# Adding AD User to a local linux group **URL:** \ **Category:** Ansible Project\ **Created:** [November 15, 2022, 12:16am UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350 "2022-11-15T00:16:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Chris\_Bidwell](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Chris\_Bidwell](https://forum.ansible.com/u/Chris_Bidwell)\ **Post date:** [November 15, 2022, 12:16am UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/1 "2022-11-15T00:16:46Z")
Hi all, Is there a way to add an AD user to a local linux group? the user function doesn’t work because it’s only looking in /etc/passwd for this user. ---
**Author:** ![skratbag](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/skratbag/32/4836_2.png) [@skratbag](https://forum.ansible.com/u/skratbag)\ **Post date:** [November 15, 2022, 5:39am UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/2 "2022-11-15T05:39:07Z")
Hi Chris, I use PowerBroker to provide this sort of functionality. This auths to AD and when I show my groups at the command line, all AD and local groups are shown. PowerBroker has the AD user id and this can be added to the group in /etc/group. What are you trying to do? Regards David ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [November 15, 2022, 12:16pm UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/3 "2022-11-15T12:16:54Z")
Look at SSSD for joining your Linux machine to AD. We use it and find it very reliable. It also enables use of smart card for SSH logins if your public keys are populated in your AD user objects if you work in an environment that requires smart card login (2-factor). Walter ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [November 15, 2022, 12:22pm UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/4 "2022-11-15T12:22:49Z")
I should add that your AD user objects need to have the POSIX attributes for UID and GID or Unix will not honor them. Walter ---
**Author:** ![Nico\_Kadel-Garcia](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/nico_kadel-garcia/32/9998_2.png) [@Nico\_Kadel-Garcia](https://forum.ansible.com/u/Nico_Kadel-Garcia)\ **Post date:** [November 16, 2022, 1:17am UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/5 "2022-11-16T01:17:42Z")
> Look at SSSD for joining your Linux machine to AD. We use it and find it very reliable. It also enables use of smart card for SSH logins if your public keys are populated in your AD user objects if you work in an environment that requires smart card login (2-factor). sssd has a lot of configuration issues and some very performance issues. It works best with FreeIPA rather than Active Directory: it's basically a Samba core with a FreeIPA body bolted on top of it, and it does not scale to large AD environments. (Its insistence on pre-caching the \*entire\* LDAP of the AD server and crashing if it times out on that pre-load, is deadly for bulky, remote environments.) For a very simple AD setup, it can work well. Be aware that it will transform account names like "nkadel" in the "example.com" AD domain to "nkadel@domain.com", except when it doesn't, and the account management can get pretty funky if you don't want to use the long form all the time. Also be prepared to overload the 2048 maximum line-length limit in /etc/group with such account names if you're not cautious, and has to be dealt with that way unless you do considerable extra work, in the sssd.conf and elsewhere in ways that upgrades to sssd tend to erase. If you have to use it, be prepared to spend time tuning the sssd itself with Ansible and managing credentials with which to register the ansible target hosts in AD. Nico Kadel-Garia Email: nkadel@gmail.com ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [November 16, 2022, 1:34am UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/6 "2022-11-16T01:34:56Z")
Interesting. None of that has been our experience, but then we only have about 45,000 people in our AD. ---
**Author:** ![skratbag](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/skratbag/32/4836_2.png) [@skratbag](https://forum.ansible.com/u/skratbag)\ **Post date:** [November 16, 2022, 5:37am UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/7 "2022-11-16T05:37:47Z")
I had issues with sssd and nested groups, basically it didn’t work with nesting. This was some time ago so it may have been resolved. We have multiple domains and members from one or more that need to authenticate to a server so PowerBroker worked for us at the time and still does. ---
**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\ **Post date:** [November 16, 2022, 12:14pm UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/8 "2022-11-16T12:14:55Z")
We have nested groups and the GPO evaluation properly unrolls them for deep group membership evaluation. SSSD has come a long ways in the last three years. The developers are very responsive. Walter ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [November 16, 2022, 1:27pm UTC](https://forum.ansible.com/t/adding-ad-user-to-a-local-linux-group/37350/9 "2022-11-16T13:27:36Z")
We do a lot of our group management - upstream from AD - using Grouper ([https://incommon.org/software/grouper/](https://incommon.org/software/grouper/)). Being an academic institution, we have way too many tails for one (like an upstart AD) to suddenly sprout a dog. But none of that has complicated our success with SSSD on Linux, or provisioning with Ansible.