the client manually, follow and execute the instructions displayed by
ipa-advisefrom the command line.