How to join two AD ?

liberodark · 25. Februar 2020

Hi,

Have see some work of ldap add for OMV 4 or 5.
List of topics read :
https://github.com/Tacioandrade/JoinOMVDomain
Active Directory / LDAP Revisited
Join a Windows 2008 R2 domain
Samba AD/DC integration
OMV vs Active Directory
Guide how to Join OpenMediaVault to a Windows 2012 R2 Active Directory Domain without ldap plugin.
Guide to OMV 4 Active Directory Integration

But my ask is how to add two ldap servers.

Exemple :

1. LDAP = MyAD.com
2. LDAP = MyOtherAD.at

Not have same users in LDAP 1 and LDAP 2.
But need to make a same NAS / Share for LDAP 1 and LDAP 2.
And no need replication option.

---------------------------------------------> LDAP 1
The schema is NAS > Auth > Ask > Local
---------------------------------------------> LDAP 2

You have any idea how to make that ?

Best Regards.

liberodark · 26. Februar 2020

Have make this :

# Install Deps

Bash

apt-get update
apt-get upgrade -y
apt-get install adcli sssd sssd-tools realmd krb5-user libpam-sss libnss-sss libsasl2-modules-gssapi-mit packagekit libwbclient-sssd -y

need to edit krb5 :

Bash

[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log






[libdefaults]
        default_realm = ADONE.COM
        dns_lookup_realm = false
        ticket_lifetime = 24h
        renew_lifetime = 7d
        forwardable = true
        rdns = false






[realms]
        ADONE.COM = {
                kdc = adone.com
                admin_server = adone.com
                default_domain = ADONE.COM
        }






        ADTWO.LOCAL = {
                kdc = adtwo.local.local
                admin_server = adtwo.local.local
                default_domain = ADTWO.local
        }






[domain_realm]
        .adone.com = ADONE.COM
        adone.com = ADONE.COM
        .adtwo.local = ADTWO.LOCAL
        adtwo.local = ADTWO.LOCAL

Alles anzeigen

# Join LDAP 1

Bash

realm join -U admin adone.com --verbose

# Join LDAP 2

Bash

adcli join -U admin --host-keytab=/etc/krb5.keytab.adtwo.local adtwo.local

need to edit sssd.conf :

Bash

[sssd]
domains = adone.com
config_file_version = 2
services = nss, pam






[domain/adone.com]
ad_domain = adone.com
krb5_realm = ADONE.com
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%d/%u
access_provider = ad
#enumerate = True
timeout = 3600
dyndns_update = false
ad_gpo_access_control = permissive








[domain/adtwo.local]
ad_domain = adtwo.local
krb5_realm = ADTWO.local
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%d/%u
access_provider = ad
timeout = 3600
krb5_keytab = /etc/krb5.keytab.adtwo.local
ldap_krb5_keytab = /etc/krb5.keytab.adtwo.local
ad_gpo_access_control = permissive

Alles anzeigen

That work for add two ldap

liberodark · 26. Februar 2020

OK that is not a tutorial is my experience returns.
Now have two LDAP but dont see users in OMV but.
If you run id user from ldap 1 or 2 is work.
same for getent passwd user ldap 1 or 2 is work

liberodark · 26. Februar 2020

Anyone have idea ?

How to join two AD ?

Jetzt mitmachen!

Tags