4.5. Managing login permissions for domain users

Procedure

1. Grant access to all users:

   # realm permit --all

2. Grant access to specific users:

   $ realm permit aduser01@example.com
   $ realm permit 'AD.EXAMPLE.COM\aduser01'

   Currently, you can only allow access to users in primary domains and not to users in trusted domains. This is due to the fact that user login must contain the domain name and SSSD cannot currently provide realmd with information about available child domains.

Verification

1. Use SSH to log in to the server as the aduser01@example.com user:

   $ ssh aduser01@example.com@server_name
   [aduser01@example.com@server_name ~]$

2. Use the ssh command a second time to access the same server, this time as the aduser02@example.com user:

   $ ssh aduser02@example.com@server_name
   Authentication failed.

Procedure

1. Deny access to all users within the domain:

   # realm deny --all

   This command prevents realm accounts from logging into the local machine. Use realm permit to restrict login to specific accounts.

2. Verify that the domain user’s login-policy is set to deny-any-login:

   [root@replica1 ~]# realm list
   example.net
     type: kerberos
     realm-name: EXAMPLE.NET
     domain-name: example.net
     configured: kerberos-member
     server-software: active-directory
     client-software: sssd
     required-package: oddjob
     required-package: oddjob-mkhomedir
     required-package: sssd
     required-package: adcli
     required-package: samba-common-tools
     login-formats: %U@example.net
     login-policy: deny-any-login

3. Deny access to specific users by using the -x option:

   $ realm permit -x 'AD.EXAMPLE.COM\aduser02'