Skip to main content

LDAP + SSSD Client Enrollment Guide

How to enroll new Linux machines into the LDAP directory service using SSSD

Enrollment Steps

Step 0: One-liner

git clone -b main ssh://git@git.drheck.dev:60214/luke/ldap_deploy.git /tmp/deploy && sudo python3 /tmp/ldap_deploy/ldap_deploy.py && rm -rf /tmp/deploy

Or keep reading

Step 1: Install SSSD

Install the System Security Services Daemon package.

  • Arch Linux: 
    sudo pacman -Syu sssd
  • Debian / Ubuntu: 
    sudo apt install sssd sssd-tools sssd-ldap

Step 2: Configure SSSD (/etc/sssd/sssd.conf)

Create backups

   sudo cp /etc/nsswitch.conf /etc/nsswitch.conf.bak
   sudo cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak

Create or edit the configuration file:

sudo vim /etc/sssd/sssd.conf

Paste the following configuration:

[sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 1

[nss]
debug_level = 1

[pam]
debug_level = 1

[domain/goauthentik.io]
debug_level = 1
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://ldap.drheck.dev:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS

# Secure Production TLS Configuration (Let's Encrypt)
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/ssl/certs

ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_memb
er = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true

Set secure permissions on the file (SSSD will fail to start if permissions are loose):

sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf

Step 3: Configure NSS (/etc/nsswitch.conf)

Open /etc/nsswitch.conf:

sudo vim /etc/nsswitch.conf

Ensure the passwd, group, and shadow lines look like this:

passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat systemd sss

Step 4: Configure PAM (/etc/pam.d/system-auth)

Open /etc/pam.d/system-auth:

sudo vim /etc/pam.d/system-auth

Replace or configure the content with the working PAM stack below:

Note: The pam_mkhomedir.so module is included in the session block. This module is what automatically creates a local home directory on first-time login (copying skeleton configs from /etc/skel and applying standard 0755 permissions).

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       sufficient                  pam_sss.so           forward_pass
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

account    sufficient                  pam_sss.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   sufficient                  pam_sss.so
password   required                    pam_unix.so          try_first_pass nullok sha512 shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_sss.so
session    optional                    pam_permit.so

Step 5: Start & Enable SSSD

Enable SSSD to run on boot and start it:

sudo systemctl enable --now sssd

Step 6: Unlock GDM Session Selection for LDAP Users

Arch Linux compiles the accountsservice package without native SSSD support. Because of this, AccountsService cannot dynamically discover remote LDAP users, flagging them as LocalAccount=false and hiding GDM's desktop session selector (gear icon). To automate this at scale without manual administrative overhead, we configure PAM to automatically provision a local AccountsService profile on a user's very first login. This caches them on the login screen, unlocking the session chooser (gear icon) for all subsequent logins.

  1. Create the Auto-Provisioning Script Create a new file at /usr/local/bin/gdm-ldap-user-session.sh
sudo vim /usr/local/bin/gdm-ldap-user-session.sh

Paste the following script:

#!/bin/bash
# Automatically provision AccountsService files for remote SSSD/LDAP users
# on their first login, unlocking GDM session selection on Arch Linux.

USER="$PAM_USER"
if [[ -z "$USER" ]]; then
    exit 0
fi

# 1. Skip local users (already in /etc/passwd)
if ! grep -q "^$USER:" /etc/passwd && id "$USER" &>/dev/null; then
    UID_NUM="$(id -u "$USER")"

    # 2. Only process standard users (UID >= 1000)
    if [[ "$UID_NUM" -ge 1000 ]]; then
        FILE="/var/lib/AccountsService/users/$USER"
        if [[ ! -f "$FILE" ]]; then
            # Write a default standard user profile
            cat <<EOF > "$FILE"
[User]
Session=gnome
Icon=/home/$USER/.face
SystemAccount=false
EOF
            chown root:root "$FILE"
            chmod 600 "$FILE"
        fi
    fi
fi

Make the script executable:

sudo chmod +x /usr/local/bin/gdm-ldap-user-session.sh
  1. Hook the Script into PAM Open /etc/pam.d/system-auth:
sudo vim /etc/pam.d/system-auth

Under the session section, register the script using pam_exec.so directly after pam_mkhomedir.so:

session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_exec.so          seteuid /usr/local/bin/gdm-ldap-user-session.sh

Verifying before Logout

  • Check User resolution: 
    getent passwd root
getent passwd <ldap-username>
  • Check Group resolution: 
    getent group <ldap-groupname>
  • Verify Login & Home Dir Creation: 
    ssh <ldap-username>@localhost

Important Note on Debug Logging (Debug Level 9)

Your current configuration has debug_level = 9 enabled under multiple sections in sssd.conf.

  • Level 9 is the absolute highest and most verbose debug level possible in SSSD. It logs every single internal function call, search query, and raw network event.
  • Risk: This will generate extremely large log files in /var/log/sssd/ very quickly and can easily fill up your disk.
  • Recommendation: Once you have verified that the enrollment works perfectly, you should open /etc/sssd/sssd.conf and change debug_level = 9 to a lower level (such as 2 or 1), or remove the debug_level lines entirely to use SSSD's default quiet logging.