The following packages are needed: krb5-user, samba, sssd, and ntp. Samba needs to be installed, even if the system is not exporting shares. The Kerberos realm and FQDN or IP of the domain controllers are needed for this step.

Install these packages now.

sudo apt install krb5-user samba sssd ntp

See the next section for the answers to the questions asked by the krb5-user postinstall script.

The installation of krb5-user will prompt for the realm name (in ALL UPPERCASE), the kdc server (i.e. domain controller) and admin server (also the domain controller in this example.) This will write the [realm] and [domain_realm] sections in /etc/krb5.conf. These sections may not be necessary if domain autodiscovery is working. If not, then both are needed.

If the domain is myubuntu.example.com, enter the realm as MYUBUNTU.EXAMPLE.COM

Optionally, edit /etc/krb5.conf with a few additional settings to specify Kerberos ticket lifetime (these values are safe to use as defaults):

[libdefaults]

default_realm = MYUBUNTU.EXAMPLE.COM
ticket_lifetime = 24h #
renew_lifetime = 7d
		

If default_realm is not specified, it may be necessary to log in with « username@domain » instead of « username ».

The system time on the Active Directory member needs to be consistent with that of the domain controller, or Kerberos authentication may fail. Ideally, the domain controller server itself will provide the NTP service. Edit /etc/ntp.conf:

server dc.myubuntu.example.com

Samba will be used to perform netbios/nmbd services related to Active Directory authentication, even if no file shares are exported. Edit the file /etc/samba/smb.conf and add the following to the [global] section:

[global]

workgroup = MYUBUNTU
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
realm = MYUBUNTU.EXAMPLE.COM
security = ads

There is no default/example config file for /etc/sssd/sssd.conf included in the sssd package. It is necessary to create one. This is a minimal working config file:

[sssd]
services = nss, pam
config_file_version = 2
domains = MYUBUNTU.EXAMPLE.COM

[domain/MYUBUNTU.EXAMPLE.COM]
id_provider = ad
access_provider = ad

# Use this if users are being logged in at /.
# This example specifies /home/DOMAIN-FQDN/user as $HOME.  Use with pam_mkhomedir.so
override_homedir = /home/%d/%u

# Uncomment if the client machine hostname doesn't match the computer object on the DC.
# ad_hostname = mymachine.myubuntu.example.com

# Uncomment if DNS SRV resolution is not working
# ad_server = dc.mydomain.example.com

# Uncomment if the AD domain is named differently than the Samba domain
# ad_domain = MYUBUNTU.EXAMPLE.COM

# Enumeration is discouraged for performance reasons.
# enumerate = true

After saving this file, set the ownership to root and the file permissions to 600:

sudo chown root:root /etc/sssd/sssd.conf

sudo chmod 600 /etc/sssd/sssd.conf

If the ownership or permissions are not correct, sssd will refuse to start.

The post-install script for the sssd package makes some modifications to /etc/nsswitch.conf automatically. It should look something like this:

passwd:         compat sss
group:          compat sss
...
netgroup:       nis sss
sudoers:        files sss

Add an alias to the localhost entry in /etc/hosts specifying the FQDN. For example:

192.168.1.10 myserver myserver.myubuntu.example.com

This is useful in conjunction with dynamic DNS updates.

Now, restart ntp and samba and start sssd.

sudo systemctl restart ntp.service
sudo systemctl restart smbd.service nmbd.service 
sudo systemctl start sssd.service

Test the configuration by obtaining a Kerberos ticket:

sudo kinit Administrator

Verify the ticket with:

sudo klist

If there is a ticket with an expiration date listed, then it is time to join the domain:

sudo net ads join -k

A warning about "No DNS domain configured. Unable to perform DNS Update." probably means that there is no (correct) alias in /etc/hosts, and the system could not provide its own FQDN as part of the Active Directory update. This is needed for dynamic DNS updates. Verify the alias in /etc/hosts described in "Modify /etc/hosts" above.

(The message "NT_STATUS_UNSUCCESSFUL" indicates the domain join failed and something is incorrect. Review the prior steps before proceeding).

Here are a couple of (optional) checks to verify that the domain join was successful. Note that if the domain was successfully joined but one or both of these steps fail, it may be necessary to wait 1-2 minutes and try again. Some of the changes appear to be asynchronous.

Verification option #1:

Check the default Organizational Unit for computer accounts in the Active Directory to verify that the computer account was created. (Organizational Units in Active Directory is a topic outside the scope of this guide).

Verification option #2

Execute this command for a specific AD user (e.g. administrator)

getent passwd username

It should now be possible to authenticate using an Active Directory User's credentials:

su - username

If this works, then other login methods (getty, ssh) should also work.

If the computer account was created, indicating that the system was "joined" to the domain, but authentication is unsuccessful, it may be helpful to review /etc/pam.d and nssswitch.conf as well as the file changes described earlier in this guide.

When logging in using an Active Directory user account, it is likely that user has no home directory. This can be fixed with pam_mkdhomedir.so, which will create the user's home directory on login. Edit /etc/pam.d/common-session, and add this line directly after session required pam_unix.so:

session    required    pam_mkhomedir.so skel=/etc/skel/ umask=0022

It is possible to also authenticate logins to Ubuntu Desktop using Active Directory accounts. The AD accounts will not show up in the pick list with local users, so lightdm will need to be modified. Edit the file /etc/lightdm/lightdm.conf.d/50-unity-greeter.conf and append the following two lines:

greeter-show-manual-login=true
greeter-hide-users=true

Reboot to restart lightdm. It should now be possible to log in using a domain account using either username or username/username@domain format.