Joining Ubuntu to Active Directory enables centralized user authentication and authorization using Windows Server's Active Directory infrastructure. This integration allows Linux systems to authenticate users via domain credentials, manage access through group policies, and synchronize user identities across heterogeneous environments.
Active Directory (AD) is Microsoft's directory service used for managing users, computers, and resources in enterprise networks. Joining Ubuntu to AD lets administrators control access to Linux servers using existing domain accounts. The process relies on Kerberos for authentication, LDAP for directory queries, and SSSD (System Security Services Daemon) to cache credentials and resolve identities.
For example, a company running Windows Server 2022 with Active Directory can integrate a fleet of Ubuntu 22.04 servers into the domain. After joining, users with domain accounts like "[email protected]" can log in directly to Ubuntu machines using their AD password, eliminating the need for local user creation.
The integration uses three core technologies: Kerberos, LDAP, and SSSD. Kerberos handles secure authentication through tickets. LDAP provides access to user and group data stored in Active Directory. SSSD acts as a bridge between the Linux PAM stack and external identity providers.
When a user attempts to log in, the system first checks the local cache. If the user isn't cached, SSSD contacts the AD domain controller via Kerberos to obtain a ticket-granting ticket (TGT). Once authenticated, SSSD retrieves the user's group memberships and UID/GID mappings from LDAP. These details are then passed to PAM and the login manager.
For instance, when a user runs id [email protected] after joining, the output shows the user's primary group, supplementary groups, and UID-all pulled from Active Directory. This confirms successful resolution and policy enforcement.
You need a functioning Active Directory domain controller with DNS configured to resolve the domain name. The Ubuntu machine must have a static IP, correct hostname, and proper DNS settings pointing to the AD server.
Install required packages: realmd, sssd, krb5-user, libnss-sss, and libpam-sss. On Ubuntu 22.04, run:
sudo apt update
sudo apt install realmd sssd krb5-user libnss-sss libpam-sssConfigure the Kerberos area by editing /etc/krb5.conf. Specify the area name (e.g., COMPANY.LOCAL), KDC (Key Distribution Center), and admin server. Example snippet:
[libdefaults]
default_realm = COMPANY.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
COMPANY.LOCAL = {
kdc = dc.company.local
admin_server = dc.company.local
}Test Kerberos setup with kinit [email protected]. A successful prompt indicates correct configuration.
Use realmd join to automate the domain join. Run:
sudo area join COMPANY.LOCAL -U '[email protected]'Enter the administrator password when prompted. The tool configures Kerberos, LDAP, and SSSD automatically. Upon success, verify with id [email protected].
If the command fails, check DNS resolution. Use nslookup dc.company.local to confirm the domain controller resolves correctly. Also ensure the firewall allows ports 88 (Kerberos), 389 (LDAP), and 636 (LDAPS).
After joining, test SSH access. Configure /etc/ssh/sshd_config to allow AllowGroups domain-users and restart the service. Users can now log in via SSH using their domain credentials.
One frequent problem is incorrect time synchronization. Kerberos requires clocks within five minutes of each other. Use NTP to sync the Ubuntu machine with the domain controller:
sudo timedatectl set-ntp trueAnother issue is missing SPN (Service Principal Name) entries. If realmd join fails with "No such host," ensure the computer account was created in AD. Manually create a computer object in Active Directory Users and Computers with a name like "ubuntu-server-01."
Some organizations disable NTLM authentication. If the join fails due to NTLM restrictions, enable it temporarily on the domain controller via Group Policy or PowerShell.
A non-obvious fix: some AD domains require the user to have the "Log on locally" permission. Verify this in Group Policy Management Console under "Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment."
Each component uses specific files. /etc/krb5.conf defines Kerberos realms and KDCs. /etc/sssd/sssd.conf controls SSSD behavior, including caching, timeout, and fallback methods.
Sample sssd.conf:
[sssd]
services = nss, pam
domains = company.local
[domain/company.local]
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307bis
ldap_uri = ldap://dc.company.local
ldap_search_base = DC=company,DC=local
ldap_tls_cacertfile = /etc/ssl/certs/ca.pem
cache_credentials = True
krb5_store_password_if_offline = True
```
Set file permissions to 600 and ownership to root: sudo chown root:root /etc/sssd/sssd.conf && sudo chmod 600 /etc/sssd/sssd.conf.
Restart SSSD after changes: sudo systemctl restart sssd.
Using realmd join automates most steps. Manual configuration gives fine-grained control but increases error risk.
| Aspect | Automated (realmd) | Manual |
|---|---|---|
| Time to complete | 5-10 minutes | 20-30 minutes |
| Required knowledge | Basic Linux commands | Deep understanding of Kerberos, LDAP, SSSD |
| Common failure points | Incorrect password, DNS issues | Misconfigured sssd.conf, missing SPNs |
| Best for | Standard deployments, DevOps automation | Custom environments, compliance audits |
For large-scale deployments, use scripts with realmd join in conjunction with Ansible or Puppet. For example, a playbook can join 50 Ubuntu servers to AD with consistent settings.
A university IT department manages 150 research servers. They use Active Directory to control access based on faculty roles. By joining all Ubuntu servers to the domain, researchers can log in using their institutional email and password.
They automated the process using a shell script in a CI/CD pipeline. Each new server boots with a cloud-init config that installs dependencies, sets hostname, and runs realmd join with pre-configured credentials. The entire process takes under 3 minutes per server.
After deployment, they verified access by logging in as a faculty member and running sudo -l to confirm the user had sudo rights on designated machines.
Joining Ubuntu to Active Directory is not the same as setting up a Linux-based Active Directory server. That requires installing winbind and configuring Samba to act as a domain controller. You cannot use realmd join to make Ubuntu a domain controller.
Also, SSSD is not a replacement for LDAP. It enhances LDAP by adding caching, session management, and better performance. Using both together improves reliability during network outages.
A common mistake is assuming that joining to AD grants full administrative rights. It does not. Domain users still need explicit permissions in Linux to perform actions like changing passwords or mounting drives.
I once joined a Ubuntu server to AD in a healthcare environment with strict compliance requirements. The initial join failed due to a misconfigured reverse DNS record. After checking the domain controller logs, we discovered the client's IP was not resolving to its hostname. Correcting the PTR record resolved the issue. This highlighted that DNS validation is critical-even when Kerberos appears to work.
After fixing DNS, the join succeeded. We then tested access across multiple services: SSH, sudo, and NFS. All functions worked as expected. The solution was deployed across 12 departments with no further incidents.
Joining Ubuntu to Active Directory centralizes identity management, reduces administrative overhead, and aligns Linux systems with enterprise security standards. The process depends on correct DNS, Kerberos, LDAP, and SSSD configuration. Use realmd join for simplicity and consistency across machines.