5.2. Configuring a Managed Service Account for a RHEL host

Procedure

1. Create an MSA for the host in the production.example.com AD domain.

   [root@client ~]# adcli create-msa --domain=production.example.com

2. Display information about the MSA from the Kerberos keytab that was created. Make note of the MSA name:

   [root@client ~]# klist -k /etc/krb5.keytab.production.example.com
   Keytab name: FILE:/etc/krb5.keytab.production.example.com
   KVNO Principal
   ---- ------------------------------------------------------------
      2 CLIENT!S3A$@PRODUCTION.EXAMPLE.COM (aes256-cts-hmac-sha1-96)
      2 CLIENT!S3A$@PRODUCTION.EXAMPLE.COM (aes128-cts-hmac-sha1-96)

3. Open the /etc/sssd/sssd.conf file and choose the appropriate SSSD domain configuration to add:

   • If the MSA corresponds to an AD domain from a different forest, create a new domain section named [domain/<name_of_domain>], and enter information about the MSA and the keytab. The most important options are ldap_sasl_authid, ldap_krb5_keytab, and krb5_keytab:

     [domain/production.example.com]
     ldap_sasl_authid = CLIENT!S3A$@PRODUCTION.EXAMPLE.COM
     ldap_krb5_keytab = /etc/krb5.keytab.production.example.com
     krb5_keytab = /etc/krb5.keytab.production.example.com
     ad_domain = production.example.com
     krb5_realm = PRODUCTION.EXAMPLE.COM
     access_provider = ad
     ...

     警告

     Even with an existing trust relationship, sssd-ad requires a MSA in the second forest.

   • If the MSA corresponds to an AD domain from the local forest, create a new sub-domain section in the format [domain/root.example.com/sub-domain.example.com], and enter information about the MSA and the keytab. The most important options are ldap_sasl_authid, ldap_krb5_keytab, and krb5_keytab:

     [domain/ad.example.com/production.example.com]
     ldap_sasl_authid = CLIENT!S3A$@PRODUCTION.EXAMPLE.COM
     ldap_krb5_keytab = /etc/krb5.keytab.production.example.com
     krb5_keytab = /etc/krb5.keytab.production.example.com
     ad_domain = production.example.com
     krb5_realm = PRODUCTION.EXAMPLE.COM
     access_provider = ad
     ...