<div dir="ltr">RHEL IdM or the upstream FreeIPA solution. It can auth against AD but handles the ID/GID, etc. for RHEL users. Uses kerberos and LDAP.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 30, 2014 at 10:45 AM, James Sumners <span dir="ltr"><<a href="mailto:james.sumners@gmail.com" target="_blank">james.sumners@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I administer RHEL systems in an environment that is primarily managed by a Windows domain. That is, Active Directory (AD) controls usernames, passwords, and all that jazz. I have my RHEL systems _authenticating_ against AD but that's it. I don't pull user ids, group ids, shells, group memberships, or anything else out of AD. I'm at the point where I want to move in that direction, though. And that's where I'd like some input from the list...<div><br></div><div>I can work with the AD administrator to get whatever attributes added that I need to make such a scenario work. But I wonder if that's worth it. Would it be better to setup a vanilla LDAP server specifically manage the RHEL users? If I did that, would I be able to pass the authentication along to the AD server but get the details out of the LDAP server? Or should I setup a Kerberos server that communicates with AD in addition to the LDAP server?</div><div><br></div><div>What are you guy's experience in this regard? How did you solve this problem?<span class="HOEnZb"><font color="#888888"><br clear="all"><div><br></div>-- <br>James Sumners<br><a href="http://james.roomfullofmirrors.com/" target="_blank">http://james.roomfullofmirrors.com/</a><br><br>"All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted."<br><br>Missionaria Protectiva, Text QIV (decto)<br>CH:D 59
</font></span></div></div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr">-- <br>James P. Kinney III<br><i><i><i><i><br></i></i></i></i>Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.<br>
- Speech 11/23/1900 Mark Twain<br><i><i><i><i><br><a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br></i></i></i></i></div>
</div>