How to properly join an Arch‑based Linux client (CachyOS) to Active Directory?

Issues & Assistance
1

Hi everyone,
I’m trying to join a fresh CachyOS (Arch‑based) installation to my Active Directory domain, but I keep running into problems. On other distros (Ubuntu, Fedora, RHEL) this usually takes a few minutes, but on Arch it seems much more complicated.

Here’s what I want to achieve:

  • Join the Linux machine to my AD domain

  • Use SSSD for authentication

  • Allow domain users to log in

  • Have a working /etc/krb5.keytab and a functioning AD backend

What I’ve tried so far:

  • SSSD configuration is valid (sssctl config-check shows no errors)

  • DNS and Kerberos work (SRV records resolve, kinit Administrator works)

  • But SSSD backend stays offline because the machine has no host keytab

  • Arch/CachyOS does not provide adcli or realmd in the official repos

  • Building adcli-git from AUR is difficult because makepkg cannot run as root and PAM/sudo were broken during testing

  • Samba is installed, but I’m not sure if net ads join is the recommended method on Arch for SSSD setups

Main question:
What is the correct and recommended way to join an Arch‑based system to Active Directory so that SSSD can authenticate domain users?

Should I:

  • Use Samba (net ads join) to generate the keytab?

  • Install adcli-git from AUR and use adcli join?

  • Manually create the keytab with ktpass on the Windows DC?

  • Or is there an official Arch method I’m missing?

Any guidance or best practices would be greatly appreciated.

Thanks!

2

may be this