Joining a Linux host to Active Directory with realmd and SSSD

Goal

Join a Linux host to an Active Directory domain so AD accounts can authenticate and be resolved locally, using realmd to drive SSSD rather than assembling sssd.conf by hand.

Prerequisites

realmd, sssd, and the AD/Kerberos support packages installed (realmd, sssd-ad/sssd-common, adcli, krb5-workstation/krb5-user depending on distribution). Correct DNS resolution of the AD domain (SRV records) and time sync with the domain controllers — Kerberos authentication fails outside a small clock skew tolerance. SSSD is the client daemon that caches identity and authentication data from directory services including Active Directory, per its own project documentation.

Steps

1. Confirm the domain is discoverable via DNS before attempting to join: realm discover example.com. Output listing the domain, its type (kerberos, active-directory) and required packages confirms SRV records and basic reachability; a failure here means fixing DNS first, not adjusting SSSD.
2. Join the domain: realm join -U administrator example.com. This is what actually creates the computer account in AD, writes the keytab, and generates the corresponding sssd.conf domain section — realmd manages that file, so avoid hand-editing the sections it owns.
3. Restrict logins immediately rather than leaving the domain fully open: realm permit user@example.com for one account, or realm permit -g "Domain Admins@example.com" for a group; realm deny --all first if the default should be nobody until explicitly permitted.
4. Verify a specific AD account resolves: id user@example.com. A UID/GID pair and group memberships confirm SSSD is resolving identity correctly; failure here with a successful realm discover points at the SSSD service itself.
5. Check SSSD's own view of its state: sssctl domain-list and sssctl domain-status example.com summarize whether the domain is online and which providers are active. id_provider/access_provider in the generated sssd.conf show which backends are actually configured.
6. For a login failure that id does not explain, raise the debug level in sssd.conf (debug_level = 9 under the relevant section, then systemctl restart sssd), reproduce the failure, and collect the logs with sssctl logs-fetch /tmp/sssd-logs.tar (the archive path is required). Level 9 is very verbose and logs sensitive detail; revert it afterwards.

Expected result

id user@example.com returns a resolved UID/GID; only explicitly permitted accounts or groups can authenticate.

Limits and test basis

Verified against realm(8) (discover, join, permit), sssd.conf(5) (id_provider, access_provider) and sssctl(8). Undo: realm leave example.com removes the local domain configuration and stops SSSD from authenticating against it; the AD computer account is left in place unless realm leave --remove -U administrator example.com is used or a domain administrator deletes it.