Ensure that the Windows Domain has Services for UNIX or a similar extension to the schema incorporated.
Create an LDAP browser user through Active Directory Users and Computers MMC. Define that User cannot change password and Password never expires. After the user is created, set the UNIX attributes for the user to UID and GID 499, with home directory set to: 
/dev/null and shell /bin/false
 
Secure TLS connections should have a certificate that is imported into the Domain Controller. This certificate should be available as a standalone PEM file or available through a URL

Connect to the Active Directory Server and open the 
Active Directory Users and Computers
 management tool.
Modify a group object to function as a POSIX group:
Right-click the group object and select 
Properties
.
Select the 
Unix Attributes
 tab.
Complete the 
NIS Domain
 and 
GID
 number as appropriate.
Modify a user object to function as a POSIX user:
Right-click the user object and select 
Properties
.
Select the 
Unix Attributes 
tab.
Complete the fields on the tab. 
Tip:
 The "Home Directory" is the same as "/home/" on the Linux file system.
Add the user as a UNIX member of the group:
Right-click the group object and select 
Properties.
 
Select the 
Unix Attributes
 tab.
Ensure that the NIS Domain is correct.
Click 
Add
.
Select your user and then click 
OK
.

Access the Gateway main menu.

Select 

1

 (Configure system settings) and then 

4

 (Configure authentication method).

Select 

2

 (LDAP) as the authentication method.

Complete the authentication wizard as follows:

 
Is the directory service to be used an Active Directory?
 
y
 
 
Do you want to use LDAPS (secure)?
 Enter 
y
 or 
n
 as appropriate
 
 
Enter the address of the LDAP server:
 Enter the address of the LDAP server (for example, "machine.mycompany.com").
 
Enter the LDAP server port:
 The default port should suffice. Enter a custom port number if you know it has changed.
 
Enter the LDAP base DN:
 Enter the Base DN that defines where the LDAP query begins looking for objects in the Active Directory (for example, "dc=example,dc=com")
The scope attribute confines the search to the base, one level below, or to search through all lower levels. Specify the scope by entering 
base
, 
one
, or 
sub
, respectively.
 
Do you want to enable LDAP Anonymous Bind?
 Enter 
y
 or 
n
 as appropriate for the needs of your organization. Anonymous binding is a bind request that uses simple authentication with no (that is, zero length) bind DN or password.
If you enable LDAP Anonymous Bind, the next two prompts are not displayed.
 
 
(If Anonymous Bind disabled) Enter the LDAP bind DN:
 Optionally specify the Bind DN (for example, cn=browse,cn=users,dc=example,dc=com).
Without a secure communication, a bind user is required to query the LDAP contents. This account is a domain user with read access. The password for this user should be written to the 
/etc/ldap.secret
 file and should not be visible as plain text.
 
(If Anonymous Bind disabled) Enter the LDAP bind password:
 Enter the password for the LDAP browser user.
 
Which object in the LDAP will be used to find the password for users:
 Specify the appropriate object. This is usually "CN=Users".
 
Enter the object class that contains the attributes for creating the local user account:
 Specify the appropriate class. The default is often sufficient ("posixAccount, Default ActiveDirectory=user").
 
Do you want to change the current setting:
 Enter 
y
.
 
Select the filter for account access:
 
pam_filter
 
pam_filter
 filters by account attributes. Example:"gidNumber=4000" grants access to accounts that have attribute "gidNumber" and the value is "4000".
 
groupdn
 filters by the full domain name of the target group that contains the list of memberUid.
Enter the pam_filter to limit account access: Enter a gidNumber (for example: "gidNumber=501").
Specify the PAM login attribute name: 
uid
 

You should now see a summary of your configuration (example below). Review your settings carefully before applying the configuration.

Authentication Configuration Summary
-------------------------------------------------------
Label                                     | Value
------------------------------------------------------------------------------
Secure                                    | false
ActiveDirectory                           | false
Server                                    | ad.example.com 
BaseDn                                    | dc=example,dc=com
Port                                      | 389
AnonymousBind                             | false
BindDn                                    | CN=test,CN=Users,dc=l7net,dc=local
BindPassword                              | <Hidden>
Object for finding the password for users | CN=Users
Certificate Action                        | NEVER
Filter for account access                 | gidNumber=501
PAM login attribute                       | uid

A print out of your test users' attribute
Access to one of the domain controllers (preferably one that has permissions to modify the attribute values).

 
nss_base_passwd
 
 
nss_base_shadow
 
 
nss_base_group
 

Open 
/etc/pam_ldap.conf
 in a text editor.
Uncomment the following lines in the file:
# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
nss_override_attribute_value loginShell /bin/bash
nss_map_attribute uidNumber uidNumber
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
About the PAM attributes:
 
Pam_login_attribute
 defines the username that the user logs in with. To ensure consistency with Active Directory and Services for UNIX, use the 
sAMAccountName
 attribute.
 
Pam_filter
 filters user accounts. This helps prevent you from authenticating users against other Active Directory objects.
 
Pam_password
 defines the password for Active Directory. Set this to 
ad
 to prevent issues from occurring when you change your password from the Linux workstation
Save and exit.

/etc/pam.d/sshd
/etc/pam.d/login 

account sufficient pam_localuser.so

account required pam_ldap.so ignore_authinfo_unavail ignore_unknown_user

Select 
X
 (Exit menu).
Select 
R
 (Reboot the Gateway appliance).