Do Linux servers using AD/Kerberos for authentication/authorization need computer accounts?

Yes, they need computer accounts. These are created through the act of "joining" the domain.

(Think Centrify, Powerbroker, etc., though specific product recommendations here are off limits.)

Active Directory in particular will not allow you to authenticate under any circumstances if you do not have an account there, regardless of whether you are a computer or a user.

Edit: Just wanted to clarify - if you intend to authenticate the servers themselves, then they need computer accounts. If you intend to only authenticate users who log on to those servers, then you could theoretically only have user accounts, if your PAM was configured in such a way as to only allow users who presented a username and password that passed a check against AD to log in.


With SSSD it depends on the configuration. With id_provider=ad yes, you need to join the domain with realmd. But if you don't want to join the domain, there's nothing preventing you from using id_provider=ldap. Even ID mapping would work, if you configure the SID yourself.