LDAP + SSSD Client Enrollment Guide
This page explains how to enroll new Linux machines into the LDAP directory service using SSSD, based on a working configuration from the ul server.
Enrollment Steps
Step 1: Install SSSD
Install the System Security Services Daemon package.
- Arch Linux:
sudo pacman -Syu sssd - Debian / Ubuntu:
sudo apt install sssd sssd-tools sssd-ldap
Step 2: Configure SSSD (/etc/sssd/sssd.conf)
Create backups
sudo cp /etc/nsswitch.conf /etc/nsswitch.conf.bak
sudo cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak
Create or edit the configuration file:
sudo vim /etc/sssd/sssd.conf
Paste the following configuration:
[sssd]
services = nss, pam
config_file_version = 2
domains = goauthentik.io
debug_level = 9
[nss]
debug_level = 9
[pam]
debug_level = 9
[domain/goauthentik.io]
debug_level = 9
id_provider = ldap
auth_provider = ldap
ldap_uri = ldaps://ldap.drheck.dev:636
ldap_search_base = dc=ldap,dc=goauthentik,dc=io
ldap_default_bind_dn = cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io
ldap_default_authtok = hgNbhl3t1hzyV4jdfsiQuAeYS
# Secure Production TLS Configuration (Let's Encrypt)
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/ssl/certs
ldap_schema = rfc2307bis
ldap_user_object_class = posixAccount
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = posixGroup
ldap_group_name = cn
ldap_group_gid_number = gidNumber
ldap_group_member = member
ldap_ignore_unreadable_references = true
default_shell = /bin/bash
fallback_homedir = /home/%u
enumerate = false
cache_credentials = true
Set secure permissions on the file (SSSD will fail to start if permissions are loose):
sudo chmod 600 /etc/sssd/sssd.conf
sudo chown root:root /etc/sssd/sssd.conf
Step 3: Configure NSS (/etc/nsswitch.conf)
Open /etc/nsswitch.conf:
sudo vim /etc/nsswitch.conf
Ensure the passwd, group, and shadow lines look like this:
passwd: compat mymachines systemd sss
group: compat mymachines systemd sss
shadow: compat systemd sss
Step 4: Configure PAM (/etc/pam.d/system-auth)
Open /etc/pam.d/system-auth:
sudo vim /etc/pam.d/system-auth
Replace or configure the content with the working PAM stack below:
Note: The
pam_mkhomedir.somodule is included in thesessionblock. This module is what automatically creates a local home directory on first-time login (copying skeleton configs from/etc/skeland applying standard0755permissions).
#%PAM-1.0
auth required pam_faillock.so preauth
auth sufficient pam_sss.so forward_pass
auth [success=1 default=bad] pam_unix.so try_first_pass nullok
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
account sufficient pam_sss.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
password sufficient pam_sss.so
password required pam_unix.so try_first_pass nullok sha512 shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session optional pam_sss.so
session optional pam_permit.so
Step 5: Start & Enable SSSD
Enable SSSD to run on boot and start it:
sudo systemctl enable --now sssd
Step 6: Unlock GDM Session Selection for LDAP Users
Arch Linux compiles the accountsservice package without native SSSD support. Because of this, AccountsService cannot dynamically discover remote LDAP users, flagging them as LocalAccount=false and hiding GDM's desktop session selector (gear icon). To automate this at scale without manual administrative overhead, we configure PAM to automatically provision a local AccountsService profile on a user's very first login. This caches them on the login screen, unlocking the session chooser (gear icon) for all subsequent logins.
/usr/local/bin/gdm-ldap-user-session.sh
sudo vim /usr/local/bin/gdm-ldap-user-session.sh
Paste the following script:
#!/bin/bash
# Automatically provision AccountsService files for remote SSSD/LDAP users
# on their first login, unlocking GDM session selection on Arch Linux.
USER="$PAM_USER"
if [[ -z "$USER" ]]; then
exit 0
fi
# 1. Skip local users (already in /etc/passwd)
if ! grep -q "^$USER:" /etc/passwd && id "$USER" &>/dev/null; then
UID_NUM="$(id -u "$USER")"
# 2. Only process standard users (UID >= 1000)
if [[ "$UID_NUM" -ge 1000 ]]; then
FILE="/var/lib/AccountsService/users/$USER"
if [[ ! -f "$FILE" ]]; then
# Write a default standard user profile
cat <<EOF > "$FILE"
[User]
Session=gnome
Icon=/home/$USER/.face
SystemAccount=false
EOF
chown root:root "$FILE"
chmod 600 "$FILE"
fi
fi
fi
Make the script executable:
sudo chmod +x /usr/local/bin/gdm-ldap-user-session.sh
/etc/pam.d/system-auth:
sudo vim /etc/pam.d/system-auth
Under the session section, register the script using pam_exec.so directly after pam_mkhomedir.so:
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
session optional pam_exec.so seteuid /usr/local/bin/gdm-ldap-user-session.sh
Verifying before Logout
- Check User resolution:
getent passwd root getent passwd <ldap-username> - Check Group resolution:
getent group <ldap-groupname> - Verify Login & Home Dir Creation:
ssh <ldap-username>@localhost
Important Note on Debug Logging (Debug Level 9)
Your current configuration has debug_level = 9 enabled under multiple sections in sssd.conf.
- Level 9 is the absolute highest and most verbose debug level possible in SSSD. It logs every single internal function call, search query, and raw network event.
- Risk: This will generate extremely large log files in
/var/log/sssd/very quickly and can easily fill up your disk. - Recommendation: Once you have verified that the enrollment works perfectly, you should open
/etc/sssd/sssd.confand changedebug_level = 9to a lower level (such as2or1), or remove thedebug_levellines entirely to use SSSD's default quiet logging.