Skip to main content

LDAP enable

LDAP + SSSD Client Enrollment Guide

This page explains how to enroll new Linux machines (such as Arch Linux) into the LDAP directory service using SSSD, based on the proven working configuration from the ul server.

1. Does first-time login create a home directory?

By default, the server ul's current PAM configuration does NOT automatically create home directories.

To enable automatic home directory creation on client machines (and copy all default shell configurations from /etc/skel), you must add the pam_mkhomedir.so module to your PAM configuration.

Add this line to /etc/pam.d/system-auth right before the session optional pam_sss.so line:

session    required                    pam_mkhomedir.so skel=/etc/skel/ umask=0022

When an LDAP user logs in for the first time:

    /home/<username> is created. Default configurations (e.g. .bashrc) are copied from /etc/skel/. Correct ownership and permissions (0755) are automatically applied.

    2. Enrollment Steps

    Step 1: Install SSSD

    Install the System Security Services Daemon package.

    • Arch Linux: 
      sudo pacman -Syu sssd
    • Debian / Ubuntu: 
      sudo apt install sssd sssd-tools sssd-ldap

    Step 2: Configure SSSD (/etc/sssd/sssd.conf)

    Create or edit the configuration file:

    sudo nanovim /etc/sssd/sssd.conf

    Paste the following configuration:

    [sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/goauthentik.io]
debug_level = 9
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://[fd77:7777:5010:0:1337:f1ac:d00d:aaaa]:ldap.drheck.dev:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS
ldap_tls_reqcert = never
ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true

    Set secure permissions on the file (SSSD will fail to start if permissions are loose):

    sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf

    Step 3: Configure NSS (/etc/nsswitch.conf)

    Open /etc/nsswitch.conf:

    sudo nanovim /etc/nsswitch.conf

    Ensure the passwd, group, and shadow lines look like this:

    passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat sss

    Step 4: Configure PAM (/etc/pam.d/system-auth)

    Open /etc/pam.d/system-auth:

    sudo nanovim /etc/pam.d/system-auth

    Replace or configure the content with the working PAM stack below:

    Note: The pam_mkhomedir.so module is included in the session block. This module is what automatically creates a local home directory on first-time login (copying skeleton configs from /etc/skel and applying standard 0755 permissions).

    #%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       sufficient                  pam_sss.so           forward_pass
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

account    sufficient                  pam_sss.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   sufficient                  pam_sss.so
password   required                    pam_unix.so          try_first_pass nullok sha512 shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_sss.so
session    optional                    pam_permit.so

    Step 5: Start & Enable SSSD

    Enable SSSD to run on boot and start it:

    sudo systemctl enable --now sssd

    3. Verifying the Setup

    • Check User resolution: 
      getent passwd <ldap-username>
    • Check Group resolution: 
      getent group <ldap-groupname>
    • Verify Login & Home Dir Creation: 
      ssh <ldap-username>@localhost