Chapter 11. Migrating authentication from nslcd to SSSD

Procedure

1. Back up the current authentication configuration:

   Copy to Clipboard Toggle word wrap

   # authselect apply-changes -b --backup=ldap-configuration-backup

2. Install SSSD packages:

   Copy to Clipboard Toggle word wrap

   # yum install sssd-ldap sssd-ad sssd-client \ sssd-common sssd-common-pac \ sssd-krb5 sssd-krb5-common

3. Stop and disable the nslcd and nscd services:

   Copy to Clipboard Toggle word wrap

   # systemctl stop nslcd nscd
   # systemctl disable nslcd nscd

4. Configure authentication with SSSD:

   Copy to Clipboard Toggle word wrap

   # authselect select sssd with-mkhomedir --force

5. Set the necessary ownership and permissions for the SSSD configuration file:

   Copy to Clipboard Toggle word wrap

   # chown root:root /etc/sssd/sssd.conf
   # chmod 600 /etc/sssd/sssd.conf

6. Open the /etc/sssd/sssd.conf file for editing.

7. Enter the following configuration, replacing values such as example.com and dc=example,dc=com with values that are appropriate for your environment:

   Copy to Clipboard Toggle word wrap

   [sssd]
   config_file_version = 2
   services = nss, pam
   domains = EXAMPLE.COM
   debug_level = 6
   
   [domain/EXAMPLE.COM]
   id_provider = ldap
   auth_provider = ldap
   ldap_uri = ldap://server.example.com/
   ldap_search_base = dc=example,dc=com
   ldap_default_bind_dn = CN=binddn,DC=example,DC=com
   ldap_default_authtok_type = password
   ldap_default_authtok = <bind_account_password>
   cache_credentials = True

   Note

   You might need to specify the LDAP schema in your SSSD configuration:

   If you are using the RFC-2307bis schema in your directory server, add the following line to the [domain/EXAMPLE.COM] section:

   Copy to Clipboard Toggle word wrap

   ldap_schema = rfc2307bis

   If you are using a Microsoft Active Directory server, add the following line to the [domain/EXAMPLE.COM] section to enable LDAP-based authentication:

   Copy to Clipboard Toggle word wrap

   ldap_schema = ad

   If you need Kerberos authentication, Red Hat recommends joining the RHEL client to your AD domain with the realm command, which automatically configures the SSSD service.

8. Enable and start the SSSD service:

   Copy to Clipboard Toggle word wrap

   # systemctl enable sssd
   # systemctl start sssd

Verification

1. Ensure you can retrieve information about your LDAP users:

   Copy to Clipboard Toggle word wrap

   # id ldapuser
    uid=100424(ldapuser) gid=100424(ldapuser) groups=100424(ldapuser)
   
   # getent passwd ldapuser
   ldapuser:*: 100424: 100424:User, LDAP:/home/ldapuser:/bin/bash

2. Ensure you can log in as an LDAP user:

   Copy to Clipboard Toggle word wrap

   # ssh -l ldapuser localhost
   ldapuser@localhost's password:
   Last login: Tue Dec 07 19:34:35 2021 from localhost
   -sh-4.2$