sssd-users

sssd-users@lists.fedorahosted.org

1846 discussions

[SSSD] Announcing SSSD 2.9.8
by Pavel Březina 21 Jan '26

21 Jan '26

# SSSD 2.9.8 The SSSD team is announcing the release of version 2.9.8 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.8 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.8.html While we plan to maintain this branch providing critical bug fixes upstream, we don't commit to regular releases off this branch going forward. We recommend switching to the latest upstream release 2.12.0. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.8 Release Notes ## Highlights ### General information * After startup SSSD already creates a Kerberos configuration snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin if the AD or IPA providers are used. This enables SSSD's localauth plugin. Starting with this release the an2ln plugin is disabled in the configuration snippet as well. If this file or its content are included in the Kerberos configuration it will fix CVE-2025-11561. ### Configuration changes * An option `ipa_enable_dns_sites`, that never worked due to missing server side implementation, was removed. * The default value of session_provider option was changed to none (i.e. disabled) no matter what id_provider used. Previously session_provider was enabled by default for id_provider = ipa case. The primary tool it was intended to support, “Fleet Commander,” has become obsolete. * The option `ipa_subid_ranges_search_base` was deprecated in favor of `ldap_subid_ranges_search_base`.

1 0

Starting SSSD without root
by Tero Saarni 20 Jan '26

20 Jan '26

Hi, I'm trying to run SSSD inside docker container without root user. The container is executed in OpenShift cluster which does not allow running as root inside container. SSSD requires root and checks for this specifically. Is there any workaround for this? I believe the limitation is implemented for security reasons, in order to have most critical parts executed as root and have it drop privileges for other parts but this now completely blocks using SSSD in the above environment. -- Tero

5 21

[SSSD] Announcing SSSD 2.12.0
by Pavel Březina 15 Jan '26

15 Jan '26

# SSSD 2.12.0 The SSSD team is announcing the release of version 2.12.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.12.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.12.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.12.0 Release Notes ## Highlights ### General information * After startup SSSD already creates a Kerberos configuration snippet typically in `/var/lib/sss/pubconf/krb5.include.d/localauth_plugin` if the AD or IPA providers are used. This enables SSSD's localauth plugin. Starting with this release the an2ln plugin is disabled in the configuration snippet as well. If this file or its content are included in the Kerberos configuration it will fix CVE-2025-11561. * Previously deprecated `--with-extended-enumeration-support` `./configure` option was removed. * SSSD now allows using machine credentials from a trusted AD domain or Kerberos realm if no suitable domain-local credentials are available. ### New features * SSSD now supports authentication mechanism selection through PAM using a JSON-based protocol. This feature enables passwordless authentication mechanisms in GUI login environments that support the protocol. Feature will be supported by GNOME Display Manager (GDM) starting with GNOME 50. While currently optimized for GNOME, the JSON protocol design allows for future support in other display managers. authselect is the recommended approach and will handle the necessary PAM stack modifications automatically starting with version 1.7 through the new option `with-switchable-auth` which provides a new PAM service called `switchable-auth`. Manual PAM configuration is also possible. For more technical details and implementation specifications, see the design documentation: https://sssd.io/design-pages/passwordless_gdm.html ### Packaging changes * This update makes it possible to not grant CAP_SETUID and CAP_SETGID to `krb5_child` binary in a situation where it is not required to store acquired TGT after user authentication. Taking into account that it is already possible to avoid using CAP_DAC_READ_SEARCH if keytab is readable by SSSD service user, and usage of 'selinux_child' isn't always required, this allows to build a setup with completely privilege-less SSSD to serve certain use cases. In particular, this might be used to build a container running SSSD on OCP with a restricted profile. * A new configure option `--with-ldb-modules-path=PATH` option to specify LDB modules path at build time. * `--with-allow-remote-domain-local-groups` `./configure` option was removed. ### Configuration changes * An option `ipa_enable_dns_sites`, that never worked due to missing server side implementation, was removed. * A new option `pam_json_services` is now available to enable JSON protocol to communicate the available authentication mechanisms. * The default value of `session_provider` option was changed to `none` (i.e. disabled) no matter what `id_provider` used. Previously `session_provider` was enabled by default for `id_provider = ipa` case. The primary tool it was intended to support, "Fleet Commander," has become obsolete. * The option `ipa_subid_ranges_search_base` was deprecated in favor of `ldap_subid_ranges_search_base`. * Support of previously deprecated `ad_allow_remote_domain_local_groups` config option was removed completely. * `ipa_dyndns_update`, `ipa_dyndns_ttl`, and `ipa_dyndns_iface` legacy options were removed. * A new option, `dyndns_address`, has been introduced to specify network addresses that are allowed or excluded from dynamic DNS updates. The `dyndns_iface` option has been extended to support the exclusion of network interfaces.

1 0

What API permissions are needed to use sssd-idp with Entra ID?
by Zhengyi Fu 05 Dec '25

05 Dec '25

I am trying to set up SSSD to authenticate against MS Entra ID but cannot get it to work. What specific API permissions do I need to give to the App to make it work?

2 2

non-posix group-based access
by dave 21 Nov '25

21 Nov '25

Hello, We are trying to test sssd for our Linux environment. We are able to join the AD domain using `realm` and, with a few tweaks, can authenticate users and find groups. (when both user/groups are POSIX-compliant) I was able to do group-based access with access_provider = simple simple_allow_groups = some_posix_ad_group_name Not all of our AD groups are POSIX-compliant; most are regular AD groups. I want to try to mimic the same group access behavior, but for non-posix groups. Meaning if a user is a member of a non-POSIX group, then allow access. Is this possible? This is how far ive gotten on my sssd.conf: [sssd] domains = mydomain.com, my_app_domain config_file_version = 2 services = nss, pam, ssh [domain/mydomain.com] ad_site = my-site-name default_shell = /bin/bash krb5_store_password_if_offline = True cache_credentials = True krb5_realm = MYDOMAIN.COM realmd_tags = manages-system joined-with-adcli id_provider = ad fallback_homedir = /home/%u ad_domain = mydomain.com use_fully_qualified_names = False ldap_id_mapping = False access_provider = ad shell_fallback = /bin/bash ldap_schema = ad ldap_search_base = OU=People,DC=mydomain,DC=com ldap_user_object_class = person ldap_user_name = SamAccountName ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber ldap_user_home_directory = unixHomeDirectory ldap_user_shell = loginShell ldap_user_gecos = displayName ad_gpo_access_control = enforcing [application/my_app_domain] domain_type = application inherit_from = mydomain.com [pam] pam_app_services = non_posix_ad_group_name Any input is much appreciated! Best, Dave

4 7

/var/lib/sss/pipe/sss - connection refused
by Prentice Bisbal 07 Nov '25

07 Nov '25

Yesterday we upgrade some of our systems to OpenSuSE 15.6. We have sssd configured to to enumate, but when I do 'getent passwd, I get only the contents of /etc/passwd, a hang for 3-5 seconds, and then the command ends w/o any of our user information from LDAP. using strace, I see getent is failing with this error: connect(3, {sa_family=AF_UNIX, sun_path="/var/lib/sss/pipes/nss"}, 110) = -1 ECONNREFUSED (Connection refused) Even with logging turned all the way up, the only message I see in the logs is this: (2025-11-04 16:51:16): [sssd] [svc_child_info] (0x0020): Child [71156] ('nss':'nss') was terminated by own WATCHDOG I know this isn't a communication issue between the client and the server. With logging turned all the way up, I see that sssd is getting all the account information from LDAP. Any ideas what is wrong here? The client system does have apparmor enabled, but I'm not as familiar with apparmor as I am with SELinux, so I don't know a reliable way to confirm/disprove that AA might be part of this problem. -- Prentice

2 5

Is it intentional to render a system unable to boot if SSSD service is broken?
by Kodiak Firesmith 16 Oct '25

16 Oct '25

Hi Folks, I've observed a few times now that if anything causes sssd.service to fail to start at boot time that at least on Ubuntu, the system will be stuck in an infinite service restart loop during boot-up, rendering it largely inoperable. I'm inclined to drop in a systemd override to allow sssd.service to fail more gracefully during boot and not prevent the OS from continuing to load, but I wanted to check in with the SSSD mindtrust about this to see if it's specifically intentional that broken sssd.service should break boot-up (again, at least on Ubuntu). Thanks!

5 5

Simple question ?
by frank rust 18 Sep '25

18 Sep '25

Hi all, I am new to this list. So if this is a common question, I apologise in advance. I have to filter the access to a system to allow several hundred users out of a ldap server with several 10 thousands of users. How would I do this? I think the way to define a simple filter line ``` ldap_user_search_filter = ( | (uid=user_1)(uid=user_2)(uid=user_7470)(...) ) ``` is not possible for the amount of users. I have no possibility to create a new group in ldap or add anything else, I only have read access. What can I do? Thanks in advance Frank

4 4

Re: Simple question ?
by Tomas Halman 15 Sep '25

15 Sep '25

On Mon, Sep 15, 2025 at 3:07 PM Rust, Frank <f.rust(a)tu-braunschweig.de> wrote: > This is a random number of users out of our University ldap. There is no > group information other than the "student" information. > I have only read access to the ldap (and password auth). > Would it be possible to get the group membership from a different server? > > Best,Frank > That can be theoretically done but outside SSSD. You can set up your own LDAP as a proxy that can combine university LDAP with another (your own or remote) and point SSSD to that proxy instance. But it looks like a lot of work for one system. If there is no information in another ldap server and it is just one system to manage I would go with some Ansible automation script that updates sssd.conf (or better configuration snippet in sssd.d). HTH Tomáš

1 0

error when trying to start SSSD
by Travis Bean 08 Sep '25

08 Sep '25

When I try to start SSSD, it fails with the following error message: SSSD couldn't load the configuration database: No domain is enabled sssd.service: Main process exited, code=exited, status=4/NOPERMISSION My sssd.conf is as follows: [sssd] domains = LDAP, files services = nss, pam, sudo, autofs, ssh config_file_version = 2 [nss] filter_groups = root filter_users = root [domain/LDAP] id_provider = ldap ldap_uri = ldapi:/// ldap_search_base = dc=example,dc=local auth_provider = krb5 krb5_server = 127.0.0.1 krb5_realm = EXAMPLE.LOCAL [domain/files] id_provider = files I tried to use the example configuration file located at /usr/share/doc/sssd-common/examples/sssd-example.conf, but I receive the same error message, so my configuration seems to be just fine. Kind regards, Travis Bean

6 15

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

sssd-users