Active Directory Client

Active Directory (AD) is a directory service that lets you login to multiple computers with the same username, password, id, and group memberships. It has other useful purposes such as security groups and mailing lists.

Basic Setup

1. Create /etc/nixos/nixos-ad.nix and add the following. Replace your_domain_lowercase and YOUR_DOMAIN_UPPERCASE with something like ad.foobar.com and AD.FOOBAR.COM.

     #
     # nixos-ad.nix -- Active Directory Client
     #
     # Join AD: sudo adcli join --domain=your.domain.com --user=administrator
     #
     {
       config,
       pkgs,
       ...
     }: {
       #
       # Packages
       #
       environment.systemPackages = with pkgs; [
         adcli # Helper library and tools for Active Directory client operations
         realmd # Diagnostic command; Does not configure AD client on NixOS
         samba # Standard Windows interoperability suite of programs for Linux and Unix
       ];
   
       #
       # Security
       #
       security = {
         krb5 = {
           enable = true;
           settings = {
             libdefaults = {
               udp_preference_limit = 0;
               default_realm = "YOUR_DOMAIN_UPPERCASE";
             };
           };
         };
   
         pam = {
           makeHomeDir.umask = "077";
           services.login.makeHomeDir = true;
           services.sshd.makeHomeDir = true;
         };
   
         sudo = {
           # Use extraConfig because of blank space in 'domain admins'.
           extraConfig = ''
             %domain\ admins ALL=(ALL:ALL) NOPASSWD: ALL
             Defaults:%domain\ admins env_keep+=TERMINFO_DIRS
             Defaults:%domain\ admins env_keep+=TERMINFO
           '';
         };
       };
   
       #
       # Services
       #
       services = {
         resolved.enable = true;
   
         sssd = {
           enable = true;
           config = ''
             [sssd]
             domains = your_domain_lowercase
             config_file_version = 2
             services = nss, pam
   
             [pam]
             offline_credentials_expiration = 365
   
             [domain/your_domain_lowercase]
             override_shell = /run/current-system/sw/bin/zsh
             krb5_store_password_if_offline = true
             cache_credentials = true
             account_cache_expiration = 365
             entry_cache_timeout = 14400
             krb5_realm = YOUR_DOMAIN_UPPERCASE
             realmd_tags = manages-system joined-with-samba
             id_provider = ad
             fallback_homedir = /home/%u
             ad_domain = your_domain_lowercase
             use_fully_qualified_names = false
             ldap_id_mapping = false
             auth_provider = ad
             access_provider = ad
             chpass_provider = ad
             ad_gpo_access_control = permissive
             enumerate = true
           '';
         };
       };
     }
     ```
   

Note

• As of NixOS 25.11 services.nscd.enable and services.nscd.enableNsncd default to TRUE. They are required to successfully use the sssd Active Directory client.
• It’s my personal custom to leave out default options, unless I’m overriding them. Feel free to declare services.nscd.enable = true; and services.nscd.enableNsncd = true; in your nixos-ad.nix if you prefer a more explicit configuration.

2. Update your configuration.nix to import ./nixos-ad.nix

     imports =
       [
         ./hardware-configuration.nix
         ./nixos-ad.nix
       ]
   

3. nix-channel --update ; nixos-switch rebuild --upgrade

Note

• These commands presume that you are using classic NixOS channels and not an experimental flakes configuration.
• These commands will freshen all installed packages and configuration settings.
• If you experience an error from systemd/sssd, disregard it. You will fix that error by joining the domain.

4. Join your domain

   sudo adcli join --domain=your.domain.com --user=administrator

5. Restart SSSD

   sudo systemctl restart sssd

6. Confirm that you have successfully joined your AD

   realm discover your_domain_lowercase

   id user_in_AD

7. Optional: You may reboot to ensure that your machine sustains its domain binding and that end users can login. As of 2024, the adcli join and sssd restart seem to be sufficient.

8. Optional: If the computer is a laptop, add users to the NixOS local networkmanager group so they can add a WiFI network, switch between wireless/wired, and so on.

     users.groups.networkmanager.members = ["user_in_AD"];
   

Note: Linux local groups do not support nesting of AD groups. You have to grant access to individual users.