CIFS Shares on Linux with Active Directory Integration

Covered versions: RHEL/CentOS/Oracle Linux 6, 7, 8, 9, 10 · Debian 10/11/12 · Ubuntu 20.04/22.04/24.04
Author: Technical tutorial — Nyverra Infraestrutura
Updated: June/2026

Table of Contents

1. Architecture overview

2. Prerequisites

3. Package installation

4. Joining the Active Directory domain

5. Configuring Samba as a domain member file server

6. Creating the CIFS shares

7. Permissions: how Linux inherits AD ACLs

8. Configuration by OS version

9. Testing and validating

10. Troubleshooting

11. Quick command reference

1. Architecture Overview

The goal is to make the Linux server function as an AD domain member (not as a DC), serving CIFS/SMB shares authenticated by AD. Permissions defined in AD (users, groups, ACLs) are applied directly to the Linux filesystem via Winbind or SSSD, without needing to create local users.

┌─────────────────────────────────────────────────────────────┐
│                      Active Directory                        │
│   DC01.empresa.local  ─────  Usuários / Grupos / GPO        │
└───────────────────────────┬─────────────────────────────────┘
                            │ Kerberos + LDAP
                            ▼
┌─────────────────────────────────────────────────────────────┐
│              Servidor Linux (Samba + Winbind/SSSD)          │
│                                                             │
│  /srv/shares/financeiro  ──►  ACL POSIX + Windows ACL      │
│  /srv/shares/ti          ──►  Herda grupos do AD           │
│  /srv/shares/publico     ──►  Leitura para todos           │
└─────────────────────────────────────────────────────────────┘
                            │ SMB/CIFS (445/TCP)
                            ▼
┌──────────────────────────────────────────────────────────────┐
│             Clientes Windows / Linux / macOS                 │
│   \\srv-files\financeiro  →  autenticado pelo AD            │
└──────────────────────────────────────────────────────────────┘

Main components:

2. Prerequisites

2.1 Required information before starting

Domínio AD (FQDN):     empresa.local
Domínio AD (NetBIOS):  EMPRESA
DC primário:           dc01.empresa.local  (IP: 192.168.1.10)
DC secundário:         dc02.empresa.local  (IP: 192.168.1.11)
Conta para ingresso:   Administrator (ou conta com permissão de join)
Hostname do servidor:  srv-files
IP do servidor:        192.168.1.50

2.2 DNS configured for AD

The Linux server must resolve the DCs via AD DNS. Configure /etc/resolv.conf or use NetworkManager/systemd-resolved:

# /etc/resolv.conf
search empresa.local
nameserver 192.168.1.10
nameserver 192.168.1.11

Verify before proceeding:

# Deve retornar os registros SRV do AD
dig +short SRV _ldap._tcp.empresa.local
dig +short SRV _kerberos._tcp.empresa.local

# Deve resolver o DC
nslookup dc01.empresa.local

2.3 Time synchronization (NTP)

Kerberos requires the time difference between the Linux server and the DCs to be less than 5 minutes.

# RHEL 7+, Ubuntu 16.04+, Debian 9+
timedatectl set-ntp true
timedatectl set-timezone America/Sao_Paulo

# Aponte o NTP para o DC (ele geralmente serve NTP)
# /etc/chrony.conf ou /etc/ntp.conf
server dc01.empresa.local iburst
server dc02.empresa.local iburst

# Verifique a sincronização
chronyc tracking
timedatectl status

2.4 Correct hostname

hostnamectl set-hostname srv-files.empresa.local

# Confirme que resolve localmente também
echo "192.168.1.50 srv-files.empresa.local srv-files" >> /etc/hosts

3. Package installation

RHEL 6 (legacy)

yum install -y samba samba-winbind samba-winbind-clients \
               krb5-workstation oddjob-mkhomedir pam_krb5

⚠️ RHEL 6 has reached EOL. Use only in isolated legacy environments.

RHEL / CentOS / Oracle Linux 7

yum install -y samba samba-winbind samba-winbind-clients \
               samba-winbind-krb5-locator krb5-workstation \
               oddjob-mkhomedir sssd sssd-ad realmd adcli

RHEL / Oracle Linux 8 and 9

dnf install -y samba samba-winbind samba-winbind-clients \
               samba-winbind-krb5-locator krb5-workstation \
               oddjob-mkhomedir sssd sssd-ad realmd adcli \
               samba-common-tools

RHEL / Oracle Linux 10

dnf install -y samba samba-winbind samba-client \
               krb5-workstation realmd sssd sssd-ad \
               adcli oddjob-mkhomedir samba-common-tools

Debian 10 / 11 / 12

apt-get update
apt-get install -y samba winbind libnss-winbind libpam-winbind \
                   krb5-user sssd sssd-ad realmd adcli \
                   oddjob oddjob-mkhomedir packagekit

During krb5-user installation, enter the realm in uppercase: EMPRESA.LOCAL

Ubuntu 20.04 / 22.04 / 24.04

apt-get update
apt-get install -y samba winbind libnss-winbind libpam-winbind \
                   krb5-user sssd sssd-ad realmd adcli \
                   oddjob oddjob-mkhomedir

4. Joining the Active Directory domain

There are two main methods. Method A (realmd) is recommended for RHEL 7+, Debian 10+, and Ubuntu 20.04+. Method B (net ads) works on all versions including RHEL 6.

Method A — realmd (recommended for modern versions)

# 1. Verifique o domínio detectável
realm discover empresa.local

# 2. Ingresse no domínio
realm join --user=Administrator empresa.local

# 3. Confirme o ingresso
realm list

realmd automatically configures SSSD, PAM, and NSS.

Method B — net ads join (universal, including RHEL 6)

Step 1: Configure Kerberos

# /etc/krb5.conf
[libdefaults]
    default_realm = EMPRESA.LOCAL
    dns_lookup_realm = true
    dns_lookup_kdc = true
    forwardable = true
    ticket_lifetime = 24h
    renew_lifetime = 7d

[realms]
    EMPRESA.LOCAL = {
        kdc = dc01.empresa.local
        kdc = dc02.empresa.local
        admin_server = dc01.empresa.local
        default_domain = empresa.local
    }

[domain_realm]
    .empresa.local = EMPRESA.LOCAL
    empresa.local = EMPRESA.LOCAL

Step 2: Test Kerberos before joining

kinit [email protected]
klist

Step 3: Configure the minimal smb.conf for joining

# /etc/samba/smb.conf (versão mínima para join)
[global]
    workgroup = EMPRESA
    realm = EMPRESA.LOCAL
    security = ADS
    kerberos method = secrets and keytab

Step 4: Join the domain

net ads join -U Administrator
# ou com OU específica:
net ads join createcomputer="Servers/Linux" -U Administrator

Step 5: Verify the join

net ads testjoin
net ads info

5. Configuring Samba as a domain member file server

This is the complete and commented /etc/samba/smb.conf for an AD member file server with support for inherited AD ACLs:

# /etc/samba/smb.conf
[global]

    ##── Identidade do servidor ──────────────────────────────────
    workgroup = EMPRESA
    realm = EMPRESA.LOCAL
    server string = Servidor de Arquivos Linux - %h
    netbios name = SRV-FILES

    ##── Integração com AD ───────────────────────────────────────
    security = ADS
    kerberos method = secrets and keytab

    ##── Resolução de identidades (Winbind) ──────────────────────
    idmap config * : backend = tdb
    idmap config * : range = 10000-19999

    # Mapeamento específico para o domínio EMPRESA
    # range deve ser exclusivo e não sobrepor o range '*'
    idmap config EMPRESA : backend = rid
    idmap config EMPRESA : range = 20000-999999

    # Preserva os SIDs do AD para mapeamento consistente entre servidores
    # Use 'ad' se o schema do AD tiver os atributos uidNumber/gidNumber
    # Use 'rid' para ambientes sem RFC2307 (mais comum)

    ##── Winbind ─────────────────────────────────────────────────
    winbind use default domain = yes
    winbind refresh tickets = yes
    winbind enum users = no   # Desative em domínios grandes (performance)
    winbind enum groups = no  # Desative em domínios grandes (performance)
    winbind offline logon = yes

    ##── ACLs e permissões ───────────────────────────────────────
    # Habilita o mapeamento de ACLs Windows no filesystem Linux
    vfs objects = acl_xattr
    map acl inherit = yes
    store dos attributes = yes

    # Permite que clientes Windows definam ACLs nos compartilhamentos
    # (requer filesystem com suporte a xattr: ext4, xfs, btrfs)
    acl_xattr:ignore system acls = no

    ##── Autenticação e segurança ────────────────────────────────
    client min protocol = SMB2
    server min protocol = SMB2
    # Para clientes legados (Windows XP/2003 — NÃO recomendado):
    # server min protocol = NT1

    ntlm auth = no
    restrict anonymous = 2

    ##── Logs ────────────────────────────────────────────────────
    log file = /var/log/samba/log.%m
    max log size = 50
    log level = 1
    # Aumente para debug: log level = 3 auth:5 winbind:5

    ##── Misc ────────────────────────────────────────────────────
    load printers = no
    cups options = raw
    printcap name = /dev/null

6. Creating the CIFS shares

6.1 Preparing the filesystem

The filesystem must support xattr to store Windows ACLs. Recommendations:

Mounting with explicit xattr (ext4):

# /etc/fstab
/dev/sdb1  /srv/shares  ext4  defaults,acl,user_xattr  0 2

For XFS (xattr is default, but mount with acl):

/dev/sdb1  /srv/shares  xfs  defaults,acl  0 2

6.2 Create the share directories

mkdir -p /srv/shares/{financeiro,ti,publico,diretoria}

# Propriedade inicial: root (o Samba/AD gerenciará via ACLs)
chown root:root /srv/shares
chmod 0755 /srv/shares

# Para compartilhamentos controlados pelo AD:
chmod 0770 /srv/shares/financeiro
chmod 0770 /srv/shares/ti
chmod 0777 /srv/shares/publico
chmod 0770 /srv/shares/diretoria

6.3 Define the shares in smb.conf

Add to the end of /etc/samba/smb.conf:

##── Compartilhamento do Departamento Financeiro ──────────────
[financeiro]
    comment = Financeiro
    path = /srv/shares/financeiro
    browseable = yes
    read only = no
    
    # Somente membros do grupo AD "GRP_Financeiro" têm acesso
    valid users = @"EMPRESA\GRP_Financeiro" @"EMPRESA\Domain Admins"
    write list = @"EMPRESA\GRP_Financeiro"
    admin users = @"EMPRESA\Domain Admins"
    
    # Herança de permissões
    inherit acls = yes
    inherit permissions = yes
    
    # ACLs Windows armazenadas em xattr
    vfs objects = acl_xattr
    map acl inherit = yes
    
    # Criação de arquivos/diretórios
    create mask = 0660
    directory mask = 0770
    force create mode = 0660
    force directory mode = 0770


##── Compartilhamento de TI ───────────────────────────────────
[ti]
    comment = Tecnologia da Informacao
    path = /srv/shares/ti
    browseable = yes
    read only = no
    valid users = @"EMPRESA\GRP_TI" @"EMPRESA\Domain Admins"
    write list = @"EMPRESA\GRP_TI"
    admin users = @"EMPRESA\Domain Admins"
    inherit acls = yes
    inherit permissions = yes
    vfs objects = acl_xattr
    map acl inherit = yes
    create mask = 0660
    directory mask = 0770


##── Compartilhamento Público (leitura para todos) ────────────
[publico]
    comment = Arquivos Publicos
    path = /srv/shares/publico
    browseable = yes
    read only = yes
    write list = @"EMPRESA\Domain Admins" @"EMPRESA\GRP_TI"
    guest ok = no
    # Qualquer usuário autenticado no AD pode ler
    valid users = @"EMPRESA\Domain Users"
    inherit acls = yes


##── Compartilhamento da Diretoria (somente diretores) ────────
[diretoria]
    comment = Diretoria - Acesso Restrito
    path = /srv/shares/diretoria
    browseable = no          # Não aparece na listagem de rede
    read only = no
    valid users = @"EMPRESA\GRP_Diretoria" @"EMPRESA\Domain Admins"
    write list = @"EMPRESA\GRP_Diretoria"
    admin users = @"EMPRESA\Domain Admins"
    inherit acls = yes
    inherit permissions = yes
    vfs objects = acl_xattr
    map acl inherit = yes
    create mask = 0660
    directory mask = 0770


##── Home dos usuários AD (opcional) ─────────────────────────
[homes]
    comment = Home do Usuario
    browseable = no
    read only = no
    create mask = 0700
    directory mask = 0700
    valid users = %S

7. Permissions: how Linux inherits AD ACLs

This is the central point of the tutorial. There are two layers of permissions that work together.

7.1 Layer 1 — POSIX ACLs (Linux filesystem)

These are the classic Unix permissions, but extended with setfacl:

# Instale as ferramentas de ACL
# RHEL-based:
yum install -y acl      # ou dnf install -y acl
# Debian/Ubuntu:
apt-get install -y acl

# Defina ACLs POSIX para o grupo AD no diretório
# O Winbind mapeia "EMPRESA\GRP_Financeiro" para um GID local (ex: 20100)

# Obtenha o GID do grupo AD
getent group "EMPRESA\\GRP_Financeiro"
# ou:
wbinfo -n "EMPRESA\GRP_Financeiro"

# Aplique a ACL POSIX
setfacl -m g:"EMPRESA\GRP_Financeiro":rwx /srv/shares/financeiro
setfacl -m d:g:"EMPRESA\GRP_Financeiro":rwx /srv/shares/financeiro  # ACL padrão (herança)
setfacl -m d:o::--- /srv/shares/financeiro  # Outros sem acesso

# Verifique
getfacl /srv/shares/financeiro

7.2 Layer 2 — Windows ACLs (xattr — stored by Samba)

When you configure vfs objects = acl_xattr + map acl inherit = yes, Samba stores Windows ACLs (AD SIDs) directly in the extended attributes of the filesystem. This allows a Windows administrator to configure permissions via the graphical interface (Properties > Security) and they are honored by Samba.

Inheritance flow:

AD Domain Controller
        │
        │ SID do usuário/grupo (ex: S-1-5-21-...-1104)
        ▼
   Winbind no Linux
        │
        │ Mapeia SID → UID/GID local (via idmap RID ou AD)
        │ ex: "EMPRESA\joao" → UID 20500
        │     "EMPRESA\GRP_Financeiro" → GID 20100
        ▼
  Samba (acl_xattr)
        │
        │ Armazena ACL Windows em: security.NTACL (xattr)
        │ Consulta POSIX ACL para compatibilidade
        ▼
  Filesystem Linux
        │
        │ /srv/shares/financeiro (ext4/xfs)
        │ user::rwx  group::rwx  other::---
        │ group:EMPRESA\GRP_Financeiro:rwx  (ACL POSIX)
        │ security.NTACL = <ACL Windows com SIDs>  (xattr)
        ▼
  Arquivo criado por joao
        │ Owner: EMPRESA\joao (UID 20500)
        │ Group: EMPRESA\GRP_Financeiro (GID 20100)
        │ Herda ACL do diretório pai

7.3 Configuring idmap for consistent inheritance

The idmap method defines how AD SIDs are mapped to UIDs/GIDs on Linux.

rid method (most common — without RFC2307 in AD schema)

# smb.conf
idmap config EMPRESA : backend = rid
idmap config EMPRESA : range = 20000-999999

The UID/GID is calculated deterministically from the SID's RID. Example:

• S-1-5-21-XXXXXXXXX-YYYYYYYYY-ZZZZZZZZZ-**1104** → UID = 20000 + 1104 = 21104

Advantage: automatic, without needing to add attributes in AD.

ad method (with RFC2307 — uidNumber/gidNumber attributes in AD)

# smb.conf
idmap config EMPRESA : backend = ad
idmap config EMPRESA : range = 1000-999999
idmap config EMPRESA : schema_mode = rfc2307

In this mode, Samba queries the uidNumber and gidNumber attributes of objects in AD. AD administrators define the UID/GID directly on the user/group account via ADUC (Active Directory Users and Computers).

When to use each:

7.4 Configuring PAM and NSS for identity resolution

# /etc/nsswitch.conf — adicione "winbind" ou "sss"
passwd:     files winbind
group:      files winbind
shadow:     files
hosts:      files dns

For SSSD (modern alternative):

passwd:     files sss
group:      files sss
shadow:     files sss

8. Configuration by OS version

RHEL 6 (legacy)

# Ingressar no domínio (sem realmd)
net ads join -U Administrator

# NSS e PAM manualmente
authconfig --enablewinbind --enablewinbindauth \
           --smbsecurity=ads --smbworkgroup=EMPRESA \
           --smbrealm=EMPRESA.LOCAL \
           --enablewinbindusedefaultdomain --update

# Serviços
service winbind start
service smb start
chkconfig winbind on
chkconfig smb on

RHEL 7

# Método realmd
realm join --user=Administrator empresa.local

# Configurar winbind para o Samba
systemctl enable --now winbind smb

# Firewall
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload

RHEL 8 / 9 / Oracle Linux 8 / 9

# Método realmd
realm join --user=Administrator --client-software=winbind empresa.local
# ou com SSSD:
realm join --user=Administrator empresa.local

# Se usar Winbind com Samba:
systemctl enable --now winbind smb

# Se usar SSSD (sem Samba file server):
systemctl enable --now sssd

# SELinux — habilite o contexto correto para os shares
setsebool -P samba_export_all_rw on
setsebool -P samba_enable_home_dirs on
chcon -R -t samba_share_t /srv/shares/

# Firewall
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload

RHEL 10 / Oracle Linux 10

realm join --user=Administrator --client-software=winbind empresa.local
systemctl enable --now winbind smb

# SELinux — mesmos comandos do RHEL 8/9
setsebool -P samba_export_all_rw on
chcon -R -t samba_share_t /srv/shares/

# Firewall (nftables)
firewall-cmd --permanent --add-service=samba
firewall-cmd --reload

Debian 10 / 11 / 12

# Ingressar no domínio
realm join --user=Administrator empresa.local

# Configurar PAM
pam-auth-update --enable mkhomedir

# NSS — edite /etc/nsswitch.conf
# passwd: files winbind
# group:  files winbind

# Serviços
systemctl enable --now winbind smbd nmbd

# AppArmor (Debian 11/12) — pode precisar de ajustes
aa-status
# Se bloquear, adicione regras ou desative para teste:
# aa-disable /usr/sbin/smbd

Ubuntu 20.04 / 22.04 / 24.04

# Ingressar no domínio
realm join --user=Administrator empresa.local

# PAM
pam-auth-update --enable mkhomedir

# NSS — edite /etc/nsswitch.conf
# passwd: files systemd winbind
# group:  files systemd winbind

# Serviços
systemctl enable --now winbind smbd nmbd

# UFW
ufw allow samba

# Ubuntu 22.04/24.04: systemd-resolved pode conflitar com DNS do AD
# Configure /etc/systemd/resolved.conf:
# [Resolve]
# DNS=192.168.1.10 192.168.1.11
# Domains=empresa.local
# DNSStubListener=no
systemctl restart systemd-resolved

9. Testing and validating

9.1 Winbind test

# Listar usuários do AD (pode ser lento em domínios grandes)
wbinfo -u | head -20

# Listar grupos
wbinfo -g | head -20

# Consultar usuário específico
wbinfo -i "EMPRESA\joao.silva"

# Testar autenticação
wbinfo -a "EMPRESA\joao.silva"

# Traduzir SID para nome
wbinfo -s S-1-5-21-XXXXXXXXX-YYYYYYYYY-ZZZZZZZZZ-1104

9.2 Identity resolution test

# Deve retornar o usuário com UID mapeado
getent passwd "EMPRESA\joao.silva"
# Saída esperada: EMPRESA\joao.silva:*:21104:20513:Joao Silva:/home/EMPRESA/joao.silva:/bin/bash

# Grupos
getent group "EMPRESA\GRP_Financeiro"

9.3 Share test

# No próprio servidor
smbclient //localhost/financeiro -U "EMPRESA\joao.silva" -k

# Listar compartilhamentos
smbclient -L //srv-files -U "EMPRESA\joao.silva"

# No cliente Windows — via CMD
net use Z: \\srv-files\financeiro /user:EMPRESA\joao.silva
dir Z:\

9.4 Validate Samba configuration

testparm -s
testparm --suppress-prompt

9.5 Check ACLs

# ACL POSIX
getfacl /srv/shares/financeiro

# ACL Windows (xattr)
getfattr -n security.NTACL /srv/shares/financeiro

# Via Samba (mostra como o cliente Windows veria)
smbcacls //localhost/financeiro / -U "EMPRESA\Administrator" -k

10. Troubleshooting

Problem: net ads join fails with "Connection refused"

# Verifique conectividade com o DC
telnet dc01.empresa.local 88    # Kerberos
telnet dc01.empresa.local 389   # LDAP
telnet dc01.empresa.local 445   # SMB

# Verifique o ticket Kerberos
kinit [email protected]
klist

# DNS correto?
host -t SRV _ldap._tcp.empresa.local

Problem: Winbind does not resolve users

# Status do Winbind
systemctl status winbind

# Pipe de comunicação presente?
ls -la /var/lib/samba/winbindd_privileged/

# Teste direto
wbinfo --ping-dc

# Logs
tail -f /var/log/samba/log.winbindd

Problem: Permission denied even with user in the correct group

# Verifique o mapeamento do grupo
id "EMPRESA\joao.silva"
# Deve mostrar os GIDs dos grupos AD

# Verifique ACL do diretório
getfacl /srv/shares/financeiro

# SELinux bloqueando? (RHEL/OL)
ausearch -m avc -ts recent | grep samba
sealert -a /var/log/audit/audit.log

Problem: UID/GID conflict between servers

This occurs when two servers use idmap backend = rid but with different ranges, or when the domain was recreated.

# Verifique o range configurado em ambos os servidores
grep -A5 "idmap config EMPRESA" /etc/samba/smb.conf

# Limpe o cache do Winbind (CUIDADO em produção)
net cache flush
systemctl restart winbind

Problem: Time out of sync (clock skew)

# Verifique a diferença de tempo com o DC
ntpdate -q dc01.empresa.local

# Force sincronização
chronyc makestep
# ou
ntpdate -u dc01.empresa.local

Problem: smb.conf with syntax error

testparm 2>&1 | grep -i "error\|warn"

11. Quick command reference

##── Domínio ──────────────────────────────────────────────────
net ads testjoin               # Verifica o ingresso no domínio
net ads info                   # Info do domínio
net ads status                 # Status da conta de máquina
kinit [email protected]  # Obtém ticket Kerberos
klist                          # Lista tickets ativos

##── Winbind ──────────────────────────────────────────────────
wbinfo -t                      # Testa trust com o DC
wbinfo --ping-dc               # Ping no DC via winbind
wbinfo -i "EMPRESA\usuario"    # Info do usuário
wbinfo -n "EMPRESA\grupo"      # Resolve nome para SID
wbinfo -s S-1-5-21-...-1104    # Resolve SID para nome

##── Samba ────────────────────────────────────────────────────
testparm -s                    # Valida smb.conf
smbstatus                      # Conexões ativas
smbclient -L //localhost -k    # Lista shares
smbcacls //localhost/share / -k  # Exibe ACLs Windows

##── Identidades ─────────────────────────────────────────────
getent passwd "EMPRESA\usuario"
getent group "EMPRESA\grupo"
id "EMPRESA\usuario"

##── ACLs ─────────────────────────────────────────────────────
getfacl /srv/shares/financeiro
setfacl -m g:"EMPRESA\GRP_Financeiro":rwx /srv/shares/financeiro
setfacl -m d:g:"EMPRESA\GRP_Financeiro":rwx /srv/shares/financeiro  # Herança

##── Serviços ─────────────────────────────────────────────────
# RHEL 7+, Debian 9+, Ubuntu 16.04+
systemctl restart smb winbind      # RHEL
systemctl restart smbd nmbd winbind  # Debian/Ubuntu
systemctl status smb winbind
journalctl -u winbind -f

##── Logs ─────────────────────────────────────────────────────
tail -f /var/log/samba/log.smbd
tail -f /var/log/samba/log.winbindd
tail -f /var/log/samba/log.wb-EMPRESA

Conclusion

Samba integration with Active Directory allows the Linux server to function as a first-class file server in the Windows ecosystem, with:

• Centralized authentication via Kerberos/AD — no local users needed

• Permission inheritance — groups and ACLs defined in AD applied directly to the Linux filesystem

• Windows ACLs via xattr — Windows administrators configure permissions with a familiar interface

• Automatic SID mapping — via Winbind rid or ad (RFC2307)

The critical success points are: correct DNS pointing to AD, synchronized NTP, consistent idmap range across all servers, and filesystem with xattr/ACL support.

Document generated by Nyverra Infraestrutura · empresa.local is an example domain — replace with the real domain of the environment.