Skip to main content

LDAP + SSSD Client Enrollment Guide

This page explains how to enroll new Linux machines into the LDAP directory service using SSSD, based on a working configuration from the ul server.

Enrollment Steps

Step 1: Install SSSD

Install the System Security Services Daemon package.

  • Arch Linux: 
    sudo pacman -Syu sssd
  • Debian / Ubuntu: 
    sudo apt install sssd sssd-tools sssd-ldap

Step 2: Configure SSSD (/etc/sssd/sssd.conf)

Create or edit the configuration file:

sudo vim /etc/sssd/sssd.conf

Paste the following configuration:

[sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 9

[nss]
debug_level = 9

[pam]
debug_level = 9

[domain/goauthentik.io]
debug_level = 9
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://ldap.drheck.dev:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS

# Secure Production TLS Configuration (Let's Encrypt)
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/ssl/certs

ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true

Set secure permissions on the file (SSSD will fail to start if permissions are loose):

sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf

Step 3: Configure NSS (/etc/nsswitch.conf)

Open /etc/nsswitch.conf:

sudo vim /etc/nsswitch.conf

Ensure the passwd, group, and shadow lines look like this:

passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat sss

Step 4: Configure PAM (/etc/pam.d/system-auth)

Open /etc/pam.d/system-auth:

sudo vim /etc/pam.d/system-auth

Replace or configure the content with the working PAM stack below:

Note: The pam_mkhomedir.so module is included in the session block. This module is what automatically creates a local home directory on first-time login (copying skeleton configs from /etc/skel and applying standard 0755 permissions).

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       sufficient                  pam_sss.so           forward_pass
auth       [success=1 default=bad]     pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

account    sufficient                  pam_sss.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

password   sufficient                  pam_sss.so
password   required                    pam_unix.so          try_first_pass nullok sha512 shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    required                    pam_mkhomedir.so     skel=/etc/skel/ umask=0022
session    optional                    pam_sss.so
session    optional                    pam_permit.so

Step 5: Start & Enable SSSD

Enable SSSD to run on boot and start it:

sudo systemctl enable --now sssd

Verifying the Setup

  • Check User resolution: 
    getent passwd <ldap-username>
  • Check Group resolution: 
    getent group <ldap-groupname>
  • Verify Login & Home Dir Creation: 
    ssh <ldap-username>@localhost

Important Note on Debug Logging (Debug Level 9)

Your current configuration has debug_level = 9 enabled under multiple sections in sssd.conf.

  • Level 9 is the absolute highest and most verbose debug level possible in SSSD. It logs every single internal function call, search query, and raw network event.
  • Risk: This will generate extremely large log files in /var/log/sssd/ very quickly and can easily fill up your disk.
  • Recommendation: Once you have verified that the enrollment works perfectly, you should open /etc/sssd/sssd.conf and change debug_level = 9 to a lower level (such as 2 or 1), or remove the debug_level lines entirely to use SSSD's default quiet logging.