Use the following procedure to integrate a RHEL 8.x desktop with an Active Directory (AD) domain for smart card redirection.

Some examples in the procedure use placeholder values to represent entities in your network configuration, such as the DNS name of your AD domain. Replace the placeholder values with information specific to your configuration, as described in the following table.

Placeholder Value Description
dns_IP_ADDRESS IP address of your DNS name server
rhel8sc.rzview2.com Fully qualified host name of your RHEL 8.0 system
rhel8sc Unqualified host name of your RHEL 8.0 system
rzview2.com DNS name of your AD domain
RZVIEW2.COM DNS name of your AD domain, in all capital letters
RZVIEW2 DNS name of the workgroup or NT domain that includes your Samba server, in all capital letters
rzviewdns.rzview2.com Host name of your AD server

Procedure

  1. On your RHEL 8.x system, do the following.
    1. Configure network and DNS settings as required by your organization.
    2. Disable IPv6.
    3. Disable Automatic DNS.
  2. Configure the /etc/hosts configuration file, so that it resembles the following example. 
    127.0.0.1        rhel8sc.rzview2.com rhel8sc localhost localhost.localdomain localhost4 localhost4.localdomain4
::1              localhost localhost.localdomain localhost6 localhost6.localdomain6
 
dns_IP_ADDRESS   rzviewdns.rzview2.com
  3. Configure the /etc/resolv.conf configuration file, so that it resembles the following example. 
    # Generated by NetworkManager
search rzview2.com
nameserver dns_IP_ADDRESS
  4. Install the packages required for the AD integration. 
    # yum install -y samba-common-tools oddjob-mkhomedir
  5. Enable the oddjobd service. 
    # systemctl enable oddjobd.service
# systemctl start oddjobd.service
  6. Specify the system identity and authentication sources. 
    # authselect select sssd with-smartcard with-mkhomedir
  7. Start the oddjobd service. 
    # systemctl enable oddjobd.service
# systemctl start oddjobd.service
  8. To support smart card authentication, create the /etc/sssd/sssd.conf file. 
    # touch /etc/sssd/sssd.conf
# chmod 600 touch /etc/sssd/sssd.conf
# chown root:root /etc/sssd/sssd.conf
  9. Add the required content to /etc/sssd/sssd.conf, as shown in the following example. Under the [pam] section, specify pam_cert_auth = True. 
    [sssd]
config_file_version = 2
domains = rzview2.com
services = nss, pam, pac
 
[domain/RZVIEW2.COM]
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
cache_credentials = true
 
[pam]
pam_cert_auth = True
  10. Enable the sssd service. 
    # systemctl enable sssd.service
# systemctl start sssd.service
  11. Edit the /etc/krb5.conf configuration file so that it resembles the following example. 
    # To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/
 
[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log
 
[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
    spake_preauth_groups = edwards25519
    default_realm = RZVIEW2.COM
    default_ccache_name = KEYRING:persistent:%{uid}
 
[realms]
 RZVIEW2.COM = {
     kdc = rzviewdns.rzview2.com
     admin_server = rzviewdns.rzview2.com
     default_domain = rzviewdns.rzview2.com
     pkinit_anchors = FILE:/etc/pki/nssdb/certificate.pem
     pkinit_cert_match = <KU>digitalSignature
     pkinit_kdc_hostname = rzviewdns.rzview2.com
 }
 
[domain_realm]
 .rzview2.com = RZVIEW2.COM
 rzview2.com = RZVIEW2.COM
  12. Edit the /etc/samba/smb.conf configuration file so that it resembles the following example. 
    [global]
        workgroup = RZVIEW2
        security = ads
        passdb backend = tdbsam
        printing = cups
        printcap name = cups
        load printers = yes
        cups options = raw
        password server = rzviewdns.rzview2.com
        realm = RZVIEW2.COM
        idmap config * : range = 16777216-33554431
        template homedir =/home/RZVIEW2/%U
        template shell = /bin/bash
        kerberos method = secrets and keytab
 
[homes]
        comment = Home Directories
        valid users = %S, %D%w%S
        browseable = No
        read only = No
        inherit acls = Yes
 
[printers]
        comment = All Printers
        path = /var/tmp
        printable = Yes
        create mask = 0600
        browseable = No
 
[print$]
        comment = Printer Drivers
        path = /var/lib/samba/drivers
        write list = @printadmin root
        force group = @printadmin
        create mask = 0664
        directory mask = 0775
  13. Join the AD domain, as shown in the following example. 
    # net ads join -U AdminUser
    Running the join command returns output similar to the following example. 
    Enter AdminUser's password:
Using short domain name -- RZVIEW2
Joined 'RHEL8SC' to dns domain 'rzview2.com'
  14. Verify that the RHEL 8.x desktop is successfully joined to the AD domain. 
    # net ads testjoin

Join is OK

What to do next

Configure Smart Card Redirection for a RHEL 8.x Desktop