|
| 1 | +--- |
| 2 | +title: Use third-party Active Directory providers with SQL Server on Linux | Microsoft Docs |
| 3 | +description: This tutorial provides the configuration steps for AD Authentication with third-party providers |
| 4 | +author: dylan-MSFT |
| 5 | +ms.date: 07/25/2018 |
| 6 | +ms.author: dygray |
| 7 | +manager: mikehab |
| 8 | +ms.topic: conceptual |
| 9 | +ms.prod: sql |
| 10 | +ms.component: "" |
| 11 | +ms.suite: "sql" |
| 12 | +ms.custom: "sql-linux" |
| 13 | +ms.technology: linux |
| 14 | +helpviewer_keywords: |
| 15 | + - "Linux, AD authentication" |
| 16 | +--- |
| 17 | +# Use third-party Active Directory providers with SQL Server on Linux |
| 18 | + |
| 19 | +[!INCLUDE[appliesto-ss-xxxx-xxxx-xxx-md-linuxonly](../includes/appliesto-ss-xxxx-xxxx-xxx-md-linuxonly.md)] |
| 20 | + |
| 21 | +This article explains how to configure a [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] on Linux host machine with AD Authentication when using third-party AD providers, such as [PowerBroker Identity Services (PBIS)](https://www.beyondtrust.com/), [Vintela Authentication Services (VAS)](https://www.oneidentity.com/products/authentication-services/), and [Centrify](https://www.centrify.com/). This guide includes steps to check your AD configuration, and it is not intended to instruct on how to join a machine to a domain. For detailed instructions on joining a [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] host to a domain using REALM and SSSD, see [Use Active Directory authentication with SQL Server on Linux](sql-server-linux-active-directory-authentication.md). |
| 22 | + |
| 23 | +## Prerequisites |
| 24 | + |
| 25 | +Before you configure AD Authentication, you need to set up an AD Domain Controller (Windows) on your network and join your [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] on Linux host to an AD domain. You can use [PBIS](https://www.beyondtrust.com/), [VAS](https://www.oneidentity.com/products/authentication-services/), or [Centrify](https://www.centrify.com/). |
| 26 | + |
| 27 | +> [!NOTE] |
| 28 | +> |
| 29 | +>This tutorial uses "contoso.com" and "CONTOSO.COM" as example domain and realm names respectively. It also uses "DC1.CONTOSO.COM" as the example fully qualified domain name of the domain controller. You should replace these with your own values. |
| 30 | +
|
| 31 | +## Check Connection to Domain Controller |
| 32 | + |
| 33 | +Check you can contact the domain controller with both the short and fully qualified name of the domain. |
| 34 | + |
| 35 | + ```bash |
| 36 | + ping contoso |
| 37 | + |
| 38 | + ping contoso.com |
| 39 | + ``` |
| 40 | + |
| 41 | + If either of these fails, update your domain search list. |
| 42 | + |
| 43 | + - **Ubuntu**: |
| 44 | + |
| 45 | + Edit the `/etc/network/interfaces` file so that your AD Domain is in the domain search list: |
| 46 | + |
| 47 | + ```/etc/network/interfaces |
| 48 | + <...> |
| 49 | + # The primary network interface |
| 50 | + auto eth0 |
| 51 | + iface eth0 inet dhcp |
| 52 | + dns-nameservers **<AD domain controller IP address>** |
| 53 | + dns-search **<AD domain name>** |
| 54 | + ``` |
| 55 | +
|
| 56 | + > [!NOTE] |
| 57 | + > The network interface (eth0) might differ for different machines. To find out which one you are using, run ifconfig and copy the interface that has an IP address and transmitted and received bytes. |
| 58 | +
|
| 59 | + After editing this file, restart the network service: |
| 60 | +
|
| 61 | + ```bash |
| 62 | + sudo ifdown eth0 && sudo ifup eth0 |
| 63 | + ``` |
| 64 | +
|
| 65 | + Now check that your `/etc/resolv.conf` file contains a line like the following example: |
| 66 | +
|
| 67 | + ```/etc/resolv.conf |
| 68 | + search contoso.com com |
| 69 | + nameserver **<AD domain controller IP address>** |
| 70 | + ``` |
| 71 | +
|
| 72 | + - **RHEL**: |
| 73 | +
|
| 74 | + Edit the `/etc/sysconfig/network-scripts/ifcfg-eth0` file (or other interface config file as appropriate) so that your AD Domain is in the domain search list: |
| 75 | +
|
| 76 | + ```/etc/sysconfig/network-scripts/ifcfg-eth0 |
| 77 | + <...> |
| 78 | + PEERDNS=no |
| 79 | + DNS1=**<AD domain controller IP address>** |
| 80 | + DOMAIN="contoso.com com" |
| 81 | + ``` |
| 82 | +
|
| 83 | + After editing this file, restart the network service: |
| 84 | +
|
| 85 | + ```bash |
| 86 | + sudo systemctl restart network |
| 87 | + ``` |
| 88 | +
|
| 89 | + Now check that your `/etc/resolv.conf` file contains a line like the following example: |
| 90 | +
|
| 91 | + ```/etc/resolv.conf |
| 92 | + search contoso.com com |
| 93 | + nameserver **<AD domain controller IP address>** |
| 94 | + ``` |
| 95 | +
|
| 96 | + If you still cannot ping the domain controller, find the fully qualified domain name (e.g. DC1.CONTOSO.COM) and IP address of the domain controller and add the following entry to `/etc/hosts` |
| 97 | +
|
| 98 | + ```/etc/hosts |
| 99 | + **<IP address>** DC1.CONTOSO.COM CONTOSO.COM CONTOSO |
| 100 | + ``` |
| 101 | + |
| 102 | + - **SLES**: |
| 103 | + |
| 104 | + Edit the `/etc/sysconfig/network/config` file so that your AD domain controller IP will be used for DNS queries and your AD domain is in the domain search list: |
| 105 | + |
| 106 | + ```/etc/sysconfig/network/config |
| 107 | + <...> |
| 108 | + NETCONFIG_DNS_STATIC_SEARCHLIST="" |
| 109 | + NETCONFIG_DNS_STATIC_SERVERS="**<AD domain controller IP address>**" |
| 110 | + ``` |
| 111 | +
|
| 112 | + After editing this file, restart the network service: |
| 113 | + ```bash |
| 114 | + sudo systemctl restart network |
| 115 | + ``` |
| 116 | +
|
| 117 | + Now check that your `/etc/resolv.conf` file contains a line like the following example: |
| 118 | +
|
| 119 | + ```/etc/resolv.conf |
| 120 | + search contoso.com com |
| 121 | + nameserver **<AD domain controller IP address>** |
| 122 | + ``` |
| 123 | +
|
| 124 | +## Check Reverse DNS is properly configured |
| 125 | +
|
| 126 | +The following command should return the fully qualified domain name of the host running SQL Server (e.g. "SqlHost.contoso.com"). |
| 127 | +
|
| 128 | + ```bash |
| 129 | + host **<IP address of SQL Server host>** |
| 130 | + # **<reversed IP address>**.in-addr.arpa domain name pointerSqlHost.contoso.com. |
| 131 | + ``` |
| 132 | + |
| 133 | + If this does not return your host's FQDN or if the FQDN is incorrect, add a reverse DNS entry for your [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] on Linux host to your DNS server. |
| 134 | + |
| 135 | +## Check your KRB5 configuration is correct |
| 136 | + |
| 137 | +Check your `/etc/krb5.conf` is configured correctly. For most third-party AD providers, this is done automatically. However, check `/etc/krb5.conf` for the following values to prevent any future issues: |
| 138 | + |
| 139 | + ```/etc/krb5.conf |
| 140 | + [libdefaults] |
| 141 | + default_realm = CONTOSO.COM |
| 142 | +
|
| 143 | + [realms] |
| 144 | + CONTOSO.COM = { |
| 145 | + } |
| 146 | +
|
| 147 | + [domain_realm] |
| 148 | + contoso.com = CONTOSO.COM |
| 149 | + .contoso.com = CONTOSO.COM |
| 150 | + ``` |
| 151 | + |
| 152 | +## Next steps |
| 153 | + |
| 154 | +In this article, we covered how to configure a [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] on Linux host machine with AD Authentication when using third-party AD providers. To finish configuring [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] on Linux to support AD accounts, follow the instructions at [Use Active Directory authentication with SQL Server on Linux](sql-server-linux-active-directory-authentication.md). |
| 155 | + |
| 156 | +> [!div class="nextstepaction"] |
| 157 | +> [Use Active Directory authentication with SQL Server on Linux](sql-server-linux-active-directory-authentication.md) |
| 158 | +
|
| 159 | +> [!NOTE] |
| 160 | +> |
| 161 | +> You can skip the "Join SQL Server host to AD domain" section in [Use Active Directory authentication with SQL Server on Linux](sql-server-linux-active-directory-authentication.md) |
| 162 | + as you have just done that in this tutorial. |
0 commit comments