Integrating a Linux server with Active directory is documented in detail by the various Linux distributions and others. As such, the intent of this article is only to provide an overview of the process at each step as it relates to Posit Workbench (formerly RStudio Workbench) and RStudio Server Pro. It's important to note this is a general resource to assist with a topic outside of our support. These exact steps may not work in your specific environment, in which case we suggest reviewing the additional resources.
The use of # in front of each command signifies the need to be executed as root or with sudo.
1) Install the prerequisites
We'll be using realmd to join with the AD server. To use the realmd system, install the
realmd package and the other required dependencies:
sudo apt-get -y install realmd sssd sssd-tools samba-common krb5-user packagekit samba-common-bin samba-libs adcli ntp
2) Join the underlying Linux server with Active Directory
Complete the join using the following syntax: realm join [-U user] [realm-name]
# realm join -U Administrator dc1.rstudio.example
You will be prompted for the password of the username entered. If the command completes without error, confirm with:
# realm list
The realm join completes these steps automatically:
Joining the domain by creating an account entry for the system in the directory.
/etc/krb5.keytabhost keytab file.
Configuring the domain in SSSD and restarting the service.
Enabling domain users for the system services in PAM configuration and the
Below is the example /etc/sssd/sssd.conf file automatically produced from the realm join:
domains = rstudio.example
config_file_version = 2
services = nss, pam
ad_server = dc1.rstudio.example
ad_domain = rstudio.example
krb5_realm = RSTUDIO.EXAMPLE
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad
The following addition under the [domain/rstudio.example] section above may be required to allow the /etc/pam.d/rstudio profile:
ad_gpo_map_service = +rstudio
You can now check and verify an AD account using the
id command before moving on to the next section.
# id email@example.com
3) Configure PAM to create the user home directory
Edit /etc/pam.d/common-session by adding this line directly after
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
4) Configure the rstudio PAM profile
After integrating the underlying Linux operating system with Active Directory, you can copy the /etc/pam.d/login PAM profile for use with Workbench as suggested here:
# cp /etc/pam.d/login /etc/pam.d/rstudio
5) Test the PAM profile and AD integration using pamtester
# /usr/lib/rstudio-server/bin/pamtester --verbose rstudio firstname.lastname@example.org authenticate acct_mgmt setcred open_session close_session
If a pam_acct_mgmt error is observed, edit /etc/pam.d/common-account by commenting out this line:
#account [default=bad success=ok user_unknown=ignore] pam_sss.so
Then, try again; if successful please continue on.
6) Test Workbench and AD integration
Login to your Posit Workbench instance with an Active Directory ID to test using the email@example.com format. If you wish to have your users login with username, instead of username@domain you can adjust this line in the sssd.conf like so:
use_fully_qualified_names = False
Then restart the sssd service.