System Security Services Daemon (SSSD) is a daemon that provides identity, authentication, and authorization services to the operating system and applications. It provides modules and/or plugins for multiple subsystems of the operating system, including NSS, PAM, or sudo. It can cache multiple types of information to speed-up subsequent lookup or authentication operations, and it can use various remote backend types, including IPA, Active Directory, or LDAP.

SSSD can be configured by editing /etc/sssd/sssd.conf directly but due to overlap to other subsystems, those subsystems typically need to be configured as well to make use of SSSD, like pam_sss.so for PAM, or /etc/krb5.* for Kerberos operations. For two use cases, setups against IPA and Active Directory, setup tools can be used to configure SSSD and other components of the operating system in automated fashion. For IPA it's ipa-client-install, or realm which can also configure the system for remote Active Directory backend.

Configuring operating system and SSSD to use identity, authentication, and authorization services of IPA is called IPA-enrollment. While running the setup tools, credentials typically need to be passed to ipa-client-install or realm commands to authenticate the operation on the remote system, as well as other options that specify to which remote system we are IPA-enrolling the machine, or which components should be configured.

The typical approach could include pre-creating the host record on the IPA server and generating one-time password for it:

ipa$ ipa host-add --random host.example.com
[...]
  Random password: 3dW742a5rYTX

host# ipa-client-install -w 3dW742a5rYTX
[...]
Client configuration complete.

However, on Fedora Atomic Host, the command is not available

atomic# ipa-client-install
bash: ipa-client-install: command not found

What we however have on Fedora Atomic Host is command atomic which can download, configure, and run containers. SSSD container is available and can be used to IPA-enroll (or join to Active Directory) the Atomic Host in a very similar way you would do it on non-Atomic machine.

As root on the Atomic host, we can check that the SSSD container is running

atomic# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
9088c7d529c6        fedora/sssd         "/bin/run.sh"       27 minutes ago      Up 26 minutes                           sssd

atomic# docker exec 9088c7d529c6 ps axuwwf
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root        29  0.0  0.2  47960  3500 ?        Rs   08:58   0:00 ps axuwwf
root         1  0.0  0.1  11744  2596 ?        Ss   08:31   0:00 /bin/bash /bin/run.sh
root         7  0.0  0.0   4356   728 ?        S    08:31   0:00 tail -f /var/log/sssd/systemctl.log
root        12  0.0  0.4 155032  6352 ?        Ss   08:31   0:00 /usr/sbin/sssd -D -f
root        13  0.0  0.9 248556 14244 ?        S    08:31   0:00  \_ /usr/libexec/sssd/sssd_be --domain example.com --uid 0 --gid 0 --debug-to-files
root        14  0.0  2.1 161108 31448 ?        S    08:31   0:00  \_ /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --debug-to-files
root        15  0.0  0.3 133860  5568 ?        S    08:31   0:00  \_ /usr/libexec/sssd/sssd_sudo --uid 0 --gid 0 --debug-to-files
root        16  0.0  0.4 138624  6888 ?        S    08:31   0:00  \_ /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --debug-to-files
root        17  0.0  0.3 133852  5480 ?        S    08:31   0:00  \_ /usr/libexec/sssd/sssd_ssh --uid 0 --gid 0 --debug-to-files
root        18  0.0  0.4 159184  6840 ?        S    08:31   0:00  \_ /usr/libexec/sssd/sssd_pac --uid 0 --gid 0 --debug-to-files
root        28  0.0  0.0   4316   632 ?        S    08:47   0:00 sleep 1000

From different machine (or the IPA server), we can test that GSS-API (Kerberos) authentication to the Fedora Atomic Host now works and that the user gets authenticated and the Atomic host knows user's identity:

other-host$ kinit bob
Password for bob@EXAMPLE.COM: 
other-host$ ssh bob@atomic.example.com
Could not chdir to home directory /home/bob: No such file or directory
atomic$ id
uid=1215800001(bob) gid=1215800001(bob) groups=1215800001(bob) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
atomic$ hostname
atomic.example.com

The PAM stack gets configured to use SSSD as well so for example when you disable the allow_all host-based access control (HBAC) rule in IPA, you can use custom rules to for example allow ssh access to the Fedora Atomic Host to members of admin user group.

Starting with Fedora Atomic 23.53, the sss_sudo is included which makes it possible to manage access to sudo for IPA-managed users in IPA server.

The SSSD container also supports uninstalling / leaving the external identity provider, either via ipa-client-install --uninstall or using realm leave.

For IPA-enrolled machine, use

atomic# atomic uninstall fedora/sssd

atomic# atomic uninstall fedora/sssd realm leave

To disable the sssd.service on the host from attempting to start the container when it was unconfigured and possibly removed, use

atomic# atomic uninstall fedora/sssd
atomic# rm /etc/systemd/system/sssd.service
atomic# systemctl daemon-reload

In the examples above, we assume that the machines can find the IPA server because they are configured with correct DNS settings.

If you are trying the examples in testing setup, you can use

host# echo nameserver IP-address-of-IPA-server > /etc/resolv.conf

host# hostname host.example.com