Active Directory

Join an Immos machine to a Windows domain, and let the domain decide who logs in. One command, no configuration files to hand-edit.

Immos ships domain-ready: the client stack — sssd with the Active Directory provider, joined by adcli — is already in the read-only system image, already wired into name resolution and PAM, and inert on a machine that never joins anything. There is no package to install and no vendor configuration file to edit; joining writes only files that did not exist before.

That last property matters more than it sounds. Edited configuration stops tracking vendor updates on Immos (see editing /etc), so the join is designed as pure data: new files in the writable layer, nothing modified. Leaving removes exactly those files and nothing else.

Joining

$ sudo immos-domain join --domain corp.example.com --user administrator

You will be asked for the password of the account performing the join. The command creates the computer account in the domain, writes the keytab and the generated sssd configuration, enables the domain service, and records what it did.

The full surface:

What a join means for the people at the keyboard

• Any valid domain user can log in by default, with their domain password, at the Plasma login screen. User names are typed plain (alice, not [email protected]).
• Logins work offline. Credentials are cached, so a laptop that leaves the network still logs its owner in.
• Home directories are created on first login, under /home on the writable data partition.
• Domain users are not administrators. Sudo and polkit stay with local accounts unless the join was run with --admin-group, which elevates one domain group.

To restrict who may log in, join with --allow-groups and a list of domain groups; the default is deliberately permissive because a freshly joined machine that lets nobody in is a support call, not a security win.

Limitations, stated plainly

• Joining is mutually exclusive with managed mode. Both CLIs refuse to cross over: a managed machine will not join a domain, and a joined machine will not enrol.
• The domain itself must be reachable to join. An install-time join from the installer’s accounts page that cannot reach the domain completes the install as a local machine and records the failed intent — immos-domain status reports it.
• Multi-domain forests and trust setups are not supported in this release; single-domain is the tested path.

The design notes for the whole mechanism — the generated sssd configuration, the offline behaviour, the rollback interaction — are in the repository, plan/18-active-directory.md.