Regarding PAM via ldap

Question

I have a question for the authentication between Linux and Windows.

When I get an authentication from the OS system such as Linux, then I can use PAM by configuration of "/pam.d".

However, it's the authentication in local only, and I have to make an authentication from Windows not Linux.

So, I'm looking into /etc/shadows and /etc/nsswitch.conf. There is an article for the tip, but it's not enough for me to configure the file by my self.. ( URL : https://serverfault.com/questions/538383/understand-pam-and-nss/538503#538503 )

Other articles are saying using OpenLDAP, but it's for Linux not Windows.. I guess..

Is there any way to get the authentication from Window servers via LDAP??

For example of 'nsswitch.conf', if I configure the file like following..

passwd:      files dns sss
shadow:      files dns sss

Then, it will find the files first and then look into DNS. Then, how can I configure the DNS or /shadow, etc. for the authentication from the remote.

Thank you so much for reading.

Have you read this? technet.microsoft.com/en-us/library/2008.12.linux.aspx — Gerard H. Pille
– Gerard H. Pille, Commented Jun 7, 2018 at 8:50
Hi, yes I read it but I'm using CentOS7 and Windows Azure. Does it work with the linked information in the condition? And.. it's using 'windbind', but I need to use 'LDAP'. — owcred601
– owcred601, Commented Jun 7, 2018 at 8:57
I'm afraid my head is not up in the cloud. No idea what's possible up there. Windbind, that's a good one ;-) — Gerard H. Pille
– Gerard H. Pille, Commented Jun 7, 2018 at 9:02
I would like to use the easy way, but.. not possible..T.T.. BTW, Thank you. — owcred601
– owcred601, Commented Jun 7, 2018 at 9:06
I just had a look for Windows Azure authentication, and the first DuckDuckGo hit was "Windows Azure Active Directory". So, the old document could still be of value. At my job, it's how Linux authentication is done. Once it's set up, you just have to make sure the clocks stay in sync, but you'd want that anyhow. — Gerard H. Pille
– Gerard H. Pille, Commented Jun 7, 2018 at 9:14

Michael Ströder · Accepted Answer · 2018-07-21 16:51:12Z

Probably you want to install sssd and adjust its config file /etc/sssd/sssd.conf.

There are several options for integrating with MS AD:

The latter might be easier in the beginning, but the former can also provide single-sign via Kerberos.

Note that sssd serves NSS maps passwd, group and sudoers. Adding dns is only useful host the hosts map.

So these parts of /etc/nsswitch.conf should look similar to this:

passwd: files sss group: files sss hosts: files dns

1 Answer 1