Search code examples
linuxactive-directoryfreeipasssd

Can we use Windows Active Directory to authenticate Linux/Unix servers and manage users/groups from AD itself


We have tried sssd utility which does LDAP auth to windows AD however we have to manage individual servers for user/group permissions, there is no central management with sssd.

Also, we are trying to use FREEIPA but seems like it's another directory service and we need to create another domain and then establish trust between windows domain & IPA domain however we don't want to choose that route.

Is there a way to just integrate the FreeIPA with windows AD without creating FREEIPA domain.


Solution

  • No, there is no such way. FreeIPA is not a tool, it is full functioning identity management system, similar to Active Directory but for POSIX environments. You aren't deploying it on a single machine as a separate application.

    There are plenty other tools that utilise existing Active Directory deployment to store own information and handle Linux machines but most of them are commercially available.

    However, I wonder why you are claiming there is no central management with SSSD for direct AD integration. SSSD with id_provider = ad supports group policies in AD, so you can apply those rules centrally. Technically you also can store SUDO rules in AD LDAP, though it wouldn't be easily manageable compared to FreeIPA.