Este conteúdo não está disponível no idioma selecionado.
5.7. Active Directory Trust for Legacy Linux Clients
Linux clients running Red Hat Enterprise Linux with SSSD version 1.8 or earlier (legacy clients) do not provide native support for IdM cross-forest trusts with Active Directory. Therefore, for AD users to be able to access services provided by the IdM server, the legacy Linux clients and the IdM server have to be properly configured.
Instead of using SSSD version 1.9 or later to communicate with the IdM server to obtain LDAP information, legacy clients use other utilities for this purpose, for example
nss_ldap, nss-pam-ldapd, or SSSD version 1.8 or earlier. Clients running the following versions of Red Hat Enterprise Linux do not use SSSD 1.9 and are therefore considered to be legacy clients:
- Red Hat Enterprise Linux 5.7 or later
- Red Hat Enterprise Linux 6.0 – 6.3
Important
Do not use the configuration described in this section for non-legacy clients, that is, clients running SSSD version 1.9 or later. SSSD 1.9 or later provides native support for IdM cross-forest trusts with AD, meaning AD users can properly access services on IdM clients without any additional configuration.
When a legacy client joins the domain of an IdM server in a trust relationship with AD, a compat LDAP tree provides the required user and group data to AD users. However, the compat tree enables the AD users to access only a limited number of IdM services.
Legacy clients do not provide access to the following services:
- Kerberos authentication
- host-based access control (HBAC)
- SELinux user mapping
sudorules
Access to the following services is provided even in case of legacy clients:
- information look-up
- password authentication
5.7.1. Server-side Configuration for AD Trust for Legacy Clients
Make sure the IdM server meets the following configuration requirements:
- The ipa-server package for IdM and the ipa-server-trust-ad package for the IdM trust add-on have been installed.
- The
ipa-server-installutility has been run to set up the IdM server. - The
ipa-adtrust-install --enable-compatcommand has been run, which ensures that the IdM server supports trusts with AD domains and that the compat LDAP tree is available.If you have already runipa-adtrust-installwithout the--enable-compatoption in the past, run it again, this time adding--enable-compat. - The
ipa trust-add ad.example.orgcommand has been run to establish the AD trust.
If the host-based access control (HBAC)
allow_all rule is disabled, enable the system-auth service on the IdM server, which allows authentication of the AD users.
You can determine the current status of
allow_all directly from the command line using the ipa hbacrule-show command. If the rule is disabled, Enabled: FALSE is displayed in the output:
[user@server ~]$ kinit admin
[user@server ~]$ ipa hbacrule-show allow_all
Rule name: allow_all
User category: all
Host category: all
Service category: all
Description: Allow all users to access any host from any host
Enabled: FALSENote
For information on disabling and enabling HBAC rules, see Configuring Host-Based Access Control in the Linux Domain Identity, Authentication, and Policy Guide.
To enable
system-auth on the IdM server, create an HBAC service named system-auth and add an HBAC rule using this service to grant access to IdM masters. Adding HBAC services and rules is described in Configuring Host-Based Access Control section in the Linux Domain Identity, Authentication, and Policy Guide. Note that HBAC services are PAM service names; if you add a new PAM service, make sure to create an HBAC service with the same name and then grant access to this service through HBAC rules.
5.7.2. Client-side Configuration Using the ipa-advise Utility
The
ipa-advise utility provides the configuration instructions to set up a legacy client for an AD trust.
To display the complete list of scenarios for which
ipa-advise can provide configuration instructions, run ipa-advise without any options. Running ipa-advise prints the names of all available sets of configuration instructions along with the descriptions of what each set does and when it is recommended to be used.
[root@server ~]# ipa-advise config-redhat-nss-ldap : Instructions for configuring a system with nss-ldap as a IPA client. This set of instructions is targeted for platforms that include the authconfig utility, which are all Red Hat based platforms. config-redhat-nss-pam-ldapd : Instructions for configuring a system (...)
To display a set of instructions, run the
ipa-advise utility with an instruction set as a parameter:
[root@server ~]# ipa-advise config-redhat-nss-ldap #!/bin/sh # ---------------------------------------------------------------------- # Instructions for configuring a system with nss-ldap as a IPA client. # This set of instructions is targeted for platforms that include the # authconfig utility, which are all Red Hat based platforms. # ---------------------------------------------------------------------- # Schema Compatibility plugin has not been configured on this server. To # configure it, run "ipa-adtrust-install --enable-compat" # Install required packages via yum yum install -y wget openssl nss_ldap authconfig # NOTE: IPA certificate uses the SHA-256 hash function. SHA-256 was # introduced in RHEL5.2. Therefore, clients older than RHEL5.2 will not # be able to interoperate with IPA server 3.x. # Please note that this script assumes /etc/openldap/cacerts as the # default CA certificate location. If this value is different on your # system the script needs to be modified accordingly. # Download the CA certificate of the IPA server mkdir -p -m 755 /etc/openldap/cacerts wget http://idm.example.com/ipa/config/ca.crt -O /etc/openldap/cacerts/ca.crt (...)
You can configure a Linux client using the
ipa-advise utility by running the displayed instructions as a shell script or by executing the instructions manually.
To run the instructions as a shell script:
- Create the script file.
[root@server ~]# ipa-advise config-redhat-nss-ldap > setup_script.sh
- Add execute permissions to the file using the
chmodutility.[root@server ~]# chmod +x setup_script.sh
- Copy the script to the client using the
scputility.[root@server ~]# scp setup_script.sh root@client
- Run the script on the client.
[root@client ~]# ./setup_script.sh
Important
Always read and review the script file carefully before you run it on the client.
To configure the client manually, follow and execute the instructions displayed by
ipa-advise from the command line.
