Linux – home dir and shell for Active Directory authenticated users

In March 2014, Red Hat published a reference architecture for integrating Red Hat Enterprise Server with Active Directory. (This material should certainly be current and relevant.) I hate to post this as an answer, but it's really just too much material to transfer into the answer field.

This document (corrected) is hot off the press seems to focus on the new features of Red Hat Enterprise Linux (RHEL) 7. It was published for the Summit last week.

Should this link go stale, please let me know and I'll update the answer accordingly.

I have personally used WinBind fairly reliably for authentication. There's very infrequent service failure that requires someone with root or other local account to go in and bounce winbindd. This could probably be dealt with via proper monitoring if you care to put the effort into it.

It is worth noting that Centrify does have additional functionality, though this can be provided by separate configuration management. (Puppet, etc.)

Edit 6/16/14:

Red Hat Enterprise Linux 7 Windows Integration Guide

Your solutions here are either FreeIPA or Centrify/PowerBroker. FreeIPA is part of your standard RHEL subscription so there is already some savings in place.

FreeIPA can be run in a mode where all users and groups can come from Active Directory. You would only keep mapping of those users and groups to POSIX-specific environments in FreeIPA, like SUDO rules, public SSH keys, host-based access control definitions, SE Linux context assignments and so on. To do so you would need to map some of your AD users/groups to some groups in FreeIPA but that is not a duplication of the information, it is amending it with the parts that are not AD-specific.

The way FreeIPA implements compatibility with Active Directory is by presenting itself as an Active Directory-compatible forest, of sorts. It is enough to allow FreeIPA resources to be consumed by AD users via cross-forest trust but not enough to allow FreeIPA users to access Windows systems on the other side of the trust. You seem to be interested in the first part so this should be fine.

With FreeIPA 4.1 which is part of RHEL 7.1 beta already (hopefully, RHEL 7.1 will be out 'soon'), we have a powerful mechanism to keep the overrides for AD users and groups in FreeIPA and SSSD is capable to discover all of them on per-server granularity.