realmd

Installation and configuration of Realmd package

Sebastien Lamy

jza34

11,505 downloads

6,897 latest version

4.9 quality score

Version information

  • 1.1.0 (latest)
  • 1.0.6
  • 1.0.5
  • 1.0.4
  • 1.0.3
  • 1.0.2
  • 0.1.1
  • 0.1.0
released May 30th 2016
This version is compatible with:
  • Debian

Start using this module

Documentation

jza34/realmd — version 1.1.0 May 30th 2016

realmd

Table of Contents

  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Setup - The basics of getting started with realmd
  4. Usage - Configuration options and additional functionality
  5. Reference - An under-the-hood peek at what the module is doing and how
  6. Limitations - OS compatibility, etc.
  7. Development - Guide for contributing to the module

Overview

Prepare the client to be enrolled with realmd. Apply it then use realm command to enrolled the client.

Module Description

It installs all extra packages Realmd ask for when discovering a samba4 controller.

It declares the "sssd" service and make sure it runs!

It fixes a "bug" aborting the join when the directory /var/lib/samba/private is not found. (it creates this directory)

It configures PAM to make home directories of users who successfully log in with a Samba4 account

Setup

Include this class "Realmd".

Log in the client, apply puppet then:

realm join MYDOMAIN.COM

After prompting for the samba4 administrator password, if join is successful you can login with a samba4 user credential:

su mydomainuser

You should be authenticated and your homedirectory created

Parameters

use fully qualified names

A boolean to set the sssd.conf value for use_fully_qualified_names.

When true then domain users must use a login with @my.domain.name at the end

Example: su seb@example.com.fr

When false then domain users need no more the domain name.

Example: su seb

(Default false)

ldap id mapping

A boolean to set the sssd.conf value for ldap_id_mapping.

When true then the host will not use IDs from the domain controller. The host will create a intermediate database with IDs. It is necessary when the controller does not keep UNix-like ids in its database.

When false then no IDs is created from the host but they are queried to the domain controller (like family name, etc...)

It is an important parameter because these IDs are written to the host disk in the home folder for the domain users

If false you keep same id for same user everywhere because it is managed by the controller

If true every host will generate different IDs for same user!

But you must be certain that the domain controller has UNix-ids in its database for all users, and a unique one...

Please note that to change this parameter after enrolment will cause domain users home folders unusable beacause bad IDs.

If ldap id mapping value changes, puppet agent will rename /home/MYREALM to /home/MYREALM.bak

(Default false)

disable pwquality

Disable local password policy and use the one from the samba4 controller.

Please note that it will change pam.d files and will make the PAM utility pam-auth-config unusable.

Be careful if you customize this part because you can lock you out from the host if PAM is badly touched...

(Default true)

homedir

A string representing the path where realm users will create their homedir

(Default /home/$::realm_domain)

Reference

PAM SSSD Samba4

Limitations

At this point it is Debian only but RedHat users may easily adapt it. Work in progress.

Development

1.1.0

  • Remove params.pp and put all variables in init.pp
  • Remove parameter realm_name replaced by a new external fact realm_domain
  • New paramater 'homedir' to set the 'sssd.conf' value 'override_homedir'

1.0.7

  • Better README