Integrate a RHEL or Rocky Linux 9.x/8.x VM with AD for Smart Card Redirection

Use the following procedure to integrate a RHEL or Rocky Linux 9.x/8.x virtual machine (VM) with an Active Directory (AD) domain for smart card redirection.

Some examples in the procedure use placeholder values to represent entities in your network configuration, such as the DNS name of your AD domain. Replace the placeholder values with information specific to your configuration, as described in the following table.

Procedure

1. On the base VM, do the following.

   1. Configure network and DNS settings as required by your organization.

   2. Turn off IPv6.

   3. Turn off Automatic DNS.

2. Install the required dependency packages.

   sudo yum install oddjob oddjob-mkhomedir sssd adcli samba-common-tools krb5-pkinit
   

3. Specify the system identity and authentication sources.

   sudo authselect select sssd with-smartcard with-mkhomedir
   

4. Edit the /etc/krb5.conf configuration file so that it resembles the following example.

   # To opt out of the system crypto-policies configuration of krb5, remove the
   # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
   includedir /etc/krb5.conf.d/
   
   [logging]
       default = FILE:/var/log/krb5libs.log
       kdc = FILE:/var/log/krb5kdc.log
       admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
       dns_lookup_realm = false
       ticket_lifetime = 24h
       renew_lifetime = 7d
       forwardable = true
       rdns = false
       pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
       spake_preauth_groups = edwards25519
       default_realm = DOMAIN.COM
       default_ccache_name = KEYRING:persistent:%{uid}
   
   [realms]
    DOMAIN.COM = {
        kdc = dnsserver.domain.com
        admin_server = dnsserver.domain.com
        default_domain = dnsserver.domain.com
        pkinit_anchors = FILE:/etc/pki/nssdb/certificate.pem
        pkinit_cert_match = <KU>digitalSignature
        pkinit_kdc_hostname = dnsserver.domain.com
    }
   
   [domain_realm]
    .domain.com = DOMAIN.COM
    domain.com = DOMAIN.COM
   

5. On the base VM, verify the network connection to the AD domain.

   sudo realm discover domain.com
   

6. Join the AD domain.

   sudo realm join --verbose domain.com -U AdminUser
   

   Running the join command returns output similar to the following example.

   Enter AdminUser's password:
   Using short domain name -- DOMAIN
   Joined 'rhelsc' to dns domain 'domain.com'
   

7. Verify that the VM is successfully joined to the AD domain.

   sudo net ads testjoin
   

   A successful AD join returns the following output.

   Join is OK
   

What to do next

Configure Smart Card Redirection on a RHEL or Rocky Linux 9.x/8.x VM