# Using with IPA

`realmd` can discover IPA domains and join the current computer as an account on a domain. This allows using domain users locally, and log into the local machine with IPA domain credentials.

## Discovering IPA domains

`realmd` discovers which domains or realms it can use or configure. It can discover and identify IPA domains by looking up the appropriate DNS SRV records and by connecting to the domain LDAP server.

The following DNS SRV records are required to be present for `realmd` to identify a provided realm as an Kerberos domain.

    # In this example the IPA domain is 'domain.example.com'
    _ldap._tcp.domain.example.com.

In addition `realmd` connects to the LDAP server on the IPA domain server's on port 389 and reads the Root DSE information about the domain.

To see how `realmd` is discovering a particular domain name, try a command like the following. Using the `--verbose` argument displays verbose discovery information.

    $ realm --verbose discover domain.example.com
     * Resolving: _ldap._tcp.dc._msdcs.domain.example.com
     * Resolving: _ldap._tcp.domain.example.com
     * Performing LDAP DSE lookup on: 192.168.10.22
     * Successfully discovered: domain.example.com
    ...

In addition a IPA domain server's host name or IP address may be specified.

## IPA client software

As part of configuring an IPA domain for use on the local computer, `realmd` will install and configure client software to enable domain accounts to be used on the local computer.

For a IPA domain this is SSSD.

## Joining a IPA domain

To join a IPA domain with `realmd` you can use the `realm` command line tool:

    $ realm join --verbose ipa.example.com

By specifying the `--verbose` it's easier to see what went wrong if the join fails.

Other tools also use `realmd` which can be used to perform the join operation, for example: GNOME Control Center.

The join operation does the following:

- Discovers information about the domain.

- Installs the necessary software to join the domain, such as SSSD.

- Prompts for administrative credentials.

- A computer account in the domain will be created, and or updated.

- A host keytab file at `/etc/krb5.keytab` is created.

- Configures the SSSD service, and restarts and enables it as appropriate.

- Enables domain users in `/etc/nsswitch.conf`

In addition an IPA domain server's host name or IP address may be specified to join via that domain controller directly.

After the join operation is complete, domain accounts should be usable locally, although logins using domain accounts are not necessarily enabled.

You verify that domain accounts are working with with a command like this:

    $ getent passwd admin@ipa.example.com

The join operation will create or update a computer account in the domain.

## Logins using Domain Accounts

Once the computer is joined to a IPA domain, the machine will automatically follow the domain settings for whether users are able to log into the machine or not.

To override this behavior and permit any domain account to log in, use the following command.

    $ realm permit --realm domain.example.com --all

To permit only specific accounts from the domain to log in use the following command. The first time this command is run it will change the mode to only allow logins by specific accounts, and then add the specified accounts to the list of accounts to permit.

    $ realm permit --realm domain.example.com user1@ipa.example.com user2@ipa.example.com

To deny logins from any domain account, use the following command.

    $ realm deny --realm domain.example.com --all