Chapter 7. Configuring SSSD
7.1. Introduction to SSSD
7.1.1. How SSSD Works
The System Security Services Daemon (SSSD) is a system service to access remote directories and authentication mechanisms. It connects a local system (an SSSD client) to an external back-end system (a provider). This provides the SSSD client with access to identity and authentication remote services using an SSSD provider. For example, these remote services include: an LDAP directory, an Identity Management (IdM) or Active Directory (AD) domain, or a Kerberos realm.
For this purpose, SSSD:
- Connects the client to an identity store to retrieve authentication information.
- Uses the obtained authentication information to create a local cache of users and credentials on the client.
Users on the local system are then able to authenticate using the user accounts stored in the external back-end system.
SSSD does not create user accounts on the local system. Instead, it uses the identities from the external data store and lets the users access the local system.
Figure 7.1. How SSSD works
SSSD can also provide caches for several system services, such as Name Service Switch (NSS) or Pluggable Authentication Modules (PAM).
7.1.2. Benefits of Using SSSD
- Reduced load on identity and authentication servers
- When requesting information, SSSD clients contact SSSD, which checks its cache. SSSD contacts the servers only if the information is not available in the cache.
- Offline authentication
- SSSD optionally keeps a cache of user identities and credentials retrieved from remote services. In this setup, users can successfully authenticate to resources even if the remote server or the SSSD client are offline.
- A single user account: improved consistency of the authentication process
- With SSSD, it is not necessary to maintain both a central account and a local user account for offline authentication.Remote users often have multiple user accounts. For example, to connect to a virtual private network (VPN), remote users have one account for the local system and another account for the VPN system.Thanks to caching and offline authentication, remote users can connect to network resources simply by authenticating to their local machine. SSSD then maintains their network credentials.
