Active Directory Integration

OmniOS can integrate itself into an active directory domain as an smb file server and it can use an active directory server for both login authentication as well as to provide name services for user accounts.

Preparing the System

Use AD as your dns server

# cat <<CFG_END >/etc/resolv.conf nameserver 10.1.1.1 domain my-ad-domain.local search my-ad-domain.local CFG_END 

Enable ntp as precise time is essential for kerberos operation.

# svcadm enable network/ntp 

Hooking up Kerberos

Install Kerberos support

# pkg install system/security/kerberos-5 

Setup Kerberos for MS Active Directory (ms_ad)

# kclient -T ms_ad # kinit -V administrator 

Enabling SMB Filesharing

To make sure we have the same user id numbers everywhere we want to keep them in Active Direcory.

# svccfg -s svc:/system/idmap setprop config/directory_based_mapping=astring: idmu # svcadm refresh svc:/system/idmap 

Make sure you have the following properties configured for every user in your active directory:

* uid (username) * uidNumber * gidNumber * homeDirectory * loginShell * gecos 

# sharectl set -p lmauth_level=5 smb # sharectl set -p system_comment="My Funny Fileserver" smb # svcadm enable -r smb/server 

Name Service Integration

The illumos active directory plugin does not support full login integration, therefore we have to setup a proxy ldap user and then configure the ldap client to enable unix logins with ldap accounts. The proxy AD user has to have appropriate rights to read the user account entries.

Now configure the ldap client accordingly

ldapclient manual \ -a credentialLevel=proxy \ -a authenticationMethod=simple \ -a proxyDN="cn=omnios ldap,cn=Users,dc=my-ad-domain,dc=local" \ -a proxyPassword=Plain Password \ -a defaultSearchBase=dc=my-ad-domain,dc=local \ -a domainName=my-ad-domain.local \ -a followReferrals=false \ -a defaultServerList=ad.my-ad-domain.local \ -a attributeMap=group:userpassword=userPassword \ -a attributeMap=group:memberuid=memberUid \ -a attributeMap=group:gidnumber=gidNumber \ -a attributeMap=passwd:gecos=gecos \ -a attributeMap=passwd:gidnumber=gidNumber \ -a attributeMap=passwd:uidnumber=uidNumber \ -a attributeMap=passwd:homedirectory=HomeDirectory \ -a attributeMap=passwd:loginshell=loginShell \ -a attributeMap=shadow:shadowflag=shadowFlag \ -a attributeMap=shadow:userpassword=userPassword \ -a objectClassMap=group:posixGroup=group \ -a objectClassMap=passwd:posixAccount=user \ -a objectClassMap=shadow:shadowAccount=user \ -a serviceSearchDescriptor=passwd:dc=my-ad-domain,dc=local?sub \ -a serviceSearchDescriptor=group:dc=my-ad-domain,dc=local?sub 

Make sure that /etc/nsswitch.conf only has ldap entries for passwd and group plus dns for hosts:

# ... passwd: files ldap ad group: files ldap ad # ... hosts: files dns ipnodes: files dns # ... 

Finally pam must be told to use kerberos where appropriate via /etc/pam.conf the entries are most likely already present you just have to remove the comment character #. See man pam_krb5 for details.

login auth sufficient pam_krb5.so.1 krlogin auth required pam_krb5.so.1 krsh auth required pam_krb5.so.1 ktelnet auth required pam_krb5.so.1 other auth sufficient pam_krb5.so.1 

Testing

Your OmniOS server should now be accessible as smb fileserver from windows clients allowing for SSO access.

On the omnios command line you should see all accounts using with getent passwd just create appropriate home directories and chown them to the users.

Thanks

Thanks to Manuel Oetiker for help in figuring this all out.

If you have any have input on how to improve this setup or the documentation, please be in touch.