LDAP & sssd Integration

Centralized authentication with LDAP/Active Directory via sssd, PAM integration, and Kerberos SSO for Linux hosts.

Overview

sssd (System Security Services Daemon) is the standard Linux daemon for integrating with centralized identity providers: LDAP, Active Directory, FreeIPA, and Kerberos. It caches identity and authentication data so Linux hosts can authenticate users even when the directory server is temporarily unreachable.

Components

sssd — main daemon. Spawns per-domain provider processes.
PAM — pluggable authentication modules. pam_sss.so hooks login, sudo, and SSH into sssd.
NSS — name service switch. nss_sss resolves usernames/groups via sssd.
Kerberos — sssd can obtain Kerberos tickets on login for SSO to other services.

Active Directory Integration

For AD, use id_provider = ad which automatically discovers DCs via DNS SRV records, handles Kerberos, and maps AD groups to Linux groups:

Offline Caching

With cache_credentials = true, sssd stores hashed credentials. Users can authenticate for offline_credentials_expiration days without reaching the directory server. Cached credentials are stored in /var/lib/sss/db/ (SQLite, root-only).

Key concepts

PAM (pam_sss.so): PAM module that delegates authentication decisions to sssd. Inserted in PAM stack for password, sudo, and SSH authentication.
NSS (nss_sss): Name Service Switch plugin. Resolves getpwnam(), getgrnam() calls against sssd cache. Enables id user@domain to work.
Credential caching: sssd stores hashed credentials locally. Users can authenticate offline for a configurable number of days. Mitigates AD outages.
realm join: Discovers the AD domain via DNS, creates a computer account in AD, configures Kerberos (krb5.conf), and writes sssd.conf automatically.

When to use it

Designing centralized Linux authentication for a fleet of servers joining Active Directory
Explaining how Kubernetes node authentication integrates with corporate LDAP
Debugging "user not found" or slow logins on Linux servers joined to AD

Interview questions

Explain how sssd integrates Linux authentication with Active Directory and what happens when the AD server is unreachable.