To support True SSO on a SLED 12.x SP3 or SLES 12.x SP3 desktop, integrate the desktop with an Active Directory domain using the Samba and Winbind solutions.

Use the following procedure to integrate a SLED/SLES desktop with an AD domain.

Prerequisites

  • The Active Directory (AD) server is resolvable by DNS on the Linux system.
  • The Network Time Protocol (NTP) is configured on the Linux system.

Procedure

  1. On your SLED/SLES desktop, install the samba and winbind packages. 
    zypper install samba-winbind krb5-client samba-winbind-32bit
  2. Open the YaST setup tool and navigate to Network Services > Windows Domain Membership.
  3. On the Windows Domain Membership screen, configure settings as follows.
    1. For Domain or Workgroup, enter the DNS name of the workgroup or NT domain that includes your Samba server, using all capital letters. For example, if your workgroup name is mydomain, enter MYDOMAIN.
    2. Select Also Use SMB Information for Linux Authentication.
    3. Select Create Home Directory on Login.
    4. Select Offline Authentication.
    5. Select Single Sign-on for SSH.
  4. At the prompt asking if you want to join the domain, select Yes.
  5. Enter the administrator name and password for the specified workgroup, and select OK.
    A message appears confirming that your SLED/SLES desktop joined the domain successfully. Select OK.
  6. Edit the /etc/samba/smb.conf configuration file so that it includes the following parameter. 
    [global]
...
winbind use default domain = yes
  7. Reboot your system and log back in.
  8. Test and verify your SLED/SLES desktop integration.
    Run the following test commands and check that they return the correct output. Replace mydomain with the name of your Samba server workgroup or NT domain.
    • net ads testjoin
    • net ads info
    • wbinfo --krb5auth=mydomain\\open%open
    • ssh localhost -l mydomain\\open

What to do next

Configure True SSO on SLED/SLES Desktops