Доступ к сетевому хранилищу через УЗ на AD с помощью LDAP

yum install -y realmd.x86_64 adcli.x86_64 sssd.x86_64 krb5-workstation.x86_64 oddjob-mkhomedir.x86_64 samba-common-tools.x86_64 policycoreutils-python.x86_64

cat << EOF > /etc/krb5.conf
[logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    default_realm = AD.DOMAIN
    default_ccache_name = KEYRING:persistent:%{uid}

[realms]
    SZGMU.LOCAL = {
        kdc = ad.domain
        admin_server = ad.domain
    }

[domain_realm]
    .ad.domain = AD.DOMAIN
    .ad = AD.DOMAIN
    ad.domain = AD.DOMAIN
    ad = AD.DOMAIN
EOF

realm discover ad.domain
realm join ad.domain -U ad_admin
# По желанию, запрещает вход всем, далее разрешаем избранных.
realm deny --all
systemctl restart sssd.service
realm permit ad_user

# Разрешить kerberos логин для ssh.
sed -i 's/^.*GSSAPIAuthentication.*$/GSSAPIAuthentication yes/g' /etc/ssh/sshd_config
sed -i 's/^.*GSSAPICleanupCredentials.*$/GSSAPICleanupCredentials yes/g' /etc/ssh/sshd_config
systemctl restart sshd.service

cat << EOF > /etc/samba/smb.conf
[global]
    interfaces = eth0
    workgroup = ad
    realm = ad.domain
    security = ads
    netbios name = hostname
    wins support = no
    wins proxy = no

    password server = ad.domain
    kerberos method = dedicated keytab
    dedicated keytab file = /etc/krb5.keytab
    log level = 3
    log file = /var/log/samba/%m.log

    vfs objects = acl_xattr
    map acl inherit = Yes
    store dos attributes = Yes

    load printers = no
    show add printer wizard = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes
[share]
    # У шары должен быть контекст samba_share_t. Запустить от рута:
    # semanage fcontext -a -t 'samba_share_t' '/path/to/share(/.*)?'
    # Далее: # restorecon -rv /path/to/share/
    path = /path/to/share
    read only = no
    valid users = @ad_group
EOF