How to Integrate RHEL 7 or CentOS 7 with Windows Active Directory

In Most of the Organizations users and groups are created and managed on Windows Active Directory.  We can integrate our RHEL 7 and CentOS 7 servers with AD(Active Directory) for authenticate purpose. In other words we can join our CentOS 7 and RHEL 7 Server on Windows Domain so that system admins can login to these Linux servers with AD credentials. While creating UNIX users on AD we can map these users to a specific group so that level of access is controlled centrally from AD.

In this article we discuss how to integrate CentOS 7.x & RHEL 7.x with AD(Windows Server 2008 R2 & Windows Server 2012 R2). Following steps are applicable for both CentOS 7 and RHEL 7.

Step:1 Install the required packages using yum command

Use the yum command to install following packages from the command line.

[root@servera ~]# yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation openldap-clients policycoreutils-python

Update the /etc/hosts file and /etc/resolv.conf so that dns name or hostname of AD server gets resolved correctly. In my case AD server hostname is ““, so place the below line in /etc/hosts file  adserver

Contents of resolv.conf should be something like below. Just replace the domain name and ip address of dns server as per your setup

[root@servera ~]# cat /etc/resolv.conf
[root@servera ~]#

Step:2 Now Join Windows Domain or Integrate with AD using realm command

When we install above required packages then realm command will be available. We will use beneath realm command to integrate CentOS 7 or RHEL 7 with AD via the user “tech”. tech is a bind user which have required privileges on AD or  we can also administrator user of AD Server for integration purpose.

[root@servera ~]# realm join --user=tech
Password for tech:
[root@servera ~]#

Now verify whether our server has joined the Windows domain or not. Simply run the command ‘realm list

 [root@servera ~]# realm list
  type: kerberos
  realm-name: EXAMPLE.COM
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common-tools
  login-formats: %[email protected]
  login-policy: allow-realm-logins
[root@servera ~]#

Whenever we run ‘realm join’ command it will automatically configure ‘/etc/sssd/sssd.conf‘ file.

Step:3 Check and Verify  AD users on REHL 7 or CentOS 7 Servers

With ‘id‘ command on Linux we can verify the user’s uid and gid and their group information. At this point of time our server is now the part of windows domain. Use below command to verify AD users details.

[root@servera ~]# id [email protected]
uid=1997801106([email protected]) gid=1997800513(domain [email protected]) groups=1997800513(domain [email protected])
[root@servera ~]#

You might have noticed in above command that i have mentioned domain name as well along with user name because this is controlled by ‘/etc/sssd/sssd.conf’ file. If we execute id command without domain name then we will not get any details for user.

[root@servera ~]# id linuxtechi
id: linuxtechi: no such user
[root@servera ~]#

We can change this behavior by editing the file /etc/sssd/sssd.conf.

Change the following parameters from

use_fully_qualified_names = True
fallback_homedir = /home/%u@%d


use_fully_qualified_names = False
fallback_homedir = /home/%u

Restart the sssd service using following systemctl command

[root@servera ~]# systemctl restart sssd
[root@servera ~]# systemctl daemon-reload

Now run the id command and see whether you are able get AD user details without mentioning domain name

[root@servera ~]# id linuxtechi
uid=1997801106(linuxtechi) gid=1997800513(domain users) groups=1997800513(domain users)
[root@servera ~]#

Let’s try ssh CentOS 7 or RHEL 7 Server with AD credentials

[root@lnxdesktop ~]# ssh [email protected]
[email protected]'s password:
Last login: Fri Mar  3 10:18:41 2017 from
[linuxtechi@servera ~]$ id
uid=1997801106(linuxtechi) gid=1997800513(domain users) groups=1997800513(domain users)
[linuxtechi@servera ~]$ pwd
[linuxtechi@servera ~]$

Step:4 Sudo rights for AD users on CentOS 7 or RHEL 7

In case you want to configure sudo rights for AD users then the best way is to create a group on AD with name sudoers and add Linux/UNIX users in that group and on Linux Server create a file with name “sudoers” under the folder /etc/sudoers.d/

Put the following content in the file.

[root@servera ~]# cat /etc/sudoers.d/sudoers
%sudoers    ALL=(ALL)       ALL
[root@servera ~]#

In my case I have given all the rights to the users which are part of sudoers group. Once your done with these changes re-login to your server with AD credentials and see whether user is part of sudoers group.


That’s all from this article, Hope you guys got an idea how to join RHEL or CentOS server with Windows Domain. Please share your feedback and valuable comments.

45 thoughts on “How to Integrate RHEL 7 or CentOS 7 with Windows Active Directory”

  1. Very helpful – thank you!

    Do you have a similar article for integrating samba and active directory authentication? I’d like to be able to share out the home directories on the centos server of the active directory users who have logged in and I am running into a wall.

  2. getent passwd; getent group; doesn’t work after this tutorial,

    You need to add:
    enumerate = true
    in your sssd.conf file (under: [domain/])

  3. This is fantastic – thank you! Now, what about integrating Samba authentication with this method of AD integration? I cannot seem to get this to work.

  4. I have installed it on aws but when i try to ssh it it say permission denied i have 3 4 times but still showing same issue..

    Any solution for this error

  5. I tried the solution and it worked for me now I have a different issue/question.

    I added my linux server to I also want to allow and users to be able to login as well.

    how can i do that

  6. Hi i have strange case with Centos 7. I had join the domain, i can log on AD users but there is no DNS entry of my Centos 7 in AD DNS. I had updated /etc/sssd/sssd.conf with dyndns_update = True, but it don’t help. Any suggestions?

  7. I am getting this error while running realm join command:

    * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-WkIz9P/krb5.d/adcli-krb5-conf-ObFF3n
    ! Couldn’t get kerberos ticket for: : Cannot contact any KDC for realm ”


Leave a Comment