sssd-users April 2025

sssd-users@lists.fedorahosted.org

2 participants
3 discussions

Starting SSSD without root
by Tero Saarni 20 Jan '26

20 Jan '26

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 21

ldap_idmap_range for a trusted domain
by Ralf Boehm 01 May '25

01 May '25

Hello, We want to switch from winbind to sssd. We have been using winbind for many years and have a configuration that does not seem to be compatible with sssd, at least I have not been able to find one. We use several Windows Active Directory servers. When we started using winbind, there were relatively few Linux hosts. Most of our clients and servers had a Windows operating system. We decided to go with rid backends at that time. It works very well. Here are the settings from /etc/samba/smb.conf: # UID & GID Mapping with RID idmap config DOMAIN1:backend = rid idmap config DOMAIN1:range = 100000-349999 idmap config DOMAIN:base_rid = 0 idmap config DOMAIN2:backend = rid idmap config DOMAIN2:range = 350000-599999 idmap config DOMAIN2:base_rid = 0 idmap config *:backend = tdb idmap config *:range = 600000-849999 Now we would like to obtain the IDs of the users and groups in order to have a very low impact on the productive systems. We have found the appropriate setting for our primary domain (DOMAIN1). However, we have not yet found a way to implement this for our trusted domain (DOMAIN2). Here are the settings from /etc/sssd/sssd.conf: [sssd] domains = example1.com default_domain_suffix = example1.com config_file_version = 2 services = nss, pam [domain/example1.com] access_provider = ad id_provider = ad krb5_realm = EXAMPLE1.COM krb5_store_password_if_offline = True krb5_ccachedir = /tmp krb5_ccname_template = FILE:%d/.krb5cc_%U full_name_format = %1$s default_shell = /bin/bash cache_credentials = True realmd_tags = manages-system joined-with-adcli fallback_homedir = /home/DOMAIN1/%u override_homedir = /home/DOMAIN1/%u ad_domain = example1.com use_fully_qualified_names = True ldap_id_mapping = True ldap_schema = ad ldap_idmap_default_domain = example1.com ldap_idmap_range_min = 100000 ldap_idmap_range_max = 349999 I hope you have a solution for me. Regards Ralf

2 1

Auth via AD, ID via OpenLDAP (getent and id problem)
by Shannon Price 21 Apr '25

21 Apr '25

We are testing a new SSSD configuration and we're almost there. Our campus Active Directory does not populate the RFC2307 fields (also there are several different Linux enclaves on campus). Authentication is done against campus AD. We have ID mapping pointing at a different LDAP server (OpenLDAP on RHEL 8.7). Our test client is RHEL 8.6. Our current successful setup is show below. We would like to avoid anything that is too obscure or not recommended. We have not found this to be a common configuration (not many examples). It is working for us, however. . Install realm and sssd . realmjoin to our domain (actually I used adcli to avoid DynamicDNS failures) . Configured [sssd.conf]: [sssd] domains = university.edu config_file_version = 2 services = nss, pam debug_level = 8 [domain/university.edu] ad_domain = university.edu dyndns_update = false krb5_realm = UNIVERSITY.EDU realmd_tags = manages-system joined-with-adcli cache_credentials = True auth_provider = ad id_provider = ldap ldap_uri = ldap://ldaptest.university.edu ldap_default_bind_dn = cn=readonly,ou=system,dc=university,dc=edu ldap_default_authtok = read_only_password krb5_store_password_if_offline = True default_shell = /bin/bash use_fully_qualified_names = True [nsswitch.conf] passwd: sss files systemd group: sss files systemd (I've tried without "systemd" as well) (We had initial problems configuring TLS, so we will address that next) PROBLEM: SSSD is correctly authenticating and pulling information from LDAP correctly. My UID and group memberships are correct. SSSD knows all of the groups and memberships. The "id" command only shows my default group. The "getent group othergroup(a)university.edu" command gives an error: error writing group entry: Invalid argument Is there any fix for these? I found an older reference to "sss_showgroup", but that utility doesn't seem to be included in sss-utils anymore. We are running sssd 2.9.4.

1 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users April 2025