Chapter 11. Migrating authentication from nslcd to SSSD

Procedure

1. Back up the current authentication configuration:

   # authselect apply-changes -b --backup=ldap-configuration-backup

   Copy to Clipboard Toggle word wrap

2. Install SSSD packages:

   # yum install sssd-ldap sssd-ad sssd-client \ sssd-common sssd-common-pac \ sssd-krb5 sssd-krb5-common

   Copy to Clipboard Toggle word wrap

3. Stop and disable the nslcd and nscd services:

   # systemctl stop nslcd nscd
   # systemctl disable nslcd nscd

   Copy to Clipboard Toggle word wrap

4. Configure authentication with SSSD:

   # authselect select sssd with-mkhomedir --force

   Copy to Clipboard Toggle word wrap

5. Set the necessary ownership and permissions for the SSSD configuration file:

   # chown root:root /etc/sssd/sssd.conf
   # chmod 600 /etc/sssd/sssd.conf

   Copy to Clipboard Toggle word wrap
6. Open the /etc/sssd/sssd.conf file for editing.

7. Enter the following configuration, replacing values such as example.com and dc=example,dc=com with values that are appropriate for your environment:

   [sssd]
   config_file_version = 2
   services = nss, pam
   domains = EXAMPLE.COM
   debug_level = 6
   
   [domain/EXAMPLE.COM]
   id_provider = ldap
   auth_provider = ldap
   ldap_uri = ldap://server.example.com/
   ldap_search_base = dc=example,dc=com
   ldap_default_bind_dn = CN=binddn,DC=example,DC=com
   ldap_default_authtok_type = password
   ldap_default_authtok = <bind_account_password>
   cache_credentials = True

   Copy to Clipboard Toggle word wrap
   Note

   You might need to specify the LDAP schema in your SSSD configuration:

   If you are using the RFC-2307bis schema in your directory server, add the following line to the [domain/EXAMPLE.COM] section:

   ldap_schema = rfc2307bis

   Copy to Clipboard Toggle word wrap

   If you are using a Microsoft Active Directory server, add the following line to the [domain/EXAMPLE.COM] section to enable LDAP-based authentication:

   ldap_schema = ad

   Copy to Clipboard Toggle word wrap

   If you need Kerberos authentication, Red Hat recommends joining the RHEL client to your AD domain with the realm command, which automatically configures the SSSD service.

8. Enable and start the SSSD service:

   # systemctl enable sssd
   # systemctl start sssd

   Copy to Clipboard Toggle word wrap

Verification

1. Ensure you can retrieve information about your LDAP users:

   # id ldapuser
    uid=100424(ldapuser) gid=100424(ldapuser) groups=100424(ldapuser)
   
   # getent passwd ldapuser
   ldapuser:*: 100424: 100424:User, LDAP:/home/ldapuser:/bin/bash

   Copy to Clipboard Toggle word wrap

2. Ensure you can log in as an LDAP user:

   # ssh -l ldapuser localhost
   ldapuser@localhost's password:
   Last login: Tue Dec 07 19:34:35 2021 from localhost
   -sh-4.2$

   Copy to Clipboard Toggle word wrap