error when trying to start SSSD

[Travis Bean]

When I try to start SSSD, it fails with the following error message:

SSSD couldn't load the configuration database: No domain is enabled
sssd.service: Main process exited, code=exited, status=4/NOPERMISSION

My sssd.conf is as follows:

[sssd]
domains = LDAP, files
services = nss, pam, sudo, autofs, ssh
config_file_version = 2

[nss]
filter_groups = root
filter_users = root

[domain/LDAP]
id_provider = ldap
ldap_uri = ldapi:///
ldap_search_base = dc=example,dc=local

auth_provider = krb5
krb5_server = 127.0.0.1
krb5_realm = EXAMPLE.LOCAL

[domain/files]
id_provider = files

I tried to use the example configuration file located at
/usr/share/doc/sssd-common/examples/sssd-example.conf, but I receive
the same error message, so my configuration seems to be just fine.

Kind regards,

Travis Bean

[Sangster, Mark]

I would suggest looking at permissions rather than configuration.

What are the permissions to the configuration directory?

What are the permissions to the /var/lib/sss directory?

Cheers
Mark

-----Original Message-----
From: Travis Bean via sssd-users 
Sent: 27 August 2025 02:03
To: [e-mail]
Cc: Travis Bean 
Subject: [SSSD-users]error when trying to start SSSD

CAUTION: External email. Ensure this message is from a trusted source and exercise caution before clicking links/opening attachments.

When I try to start SSSD, it fails with the following error message:

SSSD couldn't load the configuration database: No domain is enabled
sssd.service: Main process exited, code=exited, status=4/NOPERMISSION

My sssd.conf is as follows:

[sssd]
domains = LDAP, files
services = nss, pam, sudo, autofs, ssh
config_file_version = 2

[nss]
filter_groups = root
filter_users = root

[domain/LDAP]
id_provider = ldap
ldap_uri = ldapi:///
ldap_search_base = dc=example,dc=local

auth_provider = krb5
krb5_server = 127.0.0.1
krb5_realm = EXAMPLE.LOCAL

[domain/files]
id_provider = files

I tried to use the example configuration file located at
/usr/share/doc/sssd-common/examples/sssd-example.conf, but I receive
the same error message, so my configuration seems to be just fine.

Kind regards,

Travis Bean
--
_______________________________________________
sssd-users mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/[e-mail].o...
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

The University of Aberdeen is a charity registered in Scotland, No SC013683.
Tha Oilthigh Obar Dheathain na charthannas clàraichte ann an Alba, Àir. SC013683.

[Travis Bean]

On Wed, Aug 27, 2025 at 12:07 AM Sangster, Mark via sssd-users
 wrote:
> I would suggest looking at permissions rather than configuration.
>
> What are the permissions to the configuration directory?

The permissions are chown root:root and chmod 0755. Setting this to
chown -R sssd:sssd makes no difference.
> What are the permissions to the /var/lib/sss directory?

The permissions are the same as /etc/sssd/conf.d.

By the way, I am running Ubuntu Server 24.04.

[Alejandro Lopez]

Try stopping the sssd systemd service and launching sssd manually with
debug level 9 and in non-daemon mode:

/usr/sbin/sssd -d 9 -i

and check for any related error in the debug output.

On Thu, Aug 28, 2025 at 5:24 AM Travis Bean via sssd-users <
[e-mail]> wrote:
> On Wed, Aug 27, 2025 at 12:07 AM Sangster, Mark via sssd-users
>  wrote:
> > I would suggest looking at permissions rather than configuration.
> >
> > What are the permissions to the configuration directory?
>
> The permissions are chown root:root and chmod 0755. Setting this to
> chown -R sssd:sssd makes no difference.
> > What are the permissions to the /var/lib/sss directory?
>
> The permissions are the same as /etc/sssd/conf.d.
> By the way, I am running Ubuntu Server 24.04.
>
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue

[Travis Bean]

On Thu, Aug 28, 2025 at 12:30 AM Alejandro Lopez  wrote:
> Try stopping the sssd systemd service and launching sssd manually with debug level 9 and in non-daemon mode:
>
> /usr/sbin/sssd -d 9 -i

sudo /usr/sbin/sssd -d 9 -i
[sssd] [check_file] (0x0400): lstat for [/run/sssd.pid] failed: [2][No
such file or directory].
[sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed:
[2][No such file or directory].
[sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse!
[sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
[sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
does not exist.
[sssd] [sss_ini_add_snippets] (0x0020): Config merge error: File
/etc/sssd/conf.d/sssd.conf did not pass access check. Skipping.
[sssd] [confdb_ldif_from_ini_file] (0x0100): Value of
config_file_version option not found. Assumed to be version 2.
[sssd] [sss_confdb_create_ldif] (0x0400): Processing config section [sssd]
[sssd] [sss_confdb_create_ldif] (0x4000): Section dn
dn: cn=sssd,cn=config
cn: sssd

[sssd] [confdb_init_db] (0x0100): LDIF file to import:
dn: cn=config
version: 2

dn: cn=sssd,cn=config
cn: sssd

[sssd] [add_implicit_services] (0x0040): No domains configured!
[sssd] [get_monitor_config] (0x0040): Failed to add implicit
configured services. Some functionality might be missing
[sssd] [confdb_ensure_files_domain] (0x0100): The implicit files
domain is disabled
[sssd] [confdb_expand_app_domains] (0x0010): No domains configured, fatal error!
[sssd] [get_monitor_config] (0x0010): Failed to expand application domains
[sssd] [confdb_get_domains] (0x0020): No domains configured, fatal error!
[sssd] [get_monitor_config] (0x0010): No domains configured.
[sssd] [main] (0x0010): SSSD couldn't load the configuration database
[1432158246]: No domain is enabled

[Alejandro Lopez]

[sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
[sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
does not exist.

This confirms that it was not possible to open the configuration file.

Look for a permissions problem, including selinux.

BTW, in another message you said your file's permissions are 0755. In SSSD
permissions are usually 0640 for the configuration files and 0750 for the
configuration directories.

HTH,

On Sun, Aug 31, 2025 at 3:07 AM Travis Bean  wrote:
> On Thu, Aug 28, 2025 at 12:30 AM Alejandro Lopez 
> wrote:
> > Try stopping the sssd systemd service and launching sssd manually with
>
> debug level 9 and in non-daemon mode:
> > /usr/sbin/sssd -d 9 -i
>
> sudo /usr/sbin/sssd -d 9 -i
> [sssd] [check_file] (0x0400): lstat for [/run/sssd.pid] failed: [2][No
> such file or directory].
> [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed:
> [2][No such file or directory].
> [sssd] [ldb] (0x0400): server_sort:Unable to register control with rootdse!
> [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
> [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
> does not exist.
> [sssd] [sss_ini_add_snippets] (0x0020): Config merge error: File
> /etc/sssd/conf.d/sssd.conf did not pass access check. Skipping.
> [sssd] [confdb_ldif_from_ini_file] (0x0100): Value of
> config_file_version option not found. Assumed to be version 2.
> [sssd] [sss_confdb_create_ldif] (0x0400): Processing config section [sssd]
> [sssd] [sss_confdb_create_ldif] (0x4000): Section dn
> dn: cn=sssd,cn=config
> cn: sssd
>
> [sssd] [confdb_init_db] (0x0100): LDIF file to import:
> dn: cn=config
> version: 2
>
> dn: cn=sssd,cn=config
> cn: sssd
>
> [sssd] [add_implicit_services] (0x0040): No domains configured!
> [sssd] [get_monitor_config] (0x0040): Failed to add implicit
> configured services. Some functionality might be missing
> [sssd] [confdb_ensure_files_domain] (0x0100): The implicit files
> domain is disabled
> [sssd] [confdb_expand_app_domains] (0x0010): No domains configured, fatal
> error!
> [sssd] [get_monitor_config] (0x0010): Failed to expand application domains
> [sssd] [confdb_get_domains] (0x0020): No domains configured, fatal error!
> [sssd] [get_monitor_config] (0x0010): No domains configured.
> [sssd] [main] (0x0010): SSSD couldn't load the configuration database
> [1432158246]: No domain is enabled

[Alexey Tikhonov]

On Mon, Sep 1, 2025 at 10:16 AM Alejandro Lopez via sssd-users <
[e-mail]> wrote:
> [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
> [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
> does not exist.
>
> This confirms that it was not possible to open the configuration file.
>
> Look for a permissions problem, including selinux.
>
> BTW, in another message you said your file's permissions are 0755. In SSSD
> permissions are usually 0640 for the configuration files and 0750 for the
> configuration directories.

What is the SSSD version?
Config file ownership and access mode is different for sssd-2.9 and
sssd-2.10+
> HTH,
>
> On Sun, Aug 31, 2025 at 3:07 AM Travis Bean  wrote:
> > On Thu, Aug 28, 2025 at 12:30 AM Alejandro Lopez 
> > wrote:
> > > Try stopping the sssd systemd service and launching sssd manually with
> >
> > debug level 9 and in non-daemon mode:
> > > /usr/sbin/sssd -d 9 -i
> >
> > sudo /usr/sbin/sssd -d 9 -i
> > [sssd] [check_file] (0x0400): lstat for [/run/sssd.pid] failed: [2][No
> > such file or directory].
> > [sssd] [check_file] (0x0400): lstat for [/var/run/nscd/socket] failed:
> > [2][No such file or directory].
> > [sssd] [ldb] (0x0400): server_sort:Unable to register control with
> > rootdse!
> > [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
> > [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
> > does not exist.
> > [sssd] [sss_ini_add_snippets] (0x0020): Config merge error: File
> > /etc/sssd/conf.d/sssd.conf did not pass access check. Skipping.
> > [sssd] [confdb_ldif_from_ini_file] (0x0100): Value of
> > config_file_version option not found. Assumed to be version 2.
> > [sssd] [sss_confdb_create_ldif] (0x0400): Processing config section [sssd]
> > [sssd] [sss_confdb_create_ldif] (0x4000): Section dn
> > dn: cn=sssd,cn=config
> > cn: sssd
> >
> > [sssd] [confdb_init_db] (0x0100): LDIF file to import:
> > dn: cn=config
> > version: 2
> >
> > dn: cn=sssd,cn=config
> > cn: sssd
> >
> > [sssd] [add_implicit_services] (0x0040): No domains configured!
> > [sssd] [get_monitor_config] (0x0040): Failed to add implicit
> > configured services. Some functionality might be missing
> > [sssd] [confdb_ensure_files_domain] (0x0100): The implicit files
> > domain is disabled
> > [sssd] [confdb_expand_app_domains] (0x0010): No domains configured, fatal
> > error!
> > [sssd] [get_monitor_config] (0x0010): Failed to expand application domains
> > [sssd] [confdb_get_domains] (0x0020): No domains configured, fatal error!
> > [sssd] [get_monitor_config] (0x0010): No domains configured.
> > [sssd] [main] (0x0010): SSSD couldn't load the configuration database
> > [1432158246]: No domain is enabled
>
> --
> Alejandro
> --
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue

[Alexander Bokovoy]

On Пан, 01 вер 2025, Alexey Tikhonov via sssd-users wrote:
> On Mon, Sep 1, 2025 at 10:16 AM Alejandro Lopez via sssd-users <
> [e-mail]> wrote:
> > [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
> > [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
> > does not exist.
> >
> > This confirms that it was not possible to open the configuration file.
> >
> > Look for a permissions problem, including selinux.
> >
> > BTW, in another message you said your file's permissions are 0755. In SSSD
> > permissions are usually 0640 for the configuration files and 0750 for the
> > configuration directories.
>
> What is the SSSD version?
> Config file ownership and access mode is different for sssd-2.9 and
> sssd-2.10+

And all we need is at least one configuration file with the correct
permissions. The logs say
----------------------------------------
   [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf does not exist.
   [sssd] [sss_ini_add_snippets] (0x0020): Config merge error: File /etc/sssd/conf.d/sssd.conf did not pass access check. Skipping.
----------------------------------------

So it means permissions of /etc/sssd/conf.d/sssd.conf are wrong.

Sadly, there is no logged message that tells what is expected. Can this
be added?

[James Ralston]

On Mon, Sep 1, 2025 at 4:51 AM Alexander Bokovoy via sssd-users
 wrote:
> And all we need is at least one configuration file with the correct
> permissions. The logs say
>
> [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf does not exist.
>    [sssd] [sss_ini_add_snippets] (0x0020): Config merge error: File /etc/sssd/conf.d/sssd.conf did not pass access check. Skipping.
>
> So it means permissions of /etc/sssd/conf.d/sssd.conf are wrong.
>
> Sadly, there is no logged message that tells what is expected. Can
> this be added?

The man page does actually say what is expected, although somewhat
obliquely.  According to sssd.conf(5):
> sssd.conf must be a regular file that is accessible only by the user
> used to run SSSD service or root.

In practice, this means:

(root, root, 0600)
or
(root, sssd, 0640)

The distro’s packaging of sssd will give you a strong hint.  E.g.:

$ rpm -qlv $(rpm -qf /etc/sssd/sssd.conf) | grep /etc/sssd
drwxr-x---    2 root     sssd                        0 Jun  4 20:00 /etc/sssd
drwxr-x---    2 root     sssd                        0 Jun  4 20:00
/etc/sssd/conf.d
drwxr-x---    2 root     sssd                        0 Jun  4 20:00
/etc/sssd/pki
-rw-r-----    1 root     sssd                        0 Jun  4 20:00
/etc/sssd/sssd.conf

So, on this system, /etc/sssd/sssd.conf and /etc/sssd/conf.d/*.conf
should be user root, group sssd, mode 0640.

[Travis Bean]

On Mon, Sep 1, 2025 at 1:16 AM Alejandro Lopez  wrote:
> [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
> [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
> does not exist.
>
> This confirms that it was not possible to open the configuration file.

I moved sssd.conf from /etc/sssd/conf.d to /etc/sssd and set the
permissions to chmod 0600, and now it starts. Take a look at this:
https://www.seimaxim.com/linux/sssd-fails-to-start-with-error-file-ownership...

Thanks for all your help.

[Alexey Tikhonov]

On Tue, Sep 2, 2025 at 6:26 PM Travis Bean via sssd-users <
[e-mail]> wrote:
> On Mon, Sep 1, 2025 at 1:16 AM Alejandro Lopez  wrote:
> > [sssd] [sss_ini_open] (0x0400): No /etc/sssd/sssd.conf.
> > [sssd] [sss_ini_read_sssd_conf] (0x0100): File /etc/sssd/sssd.conf
> > does not exist.
> >
> > This confirms that it was not possible to open the configuration file.
>
> I moved sssd.conf from /etc/sssd/conf.d to /etc/sssd and set the
> permissions to chmod 0600, and now it starts. Take a look at this:
>
> https://www.seimaxim.com/linux/sssd-fails-to-start-with-error-file-ownership...

One doesn't need to set "debug_level = 9" to see "Permission check on
config file failed." - it will be visible on the default log level.

Moreover, as I wrote, ownership and access mode requirements are different
for sssd-2.9- and sssd-2.10+
What you wrote seems to apply to sssd-2.9 - LTM branch.
For sssd-2.10 recommended mode is 640 and ownership 'root:sssd'

[Travis Bean]

On Wed, Sep 3, 2025 at 12:25 AM Alexey Tikhonov  wrote:
> On Tue, Sep 2, 2025 at 6:26 PM Travis Bean via sssd-users  wrote:
> > I moved sssd.conf from /etc/sssd/conf.d to /etc/sssd and set the
> > permissions to chmod 0600, and now it starts. Take a look at this:
> > https://www.seimaxim.com/linux/sssd-fails-to-start-with-error-file-ownership...
>
> Moreover, as I wrote, ownership and access mode requirements are different for sssd-2.9- and sssd-2.10+
> What you wrote seems to apply to sssd-2.9 - LTM branch.
> For sssd-2.10 recommended mode is 640 and ownership 'root:sssd'

It would be a good idea for this information about file ownership and
permission requirements to be included in documentation located at
/usr/share/doc/sssd-common/README. sssd.conf is not installed by
default to /etc/sssd. There is an example configuration file located
at /usr/share/doc/sssd-common/examples/sssd-example.conf, but it has
permissions of 0644 and is owned by root:root.

When troubleshooting the error message "File ownership and permissions
check failed" that was displayed when I debugged SSSD, I googled the
error message, and there are two web pages that provide a resolution.
The first web page is https://access.redhat.com/solutions/6814561, but
when I tried to log in with my Red Hat developer account, it said, "An
active Red Hat subscription is required to participate." The second
web page is the link I provided in my last email. This must be a
common problem that needs to be addressed.

By the way, I am running SSSD version 2.8.2-4.

Kind regards,

Travis Bean

[James Ralston]

On Fri, Sep 5, 2025 at 12:24  PM Travis Bean via sssd-users
 wrote:
> It would be a good idea for this information about file ownership
> and permission requirements to be included in documentation located
> at /usr/share/doc/sssd-common/README.

It is already included in the documentation.  As I mentioned in my
previous message, sssd.conf(5) states:

sssd.conf must be a regular file that is accessible only by the
    user used to run SSSD service or root.

And:

The snippet files require the same owner and permissions as
    sssd.conf.

These requirements are not buried randomly in the man page; they are
at the very beginning (at the end of the *File Format* and
*Configuration Snippets From Include Directory* sections,
respectively).
> sssd.conf is not installed by default to /etc/sssd.

That is distribution-dependent.  On Red Hat Enterprise Linux, the
/etc/sssd/sssd.conf file is included in the package with
%ghost/%missingok directives, which means that the package manager
(rpm) knows about the file even though it isn’t present:

$ rpm -qlv $(rpm -qf /etc/sssd/sssd.conf) | grep /etc/sssd
drwxr-x---  2 root sssd  0 Jun  4 20:00 /etc/sssd
drwxr-x---  2 root sssd  0 Jun  4 20:00 /etc/sssd/conf.d
drwxr-x---  2 root sssd  0 Jun  4 20:00 /etc/sssd/pki
-rw-r-----  1 root sssd  0 Jun  4 20:00 /etc/sssd/sssd.conf

This means that the rpm package manager will tell you if any of the
owner/group/mode disagree with the packaging:

$ [ -f /etc/sssd/sssd.conf ] || echo not found
not found

$ rpm --verify sssd-common && echo no errors
no errors

$ install -o root -g root -m 0644 /dev/null /etc/sssd/sssd.conf
$ ls -lsa /etc/sssd/sssd.conf
0 -rw-r--r--. 1 root root 0 Sep  5 14:58 /etc/sssd/sssd.conf

$ rpm --verify sssd-common && echo no errors
.M....G..  c /etc/sssd/sssd.conf

$ chgrp sssd /etc/sssd/sssd.conf
$ rpm --verify sssd-common && echo no errors
.M.......  c /etc/sssd/sssd.conf

$ chmod 0640 /etc/sssd/sssd.conf
$ rpm --verify sssd-common && echo no errors
no errors

$ ls -lsa /etc/sssd/sssd.conf
0 -rw-r-----. 1 root sssd 0 Sep  5 14:53 /etc/sssd/sssd.conf
> There is an example configuration file located at
> /usr/share/doc/sssd-common/examples/sssd-example.conf, but it has
> permissions of 0644 and is owned by root:root.

That is the correct owner/group/mode for documentation files.  That
does not imply the actual configuration file should have the same
owner/group/mode.  Again, the man page tells you the exact
owner/group/mode requirements.
> When troubleshooting the error message "File ownership and
> permissions check failed" that was displayed when I debugged SSSD, I
> googled the error message, and there are two web pages that provide
> a resolution.  The first web page is
> https://access.redhat.com/solutions/6814561, but when I tried to log
> in with my Red Hat developer account, it said, "An active Red Hat
> subscription is required to participate."  The second web page is
> the link I provided in my last email. This must be a common problem
> that needs to be addressed.

If you believe the explanation in the man page could be worded more
helpfully, feel free to suggest an improved wording.  (In my
experience, the sssd authors are quite responsive, and will happily
accept documentation updates.)

[Travis Bean]

On Fri, Sep 5, 2025 at 12:13 PM James Ralston  wrote:
> On Fri, Sep 5, 2025 at 12:24  PM Travis Bean via sssd-users
>  wrote:
> > It would be a good idea for this information about file ownership
> > and permission requirements to be included in documentation located
> > at /usr/share/doc/sssd-common/README.
>
> It is already included in the documentation.

There are different sssd.conf(5) man pages that describe ownership and
permissions in different ways. In the Arch Linux sssd.conf(5) man page
(https://man.archlinux.org/man/sssd.conf.5.en) as well as Mankier's
sssd.conf(5) man page (https://www.mankier.com/5/sssd.conf) it
mentions, "sssd.conf must be a regular file that is accessible only by
the user used to run SSSD service or root." It is easy to misinterpret
this to mean that sssd.conf is accessible only by root, which says
something about ownership, but is not clear on permissions. In the
Ubuntu sssd.conf(5) man page
(https://manpages.ubuntu.com/manpages/noble/man5/sssd.conf.5.html) and
die.net sssd.conf(5) man page (https://linux.die.net/man/5/sssd.conf),
it mentions, "sssd.conf must be a regular file, owned by root and only
root may read from or write to the file." This gives a more concise,
clearer description of ownership and permissions.

Since the ownership and permissions for sssd.conf change to root:sssd
and 0640, respectively, for version 2.10, it would be a good idea to
include this in a README file unless an example sssd.conf is installed
by default to /etc/sssd, which would be the most logical choice.

[James Ralston]

On Sun, Sep 7, 2025 at 10:13 PM Travis Bean via sssd-users
 wrote:
> There are different sssd.conf(5) man pages that describe ownership and
> permissions in different ways.

This is because the wording in the man page was updated when the
ability to run sssd as a non-root user was added.
> In the Arch Linux sssd.conf(5) man page
> (https://man.archlinux.org/man/sssd.conf.5.en) as well as Mankier's
> sssd.conf(5) man page (https://www.mankier.com/5/sssd.conf) it
> mentions, "sssd.conf must be a regular file that is accessible only
> by the user used to run SSSD service or root."

That is the wording as of version 2.11, via commit 8472777 [1]:

commit 8472777ec472607ea450ddb4c4666017bd0de704
    Author: Alexey Tikhonov 
    Date:   Wed Oct 23 20:59:32 2024 +0200

INI: relax config files checks

Only make sure:
         - user is root or sssd
         - group is root or sssd
         - other can't access it

Don't make any assumptions wrt user/group read/write-ability.
> It is easy to misinterpret this to mean that sssd.conf is accessible
> only by root, which says something about ownership, but is not clear
> on permissions.

If you believe the wording is unclear, suggest better wording.  E.g.:

The /etc/sssd/sssd.conf file, and all /etc/sssd/conf.d/*.conf
    files, must have an owner of root or the sssd user, a group-owner
    of the root or sssd user, and must be accessible only to the root
    or sssd user.  (Owner root, group sssd, mode 0640 is recommended.)

Better yet, submit a merge request with your preferred wording.
> In the Ubuntu sssd.conf(5) man page
> (https://manpages.ubuntu.com/manpages/noble/man5/sssd.conf.5.html)
> and die.net sssd.conf(5) man page
> (https://linux.die.net/man/5/sssd.conf), it mentions, "sssd.conf
> must be a regular file, owned by root and only root may read from or
> write to the file." This gives a more concise, clearer description
> of ownership and permissions.

That was the wording as of version 2.10, via commit 91d32fe [2]:

commit 91d32fee16e37e46b7fc43d66f579ba088c45af3
    Author: Alexey Tikhonov 
    Date:   Tue Jul 18 17:10:23 2023 +0200

SPEC: make ownership of sssd.conf consistent with config folders.

:packaging: sssd.conf should be owned by user specified
        with '--with-sssd-user=' at build time. If SSSD runs under
        'root' then 'root' ownership of this file will be also
        allowed in runtime.
> Since the ownership and permissions for sssd.conf change to root:sssd
> and 0640, respectively, for version 2.10, it would be a good idea to
> include this in a README file

The man page is the correct location for this information.

Again: if you think the existing wording is unclear, suggest wording
that you think is more clear.

If the sssd project already contributed a README file, then perhaps it
would be reasonable to note in the README file that the
owner/group/mode requirements of the configuration files have changed
in version 2.11.  But it doesn’t, and it doesn’t make sense to add a
README file just to rephrase the information that is already in the
man page.
> unless an example sssd.conf is installed by default to /etc/sssd,
> which would be the most logical choice.

I suspect the reason why many distributions don’t install
/etc/sssd/sssd.conf by default is because /etc/sssd/conf.d/*.conf is
preferred (as is the general trend towards drop-in configuration file
directories), and they believe shipping a default /etc/sssd/sssd.conf
file would cause sysadmins to just edit it (instead of using a drop-in
file in the /etc/sssd/conf.d directory).

[1] https://github.com/SSSD/sssd/commit/8472777ec472607ea450ddb4c4666017bd0de704
[2] https://github.com/SSSD/sssd/commit/91d32fee16e37e46b7fc43d66f579ba088c45af3

[Alejandro Lopez]

As a side note, please be aware that the file provider was deprecated in
SSSD 2.9.0. If you are installing SSSD for the first time, I would suggest
setting *files* in nsswitch rather than configuring a domain in SSSD, or
reading this document https://sssd.io/docs/files-provider-deprecation.html
if you really need the files provider (when using smartcards or session
recording).

Cheers,

On Wed, Aug 27, 2025 at 3:03 AM Travis Bean via sssd-users <
[e-mail]> wrote:
> When I try to start SSSD, it fails with the following error message:
>
> SSSD couldn't load the configuration database: No domain is enabled
> sssd.service: Main process exited, code=exited, status=4/NOPERMISSION
>
> My sssd.conf is as follows:
>
> [sssd]
> domains = LDAP, files
> services = nss, pam, sudo, autofs, ssh
> config_file_version = 2
>
> [nss]
> filter_groups = root
> filter_users = root
>
> [domain/LDAP]
> id_provider = ldap
> ldap_uri = ldapi:///
> ldap_search_base = dc=example,dc=local
>
> auth_provider = krb5
> krb5_server = 127.0.0.1
> krb5_realm = EXAMPLE.LOCAL
>
> [domain/files]
> id_provider = files
>
> I tried to use the example configuration file located at
> /usr/share/doc/sssd-common/examples/sssd-example.conf, but I receive
> the same error message, so my configuration seems to be just fine.
>
> Kind regards,
> Travis Bean
>
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue