This content has moved to our admin guides and will be removed from Support articles in the near future. Please see our Posit Docs site for up-to-date information. New location:  Posit Documentation Posit Workbench Administration Guide

Integrating a Linux server with Active Directory is documented in detail by the various Linux distributions and others.  As such, the intent of this article is only to provide an overview of the process at each step as it relates to Posit Workbench (previously RStudio Workbench).  It's important to note this is a general resource to assist with a topic outside of our support.  These exact steps may not work in your specific environment, in which case we suggest reviewing the additional resources. 

The use of # in front of each command signifies the need to be executed as root or with sudo.

1) Install the prerequisites

We'll be using realmd to join with the AD server.  To use the realmd system, install the realmd package:

# yum install realmd

In addition, install the packages which are required to be able to manage the system using realmd with kerberos enabled.

RHEL 8/binary equivalent:

# yum install samba-common-tools realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation

RHEL 9/binary equivalent:

# dnf install samba-common-tools realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation

2) Join the underlying Linux server with Active Directory

Complete the join using the following syntax: realm join [-U user] [realm-name]

# realm join -U Administrator dc1.rstudio.example

You will be prompted for the password of the username entered.  If the command completes without error, confirm with:

# realm list

Example output:

rstudio.example
 type: kerberos
 realm-name: RSTUDIO.EXAMPLE
 domain-name: rstudio.example
 configured: kerberos-member
 server-software: active-directory
 client-software: sssd
 required-package: oddjob
 required-package: oddjob-mkhomedir
 required-package: sssd
 required-package: adcli
 required-package: samba-common-tools
 login-formats: %U@rstudio.example
 login-policy: allow-realm-logins

The realm join completes these steps automatically:

1. Joining the domain by creating an account entry for the system in the directory.
2. Creating the /etc/krb5.keytab host keytab file.
3. Configuring the domain in SSSD and restarting the service.
4. Enabling domain users for the system services in PAM configuration and the /etc/nsswitch.conf file.

Below is the example /etc/sssd/sssd.conf file automatically produced from the realm join:

[sssd]
domains = rstudio.example
config_file_version = 2
services = nss, pam

[domain/rstudio.example]
ad_server = dc1.rstudio.example
ad_domain = rstudio.example
krb5_realm = RSTUDIO.EXAMPLE
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_sasl_authid = RSP-ADSRV$
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad

The following additions under the [domain/rstudio.example] section above may be required to enumerate groups and allow the /etc/pam.d/rstudio profile. Enumeration is required to share projects with users who have never logged in to Posit Workbench but can be listed from LDAP. If you set enumerate as false, your users can only share projects with other users that logged into Workbench at least once. 

You can now check and verify an AD account using the id command before moving onto the next section.

# id user@rstudio.example

3) Configure the rstudio PAM profile

After integrating the underlying Linux operating system with Active Directory, you can copy the /etc/pam.d/login PAM profile for use with RStudio Workbench as suggested here:

# cp /etc/pam.d/login /etc/pam.d/rstudio

Contents:

# cat /etc/pam.d/rstudio

#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth substack system-auth
auth include postlogin
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session required pam_namespace.so
session optional pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session optional pam_ck_connector.so

4) Test Posit Workbench and AD integration

Login to your instance with an Active Directory ID to test.

Assuming the login completes, you can confirm a kerberos ticket has been generated with system("klist") 

> system("klist")
Ticket cache: KEYRING:persistent:1543801107:krb_ccache_RNjxOTS
Default principal: user@RSTUDIO.EXAMPLE

Valid starting       Expires              Service principal
02/01/2019 14:47:44  02/02/2019 00:47:44  krbtgt/RSTUDIO.EXAMPLE@RSTUDIO.EXAMPLE
	renew until 02/08/2019 14:47:44

Additional resources:

Integrating RHEL 8 systems directly with Windows Active Directory

Integrating RHEL 9 systems directly with Windows Active Directory