Chapter 11. Migrating authentication from nslcd to SSSD

Procedure

1. Back up the current authentication configuration:

   # authselect apply-changes -b --backup=ldap-configuration-backup

2. Install SSSD packages:

   # yum install sssd-ldap sssd-ad sssd-client \ sssd-common sssd-common-pac \ sssd-krb5 sssd-krb5-common

3. Stop and disable the nslcd and nscd services:

   # systemctl stop nslcd nscd
   # systemctl disable nslcd nscd

4. Configure authentication with SSSD:

   # authselect select sssd with-mkhomedir --force

5. Set the necessary ownership and permissions for the SSSD configuration file:

   # chown root:root /etc/sssd/sssd.conf
   # chmod 600 /etc/sssd/sssd.conf

6. Open the /etc/sssd/sssd.conf file for editing.

7. Enter the following configuration, replacing values such as example.com and dc=example,dc=com with values that are appropriate for your environment:

   [sssd]
   config_file_version = 2
   services = nss, pam
   domains = EXAMPLE.COM
   debug_level = 6
   
   [domain/EXAMPLE.COM]
   id_provider = ldap
   auth_provider = ldap
   ldap_uri = ldap://server.example.com/
   ldap_search_base = dc=example,dc=com
   ldap_default_bind_dn = CN=binddn,DC=example,DC=com
   ldap_default_authtok_type = password
   ldap_default_authtok = <bind_account_password>
   cache_credentials = True

   Note

   You might need to specify the LDAP schema in your SSSD configuration:

   If you are using the RFC-2307bis schema in your directory server, add the following line to the [domain/EXAMPLE.COM] section:

   ldap_schema = rfc2307bis

   If you are using a Microsoft Active Directory server, add the following line to the [domain/EXAMPLE.COM] section to enable LDAP-based authentication:

   ldap_schema = ad

   If you need Kerberos authentication, Red Hat recommends joining the RHEL client to your AD domain with the realm command, which automatically configures the SSSD service.

8. Enable and start the SSSD service:

   # systemctl enable sssd
   # systemctl start sssd

Verification

1. Ensure you can retrieve information about your LDAP users:

   # id ldapuser
    uid=100424(ldapuser) gid=100424(ldapuser) groups=100424(ldapuser)
   
   # getent passwd ldapuser
   ldapuser:*: 100424: 100424:User, LDAP:/home/ldapuser:/bin/bash

2. Ensure you can log in as an LDAP user:

   # ssh -l ldapuser localhost
   ldapuser@localhost's password:
   Last login: Tue Dec 07 19:34:35 2021 from localhost
   -sh-4.2$