Skip to main content

LDAP enable

LDAP + SSSD Client Enrollment Guide

This page explains how to enroll new Linux machines (such as Arch Linux) into the LDAP directory service using SSSD, based on the proven working configuration from the ul server.

1. Does first-time login create a home directory?

By default, the server ul's current PAM configuration does NOT automatically create home directories.

To enable automatic home directory creation on client machines (and copy all default shell configurations from /etc/skel), you must add the pam_mkhomedir.so module to your PAM configuration.

Add this line to /etc/pam.d/system-auth right before the session optional pam_sss.so line:

session    required                    pam_mkhomedir.so skel=/etc/skel/ umask=0022

When an LDAP user logs in for the first time:

  1. /home/<username> is created.
  2. Default configurations (e.g. .bashrc) are copied from /etc/skel/.
  3. Correct ownership and permissions (0755) are automatically applied.

2. Enrollment Steps

Step 1: Install SSSD

Install the System Security Services Daemon package.

  • Arch Linux: 
    sudo pacman -Syu sssd
  • Debian / Ubuntu: 
    sudo apt install sssd sssd-tools sssd-ldap

Step 2: Configure SSSD (/etc/sssd/sssd.conf)

Create or edit the configuration file:

sudo nano /etc/sssd/sssd.conf

Paste the following configuration:

[sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/goauthentik.io]
debug_level = 9
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://[fd77:7777:5010:0:1337:f1ac:d00d:aaaa]:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS
ldap_tls_reqcert = never
ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true

Set secure permissions on the file (SSSD will fail to start if permissions are loose):

sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf

Step 3: Configure NSS (/etc/nsswitch.conf)

Open /etc/nsswitch.conf:

sudo nano /etc/nsswitch.conf

Ensure the passwd, group, and shadow lines look like this:

passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat sss

Step 4: Configure PAM (/etc/pam.d/system-auth)

Open /etc/pam.d/system-auth:

sudo nano /etc/pam.d/system-auth

Replace or configure the content with the working PAM stack below:

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       sufficient                  pam_sss.so           forward_pass
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

account    sufficient                  pam_sss.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   sufficient                  pam_sss.so
password   required                    pam_unix.so          try_first_pass nullok sha512 shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_sss.so
session    optional                    pam_permit.so

Step 5: Start & Enable SSSD

Enable SSSD to run on boot and start it:

sudo systemctl enable --now sssd

3. Verifying the Setup

  • Check User resolution: 
    getent passwd <ldap-username>
  • Check Group resolution: 
    getent group <ldap-groupname>
  • Verify Login & Home Dir Creation: 
    ssh <ldap-username>@localhost