Use SSSD for direct AD integration #3286
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
SSSD is the component recommend on the RHEL side to integrate a Linux system directly into an AD domain. Previously, on the Foreman side, we recommended Samba. Note that the new procedure based on SSSD doesn't currently configure Kerberos SSO for Foreman.
|
The PR preview for bb87e9d is available at theforeman-foreman-documentation-preview-pr-3286.surge.sh The following output files are affected by this PR: |
9 tasks
|
The SSSD team is going to be rather busy in the upcoming several months so they won't be able to help me move forward with this. I'm closing this PR and if needed, I can revisit later. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes are you introducing?
Introducing a new procedure for direct AD integration + configuring AD as an external authentication source that relies only on SSSD to enroll the system to AD.
Why are you introducing these changes? (Explanation, links to references, issues, etc.)
Currently, the documentation uses Samba + SSSD to perform the joining. That diverges from what the RHEL team is recommending (on the RHEL side, SSSD is the component recommended for direct AD integration). However, right now, on the Foreman side, we recommended Samba.
Anything else to add? (Considerations, potential downsides, alternative solutions you have explored, etc.)
The new procedure based on SSSD doesn't currently configure Kerberos SSO for AD users logging in to Foreman. Without that functionality, there is little point in adding the steps.
Checklists
Please cherry-pick my commits into: