SSSD and Active Directory Integration

Overview

• What you will learn: How the System Security Services Daemon (SSSD) provides centralized identity and authentication services, how to join an Ubuntu server to an Active Directory (AD) domain using realmd, configure sssd.conf for AD integration, integrate PAM and NSS for seamless login, understand ID mapping strategies (automatic versus POSIX attributes), and apply Group Policy Objects (GPOs) to Linux hosts.
• Prerequisites: Lesson 50 (OpenLDAP Directory Service), familiarity with Active Directory concepts (domains, OUs, GPOs)
• Estimated reading time: 30 minutes

Introduction

In enterprise environments, Active Directory (AD) is the dominant directory service. It stores user accounts, groups, computer objects, and security policies for Windows-based networks. When Linux servers join the same environment, they need a way to authenticate users against AD, map AD identities to POSIX UIDs and GIDs, and optionally apply AD group policies.

The System Security Services Daemon (SSSD) is the standard solution on modern Linux distributions for integrating with external identity sources — Active Directory, LDAP, Kerberos, and FreeIPA. SSSD caches credentials locally so that authentication works even when the domain controller is temporarily unreachable.

In this lesson you will join an Ubuntu server to an AD domain, configure SSSD for identity resolution and authentication, integrate PAM and NSS, understand ID mapping, and explore GPO-based access control.

SSSD Architecture

SSSD sits between the operating system’s authentication and identity subsystems (PAM and NSS) and the remote identity provider (Active Directory, LDAP, or Kerberos). It provides:

• Identity resolution: Translates AD user and group names to POSIX UIDs and GIDs via NSS.
• Authentication: Validates passwords against AD via Kerberos through PAM.
• Credential caching: Caches user information and tickets locally so offline authentication is possible.
• Access control: Determines which AD users and groups are allowed to log in.

# The data flow:
# Application -> PAM/NSS -> SSSD -> Active Directory (LDAP + Kerberos)
#
# SSSD processes:
#   sssd           - monitor process
#   sssd_be        - backend (AD provider)
#   sssd_nss       - NSS responder (getpwnam, getgrnam)
#   sssd_pam       - PAM responder (authentication)

# Check if SSSD is running
$ sudo systemctl status sssd

Joining Active Directory with realmd

The realmd tool automates the process of joining a Linux machine to an AD domain. It discovers the domain, installs necessary packages, configures Kerberos, joins the machine, and generates the initial sssd.conf.

Prerequisites

# Install required packages
$ sudo apt install realmd sssd sssd-tools libnss-sss libpam-sss 
    adcli samba-common-bin krb5-user packagekit

# Ensure DNS resolves the AD domain
$ host example.com
$ host -t SRV _ldap._tcp.example.com
_ldap._tcp.example.com has SRV record 0 100 389 dc1.example.com.

# Ensure time is synchronized
$ timedatectl status

Discover and Join

# Discover the AD realm
$ realm discover example.com
example.com
  type: kerberos
  realm-name: EXAMPLE.COM
  domain-name: example.com
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: adcli

# Join the domain (prompts for AD admin password)
$ sudo realm join --user=Administrator example.com
Password for Administrator:

# Verify the join
$ realm list
example.com
  type: kerberos
  realm-name: EXAMPLE.COM
  domain-name: example.com
  configured: kerberos-member
  login-formats: %U@example.com
  login-policy: allow-realm-logins

Configuring sssd.conf

After joining, realmd creates /etc/sssd/sssd.conf. You will typically need to tune it for your environment.

# /etc/sssd/sssd.conf
[sssd]
domains = example.com
config_file_version = 2
services = nss, pam

[domain/example.com]
ad_domain = example.com
krb5_realm = EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
access_provider = ad
auth_provider = ad
chpass_provider = ad

# Login format: use short names (alice instead of alice@example.com)
use_fully_qualified_names = False
fallback_homedir = /home/%u
default_shell = /bin/bash

# ID mapping: auto-generate POSIX IDs from AD SIDs
ldap_id_mapping = True

# Performance tuning
enumerate = False
entry_cache_timeout = 300

# Access control: allow only specific groups
ad_gpo_access_control = enforcing
# Or use simple access provider:
# access_provider = simple
# simple_allow_groups = linux-admins, developers

# Set correct permissions (SSSD requires 600)
$ sudo chmod 600 /etc/sssd/sssd.conf

# Restart SSSD
$ sudo systemctl restart sssd

# Clear cache if needed
$ sudo sss_cache -E

PAM and NSS Integration

When SSSD is installed, it registers itself as a PAM module and an NSS source. This allows the system to look up AD users and groups through standard system calls and authenticate users through the standard login flow.

# Verify NSS configuration
$ grep sss /etc/nsswitch.conf
passwd:         files systemd sss
group:          files systemd sss
shadow:         files sss

# Test user lookup
$ id alice
uid=1234567(alice) gid=1234567(domain users) groups=1234567(domain users),1234568(developers)

$ getent passwd alice
alice:*:1234567:1234567:Alice Chen:/home/alice:/bin/bash

$ getent group "domain users"
domain users:*:1234567:alice,bob,charlie

# Enable automatic home directory creation
$ sudo pam-auth-update --enable mkhomedir

# Test SSH login with AD credentials
$ ssh alice@server1.example.com
# Password: (AD password)

ID Mapping Strategies

Automatic ID Mapping (ldap_id_mapping = True)

SSSD algorithmically generates POSIX UIDs and GIDs from AD Security Identifiers (SIDs). This is the default and requires no changes to AD schema. The mapping is deterministic — the same SID always produces the same UID on every Linux host.

POSIX Attributes in AD (ldap_id_mapping = False)

If your AD has the UNIX attributes (uidNumber, gidNumber, homeDirectory, loginShell) populated for users and groups, set ldap_id_mapping = False to use those values directly. This provides consistent IDs across NFS mounts.

# To use POSIX attributes from AD:
[domain/example.com]
ldap_id_mapping = False
# Requires Identity Management for UNIX or manually populated attributes

GPO-Based Access Control

SSSD can enforce Active Directory Group Policy Objects (GPOs) that control which users may log in to a Linux host. The ad_gpo_access_control setting determines the behavior.

# GPO access control modes in sssd.conf:
# enforcing  — deny login if GPO denies access (recommended)
# permissive — log but allow login (for testing)
# disabled   — ignore GPOs

[domain/example.com]
ad_gpo_access_control = enforcing

# In Active Directory, configure:
# Computer Configuration > Policies > Windows Settings >
#   Security Settings > Local Policies > User Rights Assignment >
#   "Allow log on locally" / "Deny log on locally"
#
# Apply the GPO to the OU containing the Linux computer object

Simple Access Control Alternative

# If GPOs are not available, use simple access provider
[domain/example.com]
access_provider = simple
simple_allow_groups = linux-admins, developers
simple_allow_users = alice, bob

# Or deny specific groups
simple_deny_groups = contractors

Troubleshooting

# Enable debug logging
[domain/example.com]
debug_level = 6

# Restart and check logs
$ sudo systemctl restart sssd
$ sudo journalctl -u sssd -f
$ sudo tail -f /var/log/sssd/sssd_example.com.log

# Test Kerberos authentication manually
$ kinit alice@EXAMPLE.COM
$ klist

# Check AD connectivity
$ adcli info example.com

# Re-join if the machine account is broken
$ sudo realm leave example.com
$ sudo realm join --user=Administrator example.com

# Clear all cached data
$ sudo systemctl stop sssd
$ sudo rm -f /var/lib/sss/db/*
$ sudo systemctl start sssd

Key Takeaways

• SSSD bridges Linux PAM/NSS with Active Directory, providing user lookup, authentication, credential caching, and access control in a single daemon.
• The realmd tool automates AD domain join — it discovers the domain, installs dependencies, configures Kerberos, and generates sssd.conf.
• Automatic ID mapping derives POSIX UIDs from AD SIDs without modifying the AD schema; use POSIX attributes for environments that require consistent UIDs across NFS.
• PAM and NSS integration enables transparent AD login; pam-auth-update --enable mkhomedir creates home directories automatically on first login.
• GPO-based access control or the simple access provider restricts which AD users and groups may log in to each Linux host.

What’s Next

In the next lesson you will learn about OpenVPN Setup — how to build a secure TLS-based VPN using Public Key Infrastructure with easy-rsa, configure server and client tunnels, and choose between routing and bridging modes.

# 安裝必要套件
$ sudo apt install realmd sssd sssd-tools libnss-sss libpam-sss 
    adcli samba-common-bin krb5-user

# 探索 AD 領域
$ realm discover example.com

# 加入網域
$ sudo realm join --user=Administrator example.com

# 驗證加入
$ realm list

# /etc/sssd/sssd.conf 主要設定
[domain/example.com]
ad_domain = example.com
krb5_realm = EXAMPLE.COM
cache_credentials = True
id_provider = ad
use_fully_qualified_names = False
fallback_homedir = /home/%u
default_shell = /bin/bash
ldap_id_mapping = True

# 設定正確的權限
$ sudo chmod 600 /etc/sssd/sssd.conf
$ sudo systemctl restart sssd

# 測試使用者查詢
$ id alice
$ getent passwd alice
$ getent group "domain users"

# 啟用自動家目錄建立
$ sudo pam-auth-update --enable mkhomedir

# 測試 AD 登入
$ ssh alice@server1.example.com

# sssd.conf 中的 GPO 存取控制模式：
# enforcing  — GPO 拒絕時拒絕登入（推薦）
# permissive — 記錄但允許登入（用於測試）
# disabled   — 忽略 GPO

[domain/example.com]
ad_gpo_access_control = enforcing

# 簡單存取控制替代方案
access_provider = simple
simple_allow_groups = linux-admins, developers

# 必要なパッケージのインストール
$ sudo apt install realmd sssd sssd-tools libnss-sss libpam-sss 
    adcli samba-common-bin krb5-user

# AD レルムの検出
$ realm discover example.com

# ドメインへの参加
$ sudo realm join --user=Administrator example.com

# 参加の検証
$ realm list

# /etc/sssd/sssd.conf の主要設定
[domain/example.com]
ad_domain = example.com
krb5_realm = EXAMPLE.COM
cache_credentials = True
id_provider = ad
use_fully_qualified_names = False
fallback_homedir = /home/%u
default_shell = /bin/bash
ldap_id_mapping = True

# 正しいパーミッションの設定
$ sudo chmod 600 /etc/sssd/sssd.conf
$ sudo systemctl restart sssd

# ユーザールックアップのテスト
$ id alice
$ getent passwd alice
$ getent group "domain users"

# 自動ホームディレクトリ作成の有効化
$ sudo pam-auth-update --enable mkhomedir

# AD ログインのテスト
$ ssh alice@server1.example.com

# sssd.conf の GPO アクセス制御モード：
# enforcing  — GPO が拒否すればログインを拒否（推奨）
# permissive — ログに記録するがログインは許可（テスト用）
# disabled   — GPO を無視

[domain/example.com]
ad_gpo_access_control = enforcing

# シンプルアクセス制御の代替
access_provider = simple
simple_allow_groups = linux-admins, developers