SSSD Modules for Debian Active Directory Integration

Integrating a Debian system into a Microsoft Active Directory (AD) environment using the System Security Services Daemon (SSSD) relies on specific system libraries and backend modules. SSSD acts as an intermediary, linking Debian’s native authentication and identity interfaces to the remote domain controller. This setup requires client-side modules to resolve user identities, authenticate credentials, manage Kerberos tickets, and enforce domain policies locally.

The Name Service Switch Module (libnss_sss)

The Name Service Switch (NSS) module, provided on Debian by the libnss-sss package, enables the operating system to retrieve identity information from Active Directory.

  • Functionality: It hooks into /etc/nsswitch.conf under the passwd, group, and netgroup databases.
  • Mechanism: When a process requests user or group data (such as executing id, getent passwd, or checking file ownership), libnss_sss.so directs the query through the SSSD responder to retrieve POSIX attributes generated or stored in Active Directory.

The Pluggable Authentication Module (pam_sss)

Supplied by the libpam-sss package, this module integrates SSSD with Debian's Pluggable Authentication Modules (PAM) architecture.

  • Functionality: It is configured within /etc/pam.d/common-auth, common-account, common-password, and common-session.
  • Mechanism:
    • Authentication: Validates user credentials against AD domain controllers using Kerberos.
    • Account Management: Checks account expiration, logon hours, and access controls.
    • Password Management: Enables users to change their domain passwords locally and updates them in AD.
    • Session Management: Coordinates session setup, such as automatic home directory creation via pam_mkhomedir.so.
    • Offline Caching: Permits logins using cached credentials when the domain controller is unreachable.

The SSSD Active Directory Provider (sssd-ad)

The sssd-ad backend module (packaged as sssd-ad) is the internal driver that handles communication between the SSSD daemon and Microsoft Active Directory.

  • Kerberos Integration: Coordinates with the MIT Kerberos libraries to acquire, store, and renew Kerberos Ticket Granting Tickets (TGT) upon login.
  • LDAP and Global Catalog Integration: Communicates with AD domain controllers over LDAP and the Global Catalog (port 3268) to search directory objects, cross-domain trust relationships, and nested groups.
  • DNS and Locator Services: Uses the AD service locator algorithm to query DNS SRV records, discovering optimal domain controllers and handling automatic site discovery.
  • ID Mapping: Uses built-in algorithmic mapping (idmap_subid or idmap_rid) to convert Windows SIDs (Security Identifiers) into consistent Linux UIDs and GIDs without requiring manual POSIX attribute population in the directory.

Associated SSSD Support Components

To complete the integration, Debian utilizes several secondary modules and packages:

  • sssd-common: Contains the core daemons, responders, and the local cache database (LDB) infrastructure.
  • sssd-tools: Command-line utilities used for administrative tasks, such as clearing local cache databases (sss_cache) or debugging configurations.
  • adcli or realmd: External helper packages often used alongside SSSD to provision the computer account in Active Directory and generate the initial /etc/krb5.keytab.