# Using with Active Directory

`realmd` can discover Active Directory domains and join the current computer as an account on that domain. This allows using domain users locally, as well as use a domain account to log into the machine.

## Discovering Active Directory domains

`realmd` discovers which domains or realms it can use or configure. It can discover and identify Active Directory domains by looking up the appropriate DNS SRV records.

The following DNS SRV records are required to be present for `realmd` to identify a provided realm as an Active Directory domain. The DNS server that comes with Active Directory on Windows Server automatically creates these DNS records.

    # In this example the Active Directory domain is 'domain.example.com'
    _ldap._tcp.dc._msdcs.domain.example.com.

An Active Directory specific UDP LDAP ping is sent to each server during discovery.

To see how `realmd` is discovering a particular domain name, try a command like the following. Using the `--verbose` argument displays verbose discovery information.

    $ realm discover --verbose domain.example.com
     * Resolving: _ldap._tcp.dc._msdcs.domain.example.com
     * Sending MS-CLDAP ping to: 192.168.20.10
     * Sending MS-CLDAP ping to: 192.168.12.12
     * Successfully discovered: domain.example.com
    ...

In addition an Active Directory domain controller's host name or IP address may be specified directly.

## Active Directory client software

As part of configuring an Active Directory domain for use on the local computer, `realmd` will configure client software to enable domain accounts to be used on the local computer.

`realmd` supports two types of client software for Active Directory: SSSD and Winbind. By default SSSD is used.

### Using SSSD with Active Directory

SSSD provides client software for various kerberos and/or LDAP directories. Since version 1.9.x it provides good support for Active Directory.

When joining a computer to an Active Directory domain, `realmd` will use SSSD as the client software by default. You can force use of SSSD by specifying the `--client-software=sssd` when joining the domain with the `realm` command like this:

    $ realm join --client-software=sssd domain.example.com

### Using Winbind with Active Directory

Samba Winbind provides client software for use with Active Directory.

To have `realmd` use Winbind as the client software, configure the `default-client` setting. You can force use of Winbind by specifying the `--client-software=winbind` when joining the domain with the `realm` command like this:

    $ realm join --client-software=winbind domain.example.com

## Joining an Active Directory domain

To join an Active Directory domain with `realmd` you can use the `realm` command line tool:

    $ realm join --verbose domain.example.com

By specifying the `--verbose` it's easier to see what went wrong if the join fails.

Other tools also use `realmd` which can be used to perform the join operation, for example: GNOME Control Center.

The join operation does the following:

- Discovers information about the domain.

- Installs the necessary software to join the domain, such as SSSD or Winbind.

- If administrative credentials are required, a password will be prompted for.

- A computer account in the domain will be created, and or updated.

- A host keytab file at `/etc/krb5.keytab` is created.

- Configures the SSSD or Winbind services, and restarts and enables them as appropriate.

- Enables domain users in `/etc/nsswitch.conf`

In addition an Active Directory domain controller's host name or IP address may be specified to join via that domain controller directly.

After the join operation is complete, domain accounts should be usable locally, although logins using domain accounts are not necessarily enabled.

You verify that domain accounts are working with with a command like this:

    $ getent passwd DOMAIN\Administrator

The join operation will create or update a computer account in the domain. If you wish to specify a specific organizational unit where this account is created, you can use the `computer-ou` setting. Additonally, you can override the default name for the computer account with the `computer-name` setting.

Specify the `--user` to choose a different user name than the default `Administrator` user.

You can use kerberos credentials to perform the join. Use the `kinit` command to acquire credentials prior to starting the join. Do not specify the `--user` argument, the user will be selected automatically from the credential cache. The `realm` respects the `KRB5_CCACHE` environment variable, but uses the default kerberos credential cache if it's not present.

## Logins using Domain Accounts

Once the computer is joined to an Active Directory domain, you can configure the machine so that you can log in with domain accounts.

To permit any domain account to log in, use the following command.

    $ realm permit --realm domain.example.com --all

To permit only specific accounts from the domain to log in use the following command. The first time this command is run it will change the mode to only allow logins by specific accounts, and then add the specified accounts to the list of accounts to permit.

    $ realm permit --realm domain.example.com DOMAIN\\User1 DOMAIN\\User2

To deny logins from any domain account, use the following command.

    $ realm deny --realm domain.example.com --all