Join a cluster to Active Directory¶

When you finish, the cluster is a member of your Active Directory domain, and Windows clients sign in to its SMB shares with their domain accounts.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later
A dedicated AD service account with permission to join computers to the domain
DNS on the cluster's network that resolves the domain, and a path from the cluster to the domain controllers on ports 88 (Kerberos) and 389 (LDAP)
The Organizational Unit for the cluster's computer account, unless the default Computers container suits you

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_ad" "main" {
  connection_profile = "cluster1"

  domain      = "corp.example.com"                     # <-- Replace with your AD domain
  ad_username = "svc-qumulo-join"                      # <-- Replace with your join account
  ad_password = "JoinAccountPassword123!"              # <-- Replace with the join account password
  ou          = "OU=Servers,DC=corp,DC=example,DC=com" # <-- Replace with your OU
}

output "ad_status" {
  value = qumulo_ad.main.status
}

Replace the six values marked <-- Replace, and leave the rest as written. To use the default Computers container, delete the ou line.

Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Choose protocol security¶

By default the cluster prefers SMB signing, SMB encryption, and AES for Kerberos without requiring any of them. Add a line to the qumulo_ad block for each rule your organization enforces.

To reject unsigned SMB connections, add signing = "REQUIRE_SIGNING".
To reject unencrypted SMB connections, add sealing = "REQUIRE_SEALING".
To refuse Kerberos encryption other than AES, add crypto = "REQUIRE_AES".
If AD stores UID and GID values for Linux clients in RFC 2307 attributes, add use_ad_posix_attributes = true.
To look up users and groups in trusted domains too, add search_trusted_domains = true.

The plan in step 3 shows each setting you added.

3. Apply¶

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 1 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 1 added, 0 changed, 0 destroyed., followed by the ad_status output.

Warning

terraform destroy takes the cluster out of the domain with the join account. If that account no longer works, set force_leave = true and apply before you destroy, which leaves the computer account behind in AD.

4. Check the cluster¶

Run terraform output ad_status. It prints "JOINED".

Next¶

Give your AD administrators rights on the cluster with cluster roles, and let the domain controllers keep the cluster's time with use_ad_for_primary in Set cluster-wide settings. Active Directory concepts are in Qumulo's documentation, and the qumulo_ad reference lists every attribute.