LDAP + SSSD Client Enrollment Guide

How to enroll new Linux machines into the LDAP directory service using SSSD

---

Enrollment Steps

Step 0: One-liner

git clone -b main ssh://git@git.drheck.dev:60214/luke/ldap_deploy.git /tmp/deploy && sudo python3 /tmp/ldap_deploy/ldap_deploy.py && rm -rf /tmp/deploy

Or keep reading

Step 1: Install SSSD

Install the System Security Services Daemon package.

• Arch Linux:

  sudo pacman -Syu sssd
  

• Debian / Ubuntu:

  sudo apt install sssd sssd-tools sssd-ldap
  

---

Step 2: Configure SSSD (/etc/sssd/sssd.conf)

Create backups

   sudo cp /etc/nsswitch.conf /etc/nsswitch.conf.bak
   sudo cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak

Edit the configuration file:

sudo vim /etc/sssd/sssd.conf

Contents:

[sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 1

[nss]
debug_level = 1

[pam]
debug_level = 1

[domain/goauthentik.io]
debug_level = 1
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://ldap.drheck.dev:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS

# TLS Configuration
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/ssl/certs

ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_memb
er = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true

Set permissions on the file (SSSD will fail to start if permissions otherwise):

sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf

---

Step 3: Configure NSS (/etc/nsswitch.conf)

Open /etc/nsswitch.conf:

sudo vim /etc/nsswitch.conf

There is more config than this; ensure these are correct:

passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat systemd sss

---

Step 4: Configure PAM (/etc/pam.d/system-auth)

Open /etc/pam.d/system-auth:

sudo vim /etc/pam.d/system-auth

Replace the content with this working PAM stack:

Note: The pam_mkhomedir.so module is included in the session block. This module is what automatically creates a local home directory on first-time login (copying skeleton configs from /etc/skel and applying standard 0755 permissions).

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       sufficient                  pam_sss.so           forward_pass
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

account    sufficient                  pam_sss.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   sufficient                  pam_sss.so
password   required                    pam_unix.so          try_first_pass nullok sha512 shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_sss.so
session    optional                    pam_permit.so

---

Step 5: Start & Enable SSSD

Enable SSSD to run on boot and start it:

sudo systemctl enable --now sssd

---

Step 6: Unlock GDM Session Selection for LDAP Users

Arch compiles the accountsservice package without native SSSD support. Because of this, AccountsService cannot dynamically discover remote LDAP users, flagging them as LocalAccount=false and hiding GDM's desktop session selector (the gear icon). To fix this configure PAM to automatically provision a local AccountsService profile on a user's very first login. This caches them on the login screen, unlocking the session selector (gear icon) for all subsequent logins.

1. Create the Auto-Provisioning Script Create a new file at /usr/local/bin/gdm-ldap-user-session.sh

sudo vim /usr/local/bin/gdm-ldap-user-session.sh

Paste the following script:

#!/bin/bash
# Automatically provision AccountsService files for remote SSSD/LDAP users
# on their first login, unlocking GDM session selection on Arch Linux.

USER="$PAM_USER"
if [[ -z "$USER" ]]; then
    exit 0
fi

# 1. Skip local users (already in /etc/passwd)
if ! grep -q "^$USER:" /etc/passwd && id "$USER" &>/dev/null; then
    UID_NUM="$(id -u "$USER")"

    # 2. Only process standard users (UID >= 1000)
    if [[ "$UID_NUM" -ge 1000 ]]; then
        FILE="/var/lib/AccountsService/users/$USER"
        if [[ ! -f "$FILE" ]]; then
            # Write a default standard user profile
            cat <<EOF > "$FILE"
[User]
Session=gnome
Icon=/home/$USER/.face
SystemAccount=false
EOF
            chown root:root "$FILE"
            chmod 600 "$FILE"
        fi
    fi
fi

Make the script executable:

sudo chmod +x /usr/local/bin/gdm-ldap-user-session.sh

2. Hook the Script into PAM Open /etc/pam.d/system-auth:

sudo vim /etc/pam.d/system-auth

Under the session section, register the script using pam_exec.so directly after pam_mkhomedir.so:

session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_exec.so          seteuid /usr/local/bin/gdm-ldap-user-session.sh

---

Verifying before Logout

• Check User resolution:

  getent passwd root
  getent passwd <ldap-username>
  

• Check Group resolution:

  getent group <ldap-groupname>
  

• Verify Login & Home Dir Creation:

  ssh <ldap-username>@localhost
  

---