Workstation login: SSSD against the Authentik LDAP outpost #3
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Part of the plan AvesIT/platform-architecture#59 (steps 4 to 6). Personal machines only, so the client config lives here (decided 2026-11-02).
This repo is public: nothing secret and no internal detail that the public/private split keeps out goes here. The bind DN and password come from the vault at apply time.
rpm -q sssd sssd-ldap authselect oddjob-mkhomedir fprintd-pamon the host; layer the missing ones withrpm-ostree installfrom arun_onchangescript (reboot needed), or confirm Bluefin already ships them./etc/sssd/sssd.confas a template, mode 0600 root:id_provider/auth_provider = ldap,access_provider = permit(the group rule is the Authentik application policy),ldaps://URI,ldap_schema = rfc2307bis,cache_credentials = true,offline_credentials_expiration = 0(or a limit),override_homedir,default_shell = /bin/bash,enumerate = false. The LDAP host and base DN come from the private config.bwtoday,rbwper the migration plan) when the script runs and write it root-only intosssd.conf. Never into git, never into the chezmoi source state.authselect select sssd with-mkhomedir with-fingerprint, enablesssdandoddjobd. authselect owns/etc/pam.d, so no hand edits./homeis/var/homeon Atomic: check the homedir path, SELinux labels andoverride_homedir.sssdis up and tested.nivoaccount with a local password; documentauthselect select minimalas the way back.Depends on the infra-idp LDAP root (AvesIT/infra-idp#118) and the outpost issue in AvesIT/platform (text in a comment on AvesIT/platform-architecture#59).