How to Join CentOS Stream 9 to Windows Active Directory using SSSD and Realmd – ITFROMZERO

Table of Contents

Account Management Headaches in Growing Systems

Initially, my system only had about 3-5 servers running Web and Database services. Using the useradd command and manually setting passwords was still manageable. However, when the server count hit 30 nodes, combined with a 10-person DevOps team and frequent staff turnover, I started to feel overwhelmed. Every time an employee left, I had to SSH into every single machine to delete their account. Forgetting just one machine created a serious security vulnerability.

Leveraging an existing Windows Active Directory (AD) infrastructure is the most logical path. Why manage two separate user systems when you can use AD accounts to log directly into CentOS Stream 9? This approach unifies Password Policies and allows you to revoke access with a single click on the Domain Controller.

Many beginners fall into the “trap” of manually configuring Winbind or Samba. The configuration files are often miles long and extremely prone to errors. Currently, the most lightweight and stable solution on CentOS 9 is Realmd and SSSD. SSSD acts as an interpreter, helping Linux understand and communicate smoothly with Microsoft’s authentication protocols.

Advantages of SSSD and Realmd

I once struggled with setting up LDAP manually, but it’s incredibly tedious when dealing with complex Windows Forest structures. Realmd solves this by automatically discovering domains and installing dependencies. Meanwhile, SSSD features excellent caching capabilities. Even if the connection to the Domain Controller is lagging, you can still log in using cached credentials without being kicked out.

System Preparation: Don’t Skip This Step

Experience shows that 90% of domain join failures are caused by DNS and Time. If these two factors are out of sync, you will only receive generic error messages that are very difficult to debug.

1. Point DNS to the Domain Controller

The CentOS server must be able to resolve the AD domain name. Check your /etc/resolv.conf file or use nmcli:

# Update DNS using nmcli
nmcli connection modify eth0 ipv4.dns "192.168.1.10" 
nmcli connection up eth0

Make sure the ping command to the domain returns the correct result:

ping itfromzero.local

2. Synchronize Time Precisely

The Kerberos protocol will refuse authentication if the time difference between the Client and Server exceeds 5 minutes. On CentOS Stream 9, chrony is the best default choice:

dnf install chrony -y
systemctl enable --now chronyd

3. Set an FQDN Hostname

Having a clear Linux machine identifier makes AD management easier.

hostnamectl set-hostname srv-web-01.itfromzero.local

Installing Software Packages

Run the following command to install the necessary connection tools:

dnf install realmd sssd adcli samba-common-tools oddjob oddjob-mkhomedir sssd-ad -y

realmd: Coordinates the domain joining process.
sssd: Handles authentication and stores user identities.
oddjob-mkhomedir: Automatically creates the /home/user directory upon the first login.

Proceeding with the Domain Join

First, try “probing” to see if Linux can see the AD:

realm discover itfromzero.local

If everything looks good, execute the join command. You need to have a Domain Admin account ready:

realm join -U Administrator itfromzero.local

Enter the password when prompted. If no error appears, your machine is officially in the “Computers” list of the Active Directory.

Optimizing SSSD Configuration

By default, you must type the full user@domain to log in. To shorten it to just username, edit the /etc/sssd/sssd.conf file:

vi /etc/sssd/sssd.conf

Change the line use_fully_qualified_names = True to False. Then restart the service:

systemctl restart sssd

Enable the automatic home directory creation feature so users don’t encounter workspace environment errors:

authselect select sssd with-mkhomedir --force
systemctl enable --now oddjobd && systemctl restart oddjobd

Verification and Sudo Permissions

Use the id command to confirm that Linux recognizes the user from Windows:

id username_ad

To grant root privileges to an administrative group (e.g., the IT_Admins group in AD), create a sudo configuration file:

vi /etc/sudoers.d/ad-admins

Add the following line (remember to use a backslash if the group name contains spaces):

%[email protected] ALL=(ALL) ALL

Real-world Lesson: When SSSD “Goes on Strike”

In a real project, I once encountered a situation where realm list reported success, but users couldn’t log in. After checking the logs at /var/log/sssd/, I discovered the Windows Firewall was blocking port 389 (LDAP) and 445 (SMB). Once these ports were opened for the Linux server IP range, everything ran smoothly.

Note: If you are cloning virtual machines (Templates), run realm leave before cloning. Otherwise, the new machines will have duplicate SIDs, causing conflicts and constant domain ejections.

Summary

Integrating CentOS Stream 9 into Active Directory is the optimal way to professionalize your infrastructure. You no longer have to remember dozens of passwords or struggle with manual user deletion. Everything is now centralized in one place. If you are upgrading your system from CentOS 7 to version 9, apply these post-installation steps immediately to make administration much easier.