The "realm discover" command returns complete domain configuration and a list of packages that must be installed for the system to enrolled in the domain.

The "realm join" command then sets up the local machine for use with a specified domain by configuring both the local system services and the entries in the identity domain. the process run by "realm join" follows these steps:

• Running a discovery scan for the specified domain.
• Automatic installation of the packages required to join the system to the domain.
  This includes SSSD and the PAM home directory job packages. Note that the automatic installation of packages requires the PackageKit suite to be running. If PackageKit is disabled, the system prompts you for the missing packages, and you will be required to install them manually using the "yum" utility.
• Joining the domain by creating an account entry for the system in the directory.
• Creating the /etc/krb5.keytab host keytab file.
• Configuring the domain in SSSD and restarting the service.
• Enabling domain users for the system services in PAM configuration and the /etc/nsswicht.conf file.

To install the software manually, run:

# yum install realmd oddjob oddjob-mkhomedir sssd 
# yum install adcli krb5-workstation samba-common-tools

When run without any options, the "realm discover" command displays information about the default DNS domain. It is also possible to run a discovery for a specific domain, such as:

# realm discover mydomain.local

Before this works, make sure the system can access the domain controllers, such as the AD servers. You may have to add those to /etc/resolv.conf, as realmd will use DNS SRV lookups to find the domain controllers in the domain automatically.

To join the domain use the "realm join" command, for example:

# realm join -v - U user mydomain.local

By default, the join is performed as the domain administrator. For AD, the administrator is called "Administrator"; for IdM, it is called "admin". To connect as a different user, use the -U option, as was shown in the example above. When prompted for a password, type it in.

Once the join has been completed, use a separate user account to login to the system, to ensure that domain accounts work.

If you run into issue, make sure that the following ports are opened in the firewall, if present: 53, 389, 636, 88, 464, 3268, 3269 and 123.

For more details on joining a RHEL system to a domain, see: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/realmd-domain.



If you found this useful, here's more on the same topic(s) in our blog:

• Howto extend an ext3 filesystem in RHEL5
• Logical volume snapshot on Linux
• Linux strace command
• Yum
• Determining type of system remotely