Active Directory Client - Revision history

Jkotran: Corrected homedir. I use Users like on macOS, but home is the Linux custom.

2026-05-28T03:26:35Z

Corrected homedir. I use Users like on macOS, but home is the Linux custom.

← Older revision		Revision as of 03:26, 28 May 2026
Line 79:		Line 79:
	realmd_tags = manages-system joined-with-adcli		realmd_tags = manages-system joined-with-adcli
	id_provider = ad		id_provider = ad
	fallback_homedir = /~~Users~~/%u		fallback_homedir = /home/%u
	ad_domain = your_domain_lowercase		ad_domain = your_domain_lowercase
	use_fully_qualified_names = False		use_fully_qualified_names = False

Jkotran: Improved reliability of off-network laptops and login/screen unlock after PC sleep.

2026-05-28T03:21:34Z

Improved reliability of off-network laptops and login/screen unlock after PC sleep.

← Older revision		Revision as of 03:21, 28 May 2026
Line 29:		Line 29:
	#		#
	security = {		security = {
			# Kerberos
	krb5 = {		krb5 = {
	enable = true;		enable = true;
Line 39:		Line 40:
	};		};

			# Create a home directory when an AD user logs in
	pam = {		pam = {
	makeHomeDir.umask = "077";		makeHomeDir.umask = "077";
Line 45:		Line 47:
	};		};

			# Grant AD Domain Admin full sudo on Linux machines
	sudo = {		sudo = {
	# Use extraConfig because of blank space in 'domain admins'.		# Use extraConfig because of blank space in 'domain admins'.
Line 68:		Line 71:
	config_file_version = 2		config_file_version = 2
	services = nss, pam		services = nss, pam

	~~[pam]~~
	~~offline_credentials_expiration = 365~~

	[domain/your_domain_lowercase]		[domain/your_domain_lowercase]
	override_shell = /run/current-system/sw/bin/zsh		override_shell = /run/current-system/sw/bin/zsh
	krb5_store_password_if_offline = ~~true~~		krb5_store_password_if_offline = True
	cache_credentials = ~~true~~		cache_credentials = True
	~~account_cache_expiration = 365~~
	~~entry_cache_timeout = 14400~~
	krb5_realm = YOUR_DOMAIN_UPPERCASE		krb5_realm = YOUR_DOMAIN_UPPERCASE
	realmd_tags = manages-system joined-with-~~samba~~		realmd_tags = manages-system joined-with-adcli
	id_provider = ad		id_provider = ad
	fallback_homedir = /~~home~~/%u		fallback_homedir = /Users/%u
	ad_domain = your_domain_lowercase		ad_domain = your_domain_lowercase
	use_fully_qualified_names = ~~false~~		use_fully_qualified_names = False
	ldap_id_mapping = ~~false~~		ldap_id_mapping = False
			access_provider = ad
			# Red Hat recommendation to reduce server queries
			entry_cache_timeout = 14400
	auth_provider = ad		auth_provider = ad
	~~access_provider = ad~~
	chpass_provider = ad		chpass_provider = ad
	ad_gpo_access_control = ~~permissive~~		ad_gpo_access_control = disabled
	enumerate = ~~true~~		enumerate = False
			dyndns_update = False
			# Red Hat recommendation to reduce terminated by own WATCHDOG
			timeout = 20
			# Fast fallback in case of server interruption/unavailability
			ldap_network_timeout = 3
			ldap_opt_timeout = 10
	'';		'';
	};		};
	};		};
	}		}</syntaxhighlight>
	~~```~~</syntaxhighlight><~~/li></ol~~>		<p>'''Note'''</p>
			<ul>
	'''Note'''		<li>As of NixOS 25.11 services.nscd.enable and services.nscd.enableNsncd default to TRUE. They are required to successfully use the sssd Active Directory client.</li>
			<li>It’s my personal custom to leave out default options, unless I’m overriding them. Feel free to declare services.nscd.enable = true; and services.nscd.enableNsncd = true; in your nixos-ad.nix if you prefer a more explicit configuration.</li></ul>
	* As of NixOS 25.11 services.nscd.enable and services.nscd.enableNsncd default to TRUE. They are required to successfully use the sssd Active Directory client.		</li>
	* It’s my personal custom to leave out default options, unless I’m overriding them. Feel free to declare services.nscd.enable = true; and services.nscd.enableNsncd = true; in your nixos-ad.nix if you prefer a more explicit configuration.

	<~~ol start="2" style="list-style-type: decimal;"~~>
	<li><p>Update your configuration.nix to import ./nixos-ad.nix</p>		<li><p>Update your configuration.nix to import ./nixos-ad.nix</p>
	<syntaxhighlight lang="nix"> imports =		<syntaxhighlight lang="nix"> imports =
Line 108:		Line 111:
	./nixos-ad.nix		./nixos-ad.nix
	]</syntaxhighlight></li>		]</syntaxhighlight></li>
	<li><p><code>nix-channel --update ; nixos-switch ~~rebuild~~ --upgrade</code></p><~~/li~~>~~</ol>~~		<li><p>Apply NixOS configuration</p>
			<p><code>nix-channel --update && nixos-rebuild switch --upgrade</code></p>
	'''Note'''		<p>'''Note'''</p>
			<ul>
	* These commands presume that you are using classic NixOS channels and not an experimental flakes configuration.		<li>These commands presume that you are using classic NixOS channels and not an experimental flakes configuration.</li>
	* These commands will freshen all installed packages and configuration settings.		<li>These commands will freshen all installed packages and configuration settings.</li>
	* If you experience an error from systemd/sssd, disregard it. You will fix that error by joining the domain.		<li>If you experience an error from systemd/sssd, disregard it. You will fix that error by joining the domain.</li></ul>
			</li>
	<~~ol start="4" style="list-style-type: decimal;"~~>
	<li><p>Join your domain</p>		<li><p>Join your domain</p>
	<p><code>sudo adcli join --domain=your.domain.com --user=administrator</code></p></li>		<p><code>sudo adcli join --domain=your.domain.com --user=administrator</code></p></li>
Line 128:		Line 130:
	<syntaxhighlight lang="nix"> users.groups.networkmanager.members = ["user_in_AD"];</syntaxhighlight></li></ol>		<syntaxhighlight lang="nix"> users.groups.networkmanager.members = ["user_in_AD"];</syntaxhighlight></li></ol>

	Note: Linux local groups do not support nesting of AD groups. You have to grant access to individual users.		'''Note:''' Linux local groups do not support nesting of AD groups. You have to grant access to individual users.

	[[Category:Cookbook]]		[[Category:Cookbook]]

Jkotran: Minor cleanup and freshening

2025-12-09T04:17:08Z

Minor cleanup and freshening

Show changes

Jkotran: Added note about default settings

2025-11-28T04:57:51Z

Added note about default settings

← Older revision		Revision as of 04:57, 28 November 2025
Line 105:		Line 105:

	* As of NixOS 25.11 services.nscd.enable and services.nscd.enableNsncd default to TRUE. They are required to successfully use the sssd Active Directory client.		* As of NixOS 25.11 services.nscd.enable and services.nscd.enableNsncd default to TRUE. They are required to successfully use the sssd Active Directory client.
			* It's my personal custom to leave out default options, unless I'm overriding them. Feel free to declare services.nscd.enable = true; and services.nscd.enableNsncd = true; in your nixos-ad.nix if you prefer a more explicit configuration.

	2) Update your configuration.nix to import ./nixos-ad.nix		2) Update your configuration.nix to import ./nixos-ad.nix

Jkotran: Added note about default settings

2025-11-28T04:55:10Z

Added note about default settings

← Older revision		Revision as of 04:55, 28 November 2025
Line 101:		Line 101:
	}		}
	</syntaxhighlight>		</syntaxhighlight>

			'''Note'''

			* As of NixOS 25.11 services.nscd.enable and services.nscd.enableNsncd default to TRUE. They are required to successfully use the sssd Active Directory client.

	2) Update your configuration.nix to import ./nixos-ad.nix		2) Update your configuration.nix to import ./nixos-ad.nix

Jkotran: Updated guidance for NixOS 25.11

2025-11-28T04:51:52Z

Updated guidance for NixOS 25.11

@@ Line 65: / Line 65: @@
+   #
    services = {
-     nscd = {
+     resolved.enable = true;
      sssd = {

Jkotran: Minor: Clarified intent of installing realmd package.

2025-06-09T16:07:38Z

Minor: Clarified intent of installing realmd package.

← Older revision		Revision as of 16:07, 9 June 2025
Line 21:		Line 21:
	environment.systemPackages = with pkgs; [		environment.systemPackages = with pkgs; [
	adcli # Helper library and tools for Active Directory client operations		adcli # Helper library and tools for Active Directory client operations
	realmd # ~~DBus service for configuring Kerberos and other~~		realmd # Diagnostic command; Does not configure AD client on NixOS
	samba # Standard Windows interoperability suite of programs for Linux and Unix		samba # Standard Windows interoperability suite of programs for Linux and Unix
	];		];

Jkotran: Put realmd back because realm is a useful diagnostic aid.

2025-05-07T21:36:17Z

Put realmd back because realm is a useful diagnostic aid.

← Older revision		Revision as of 21:36, 7 May 2025
Line 21:		Line 21:
	environment.systemPackages = with pkgs; [		environment.systemPackages = with pkgs; [
	adcli # Helper library and tools for Active Directory client operations		adcli # Helper library and tools for Active Directory client operations
			realmd # DBus service for configuring Kerberos and other
	samba # Standard Windows interoperability suite of programs for Linux and Unix		samba # Standard Windows interoperability suite of programs for Linux and Unix
	];		];

Jkotran: Enabled long term credential caching for offline laptops. Simplified setup. oddjobd and realmd are irrelevant to NixOS.

2025-05-07T21:33:47Z

Enabled long term credential caching for offline laptops. Simplified setup. oddjobd and realmd are irrelevant to NixOS.

← Older revision		Revision as of 21:33, 7 May 2025
Line 21:		Line 21:
	environment.systemPackages = with pkgs; [		environment.systemPackages = with pkgs; [
	adcli # Helper library and tools for Active Directory client operations		adcli # Helper library and tools for Active Directory client operations
	~~oddjob # Odd Job Daemon~~		samba # Standard Windows interoperability suite of programs for Linux and Unix
	~~samba4Full~~ # Standard Windows interoperability suite of programs for Linux and Unix
	~~sssd # System Security Services Daemon~~
	~~krb5 # MIT Kerberos 5~~
	~~realmd # DBus service for configuring Kerberos and other~~
	];		];

Line 90:		Line 86:
	config_file_version = 2		config_file_version = 2
	services = nss, pam		services = nss, pam

			[pam]
			offline_credentials_expiration = 365

	[domain/your_domain_lowercase]		[domain/your_domain_lowercase]
	override_shell = /run/current-system/sw/bin/zsh		override_shell = /run/current-system/sw/bin/zsh
	krb5_store_password_if_offline = ~~True~~		krb5_store_password_if_offline = true
	cache_credentials = ~~True~~		cache_credentials = true
			account_cache_expiration = 365
			entry_cache_timeout = 14400
	krb5_realm = YOUR_DOMAIN_UPPERCASE		krb5_realm = YOUR_DOMAIN_UPPERCASE
	realmd_tags = manages-system joined-with-samba		realmd_tags = manages-system joined-with-samba
Line 108:		Line 109:
	enumerate = true		enumerate = true
	'';		'';
	};
	};

	#
	~~# Systemd~~
	#
	~~systemd = {~~
	~~services.realmd = {~~
	~~description = "Realm Discovery Service";~~
	~~wantedBy = ["multi-user.target"];~~
	~~after = ["network.target"];~~
	~~serviceConfig = {~~
	~~Type = "dbus";~~
	~~BusName = "org.freedesktop.realmd";~~
	~~ExecStart = "${pkgs.realmd}/libexec/realmd";~~
	~~User = "root";~~
	};
	};		};
	};		};

Jkotran: Minor grammar fix

2024-10-31T16:04:00Z

Minor grammar fix

← Older revision		Revision as of 16:04, 31 October 2024
Line 146:		Line 146:
	* These commands presume that you're using the classic NixOS channels and not the experimental flakes configuration.		* These commands presume that you're using the classic NixOS channels and not the experimental flakes configuration.
	* These commands will freshen all installed packages and configuration settings.		* These commands will freshen all installed packages and configuration settings.
	* If you experience an error from systemd/sssd, disregard it. You will fix that error, by joining the domain.		* If you experience an error from systemd/sssd, disregard it. You will fix that error by joining the domain.

	4) Join your domain		4) Join your domain