Winbind or SSSD for Active Directory authentication

megamaced · 12-18-2014, 07:40 AM

Hi,

I have seen various guides that show how to use Winbind or SSSD/Realmd to join a Linux workstation to a Windows Active Directory domain. Using SSSD seems to be the simplest of the two to actually set up and get going. However I am not sure which is the "preferred" method or what the pros/cons are of using either solution?

Cheers

btmiller · 12-20-2014, 11:28 AM

I don't think there's really a "preferred" solution. In a Red Hat based environment, sssd seems to be the way to go, but there seems to be sporadic bugginess, especially with older versions (failing to authenticate any users and behavior like that). More recent versions seem more stable.

I have no experience with pam_winbind; I use sssd to authenticate against our LDAP (not AD) and it works reasonably OK (except for the small glitches mentioned above) and is simple to configure.

megamaced · 12-20-2014, 02:39 PM

OK thanks for the info. I've tried the SSSD method using CentOS 7 and it was pretty easy to set up compared to Winbind. Fortunately I have not encountered any glitches as yet but its only been going for a week or so! One thing I didn't figure out yet is how to restrict the Active Directory accounts that have permission to log into the desktop, say if I only want a particular group. I think in Winbind this can be configured in smb.conf