You can join your Unix host to Active Directory with the vastool join command directly from the command line.
Before you join the Authentication Services agent to the Active Directory domain, collect the following information:
To join Active Directory using vastool join
# /opt/quest/bin/vastool -u <user> join <domain-name>
The vastool join results are shown on the shell’s standard output.
Note: vastool join supports many options that allow you to customize the way the computer is joined to the domain. You can specify the name of the computer object. You can join to a specific organizational unit or use a pre-created computer object. For a list of all vastool join options, refer to the vastool man page.
Rather than using the vastool join command from the command line, you can join your Unix host to Active Directory using the interactive join script, vasjoin.sh. The script walks you through the domain join process, calling the vastool join command.
The vasjoin.sh script is in /opt/quest/libexec/vas/scripts/ directory. You can use most of the standard vastool join command options when running it. However, you can run the join script with no options; it only requires that you supply the domain name and the name of a user with sufficient Active Directory privileges to perform the join.
|-h||Help; displays options including how to pass vastool join options|
|-q||Unattended or quiet mode; displays less verbose: no explanations, asks no questions|
|-i||Interactive mode: prompts for common options|
|<none>||Simple mode; installs vasclnt and vasgp with options to add license and join domain.|
To join Active Directory using the vasjoin script
Run the script as the root user at a shell prompt, as follows:
The script ensures that your local host's time is synchronized with that of the controller in the domain you want to join (in order to satisfy Kerberos), then performs the join for you by running vastool join as follows:
vastool -u <username> join <domain-name>
Follow the prompts to complete the join process.
Note: Run the script in interactive mode as follows:
In interactive mode, it prompts you for specific information and allows you to either save the resulting vastool join command in a script or execute the command immediately.
The script presents defaults as part of the prompting and if you accept them all, the result is identical to running the script in simple mode.
The information gathered by the full, interactive mode of vasjoin.sh includes the following.
When Authentication Services joins a new computer to a domain, it becomes known to the LDAP and Kerberos protocols, but not to DNS. This is because the IP address of the host is not directly under the control of this part of Active Directory.
Although Active Directory comes with a integrated DHCP and DNS servers, some sites run their own DHCP servers. This means that the leased IP addresses must be communicated to Active Directory's DNS server through another (often manual) means.
The One Identity Dynamic DNS Update Tool, dnsupdate, performs this communication. It can automatically and securely inform Active Directory's DNS server of IP address changes of the host due to DHCP lease acquisition and renewal.
Because dnsupdate uses Kerberos to authenticate itself to the DNS server, only the computer joined with that name can update its record.
When you run the Authentication Services installation script, install.sh, in interactive mode (the -i option), it gives you an option to install the One Identity Dynamic DNS Update Tool. Dynamic DNS automatically integrates into the host's native DHCP client infrastructure to securely update DNS servers when its IP address changes. (For more information about running the install.sh script, see Installation script options.)
Note: If Pointer Record (PTR) updates are being rejected, it may be because the DHCP server is doing the update already. Refer to the documentation for the DHCP server being used in your environment. The Microsoft DHCP server does updates on behalf of the client and this is controlled by the Fully Qualified Domain Name (FQDN) option. Please refer to the Microsoft Active Directory DNS/DHCP documentation.
Once you have successfully installed Authentication Services you will want to learn how to do some basic system administration tasks using the Control Center and Management Console for Unix.