Skip to main content

LDAP + SSSD Client Enrollment Guide

LDAP + SSSD Client Enrollment Guide

This page explains how to enroll new Linux machines (such as Arch Linux) into the LDAP directory service using SSSD, based on the proven working configuration from the ul server.

Enrollment Steps

Step 1: Install SSSD

Install the System Security Services Daemon package.

  • Arch Linux: 
    sudo pacman -Syu sssd
  • Debian / Ubuntu: 
    sudo apt install sssd sssd-tools sssd-ldap

Step 2: Configure SSSD (/etc/sssd/sssd.conf)

Create or edit the configuration file:

sudo vim /etc/sssd/sssd.conf

Paste the following configuration:

[sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/goauthentik.io]
debug_level = 9
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://ldap.drheck.dev:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS

# Secure Production TLS Configuration (Let's Encrypt)
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/ssl/certs

ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true

Set secure permissions on the file (SSSD will fail to start if permissions are loose):

sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf

Step 3: Configure NSS (/etc/nsswitch.conf)

Open /etc/nsswitch.conf:

sudo vim /etc/nsswitch.conf

Ensure the passwd, group, and shadow lines look like this:

passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat sss

Step 4: Configure PAM (/etc/pam.d/system-auth)

Open /etc/pam.d/system-auth:

sudo vim /etc/pam.d/system-auth

Replace or configure the content with the working PAM stack below:

Note: The pam_mkhomedir.so module is included in the session block. This module is what automatically creates a local home directory on first-time login (copying skeleton configs from /etc/skel and applying standard 0755 permissions).

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       sufficient                  pam_sss.so           forward_pass
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

account    sufficient                  pam_sss.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   sufficient                  pam_sss.so
password   required                    pam_unix.so          try_first_pass nullok sha512 shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_sss.so
session    optional                    pam_permit.so

Step 5: Start & Enable SSSD

Enable SSSD to run on boot and start it:

sudo systemctl enable --now sssd

Verifying the Setup

  • Check User resolution: 
    getent passwd <ldap-username>
  • Check Group resolution: 
    getent group <ldap-groupname>
  • Verify Login & Home Dir Creation: 
    ssh <ldap-username>@localhost

Important Note on Debug Logging (Debug Level 9)

Your current configuration has debug_level = 9 enabled under multiple sections in sssd.conf.

  • Level 9 is the absolute highest and most verbose debug level possible in SSSD. It logs every single internal function call, search query, and raw network event.
  • Risk: This will generate extremely large log files in /var/log/sssd/ very quickly and can easily fill up your disk.
  • Recommendation: Once you have verified that the enrollment works perfectly, you should open /etc/sssd/sssd.conf and change debug_level = 9 to a lower level (such as 2 or 1), or remove the debug_level lines entirely to use SSSD's default quiet logging.