Unfortunately, I don’t think realms is available yet. There is a security.ipa, but that did not work for me.
I believe @SohamG is working on support, but I do not think it is ready yet.
Fortunately, with NixOS nothing is hard once it has been done. Using @buckley 's modules my entire household is now running NixOS and happily joined to my AD domain. After the first one, it was extremely easy to setup, because I just copied my config off the shared drive and rebuild. I did move my hostname into an id.nix so that I don’t mess things up by putting it on the shared drive.
I also made a few changes to buckley’s scripts, but I am not sure how necessary they were. I posted all of my changes above. There was one minor change after the above post to make sure the netbios name is the correct size.
So my final modules/ad-domain.nix was:
{ config, lib, pkgs, ... }:
let
cfg = config.sconfig.ad-domain;
in
{
options.sconfig.ad-domain = with lib; with types;
{
enable = mkEnableOption "Join Domain with SSSD";
longname = mkOption {
type = str;
example = "example.com";
};
shortname = mkOption {
type = str;
example = "EXAMPLE";
};
};
config = lib.mkIf cfg.enable
{
#networking.domain = cfg.longname;
#networking.search = [ (cfg.longname) ];
security.pam.services.sshd.makeHomeDir = true;
krb5 = {
enable = true;
libdefaults.default_realm = lib.toUpper cfg.longname;
};
services.sssd = {
enable = true;
sshAuthorizedKeysIntegration = true;
config = ''
[sssd]
services = nss, pam, ssh
config_file_version = 2
domains = ${cfg.longname}
[domain/${cfg.longname}]
default_shell = /run/current-system/sw/bin/bash
id_provider = ad
ldap_sasl_authid = ${builtins.substring 0 15 (lib.toUpper config.networking.hostName)}
cache_credentials = True
krb5_real = ${lib.toUpper cfg.longname}
krb5_store_password_if_offline = True
ldap_sasl_mech = gssapi
access_provider = ad
fallback_homedir = /home/%u.%d
ad_gpo_access_control = permissive
ad_gpo_ignore_unreadable = True
ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
ldap_user_ssh_public_key = altSecurityIdentities
ldap_use_tokengroups = True
use_fully_qualified_names = False
ldap_id_mapping = True
ad_domain = ${cfg.longname}
'';
};
# Samba is configured, but just for the "net" command, to
# join the domain. A better join method probably exists.
# `net ads join -U Administrator`
environment.systemPackages = [ pkgs.samba4Full ];
systemd.services.samba-smbd.enable = lib.mkDefault false;
services.samba = {
enable = true;
enableNmbd = lib.mkDefault false;
enableWinbindd = lib.mkDefault false;
package = pkgs.samba4Full;
securityType = "ads";
extraConfig = ''
realm = ${lib.toUpper cfg.longname}
workgroup = ${lib.toUpper cfg.shortname}
client use spnego = yes
restrict anonymous = 2
server signing = mandatory
client signing = mandatory
kerberos method = secrets and keytab
'';
};
};
}
my added krb5 section in my configuration.nix (for custom CA) was:
krb5.libdefaults = {
dns_lookup_realm = "false";
ticket_lifetime = "24h";
forwardable = "true";
rdns = "false";
pkinit_anchors = "FILE:/etc/nixos/certificates/ca.crt";
spake_preauth_groups = "edwards25519";
dns_canonicalize_hostname = "fallback";
default_ccache_name = "KEYRING:persistent:%{uid}";
udp_preference_limit = "0";
};
My configuration.nix to configure the module:
# Configure ad domain
sconfig.ad-domain = {
enable = true;
longname = "youdomain.com";
shortname = "SHORTNAME";
};
My join command is:
sudo net ads join -n SHORTNAME -U Administrator
This seem to just work.
