Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we use a lot of Linux-Servers with active-directory membership for user-authentication. This are made with the likewise-open packet. We tested the beta-Version of ubuntu Server 14.04 LTS. Everything works fine after one minute (install, domain-join, import registry, edit sudoers, done). Now, from beta to production-release likewise-open is removed from repository.

Is there any equivalent easy way for AD-domain-join and (AD-)group-based login-management (without manually installing and editing config-files for samba, winbind, nsswitch, pam etc....?

thanks a lot Silvio

share|improve this question

Using Powerbroker instead of likewise

do as steps below

1- download powerbroker frome here http://download1.beyondtrust.com/Technical-Support/Downloads/PowerBroker-Identity-Services-Open-Edition/?Pass=True

2- run it ,

sudo chmod a+x

run by typing it and hitting enter key

 sudo ./pibsfilename.sh

3- join by one of the below commands

 sudo domainjoin-cli join domainname.com administrator@domainname.com

or

 sudo domainjoin-cli join --disable ssh domainname.com administrator@domainname.com

4- Also, note that you might need to make one minor change to a config file as noted here. Namely, in the file /etc/pam.d/common-session, change the line that reads:

   session sufficient pam_lsass.so

to

   session [success=ok default=ignore] pam_lsass.so

5- run this command to config, like lwconfig in likewise (run from home folder), use caret ^ for spaces in group names

   /opt/pbis/bin/config Requiremembershipof "domainname\\ASecurityGroupFromYourDomain" "domainname\\plus^other^group"
   /opt/pbis/bin/config AssumeDefaultDomain true
   /opt/pbis/bin/config UserDomainPrefix domainname

6- if you want a username to be sudoer do as follows

 sudo nano /etc/sudoers

after root line add the line below

 username ALL=(ALL:ALL) ALL

for group use %:

 %DOMAINNAME\\Power^Users ALL=(ALL:ALL) ALL

7- and finally edit lightdm configuration file

   sudo nano /usr/share/lightdm/lightdm.conf.d/50-unity-greeter.conf

   allow-guest=false
   greeter-show-remote-login=false
   greeter-show-manual-login=true

(60-lightdm-gtk-greeter.conf in Lubuntu 14.04)

8- Reboot

Resources used:

share|improve this answer
    
Thanks a lot. For me I will run with the "realmd" - network authenification that use "sssd" for authentication. – user272446 Apr 24 '14 at 11:51
    
"disbale" should probably be "disable", yes? – matt wilkie Jun 11 '14 at 20:52
    
For me, tab completion in terminal shells is broken for AD user; from here, I think sudo /opt/pbis/bin/config LoginShellTemplate /bin/bash might fix that (for new users only?). Also there's a note that 50-unity-greeter.conf needs to be edited instead for Lubuntu 14.04. – matt wilkie Jun 12 '14 at 17:36

It has simply been rebranded, and removed from official repositories. It is now known as BeyondTrust PowerBroker Identity Services, Open Edition (not as catchy, I know), and can be found here.

Also, note that you might need to make one minor change to a config file as noted here. Namely, in the file /etc/pam.d/common-session, change the line that reads:

session sufficient pam_lsass.so

to

session [success=ok default=ignore] pam_lsass.so

Found this info after a LOT of Googling and pulling out hair. Hope this helps.

share|improve this answer
    
Just in case anyone is looking for a bug report, it's here, with the same fix as your answer. Someone mentioned that he would notify PowerBroker about this, but apparently they haven't fixed PBIS yet. – Bart Jul 24 '14 at 14:21

The other (and in IMHO the more mature and stable) solution is Centrify Express.

Steps on how to install Centrify Express (and why folks switched to Centrify) can be found at

http://www.question-defense.com/2012/08/31/dpkg-error-processing-likewise-open-configure-join-linux-server-to-windows-domain-controller

http://ninjix.blogspot.com/2011/01/puppet-module-for-centrify-express.html

share|improve this answer
    
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – guntbert Apr 23 '14 at 18:50

Thanks a lot. For me (instead of use the PBIS (powerbroker identify service)) i will run with the "realmd - network authenification" that use "sssd". This install and configure all components (Kerberos and the sssd-config) for me (SSSD= System Security Services Daemon). The only thing to do is joining the domain (see realm --help) and manually setup pam (in /etc/pam.d/common-session; add "session required pam_mkhomedir.so umask=077) for auto-create homedirectorys and possibly modify sudoers-file for the ad-users. Take a look of that, I think that is an easy alternative way for AD-Integration and it comes out of the box and use standards.

share|improve this answer

I hope you searched for other options because sudo apt-get install likewise-open didn't work, follow these steps to install likewise in 14.04 , It worked for me.

wget http://de.archive.ubuntu.com/ubuntu/pool/main/l/likewise-open/likewise-open_6.1.0.406-0ubuntu10_i386.deb
wget http://de.archive.ubuntu.com/ubuntu/pool/main/libg/libglade2/libglade2-0_2.6.4-1ubuntu3_i386.deb
wget http://de.archive.ubuntu.com/ubuntu/pool/universe/l/likewise-open/likewise-open-gui_6.1.0.406-0ubuntu10_i386.deb
sudo dpkg -i likewise-open_6.1.0.406-0ubuntu10_i386.deb
sudo dpkg -i libglade2-0_2.6.4-1ubuntu3_i386.deb
sudo dpkg -i likewise-open-gui_6.1.0.406-0ubuntu10_i386.deb
sudo domainjoin-cli join domain_name admin_username

will ask for admin password and you are in.

Hope this will help.

share|improve this answer

I write a short howto for install PowerBroker Identity Services on ubuntu 14.04 lts server. I use for Apache service SSO over AD and Windows 7 client. In french but the command line is write in shell :o) : http://www.cymea.net/sso-apache2-active-direcotry-powerbroker-identity-services/

Nice read

wget http://download.beyondtrust.com/PBISO/8.0.0.2016/linux.deb.x64/pbis-open-8.0.0.2016.linux.x86_64.deb.sh
chmod +x pbis-open-8.0.0.2016.linux.x86_64.deb.sh
./pbis-open-8.0.0.2016.linux.x86_64.deb.sh
domainjoin-cli join TEST.LAN administrateur

Joining to AD Domain:   TEST.LAN
With Computer DNS Name: chronos.TEST.LAN
administrateur@TEST.LAN's password:
...
Your system has been configured to authenticate to Active Directory for the first time.  It is recommended that you restart your system to ensure that all applications recognize the new settings.
SUCCESS
share|improve this answer

protected by Community Jul 15 '14 at 15:59

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.