Add Linux Active Directory enrollment bootstrap

2026-09-07 09:42:24 -06:00
parent dcbf5e87e3
commit c737bd3192
6 changed files with 365 additions and 4 deletions
@@ -50,6 +50,7 @@ Operational documentation:
 - [Broker location, health, timeout, and recovery](docs/broker-operations.md)
 - [Windows domain join and remote-access onboarding](docs/windows-client-onboarding.md)
 - [Required Credential Provider client enrollment](docs/client-enrollment.md)
+- [Linux client enrollment with realmd and SSSD](docs/linux-client-enrollment.md)
 - [Domain monitoring, usage reports, and six-month retention](docs/monitoring.md)
 - [Decision: do not persist password verifiers in Redis](docs/decisions/0001-no-password-cache.md)

@@ -106,6 +107,13 @@ Start-SguServerBootstrap.cmd 192.168.50.10
 Start-SguClientEnrollment.cmd 192.168.50.10
 ```

+Linux clients are enrolled through their native PAM/SSSD stack instead of the
+Windows Credential Provider:
+
+```bash
+sudo bash ./Enroll-SguLinuxDomainClient.sh --domain-controller 192.168.50.10
+```
+
 The server command creates a new forest and resumes by itself after its required
 restart. The client command registers a unique non-exportable mTLS certificate,
 installs and validates SGU before domain join, then enables the managed remote