I'm trying to join a Ubuntu 16.04 to a Windows domain (active directory) using realmd + sssd. Basically I was following [this post](https://www.mylesgray.com/infrastructure/utilising-kerberosad-auth-ubuntu-14-04-realmd/) which worked pretty well and I was able to join my server and could successfully authenticate as AD user. However there are two pieces missing in the integration:

1. Register server's hostname in DNS
2. Use [sssd-sudo](http://linux.die.net/man/5/sssd-sudo) for user authorization

**Register server's hostname in DNS** 

As mentioned I successfully join the AD by using 
`realm join --user=dpr MYDOMAIN.INT --install=/`:

```
root@ip-172-28-5-174 ~ # realm list
mydomain.int
  type: kerberos
  realm-name: MYDOMAIN.INT
  domain-name: mydomain.int
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U@mydomain.int
  login-policy: allow-realm-logins

```

However, dispite the successful join, my server is not known to the other machines in the domain using its hostname `ip-172-28-5-174.mydomain.int`. I found [this documentation](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/sssd-ad-options.html#sssd-dyndns) that mentions a `dyndns_update` setting in the sssd.conf file.

As I'm using realm. The sssd configuration is generated automatically by issuing the join command. The generated config file looks like this:

```
[sssd]
domains = mydomain.int
config_file_version = 2
services = nss, pam

[domain/mydomain.int]
ad_domain = mydomain.int
krb5_realm = MYDOMAIN.INT
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad

```

That is I somehow need to add `dyndns_update = True` to this generated file. But how?

**Use sssd-sudo for user authorization** 

Additionally I want to make sssd to read my sudo configuration from AD. I think this can be achieved using [sssd-sudo](http://linux.die.net/man/5/sssd-sudo) but this needs to be enabled/configured in the sssd.conf file as well by adding `sudo` to the sssd services and use `sudo_provider = ldap` for my domain. Again I'm not able to figure out how to do this with realm.

Basically I want my generated config file to look like this:

```
[sssd]
domains = mydomain.int
config_file_version = 2
services = nss, pam, sudo

[domain/mydomain.int]
id_provider = ad
access_provider = ad
sudo_provider = ldap
ad_domain = mydomain.int
krb5_realm = MYDOMAIN.INT
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d

```

Any ideas on how this can be achieved?