A Docker image that provides the SSSD service with Active Directory configuration.
This image provides a way to let PAM authenticate against active directory inside you Docker containers. The configuration is done in a way that you do not need the AD administrator's password to use it. AD_LDAP credentials are sufficient.
docker run --name sssd \
-e KERBEROS_REALM=YOURDOMAIN.TLD
-e LDAP_BASE_DN="DC=YOURDOMAIN,DC=TLD" \
-e LDAP_BIND_DN="CN=SOMEACCOUNT,DC=YOURDOMAIN,DC=TLD" \
-e LDAP_BIND_PASSWORD=SOMEPASSWORD \
-e LDAP_URI=ldap://YOUR-AD-LDAP-SERVER/ \
-v /var/lib/sss
The volume is important because it can be mounted with --volume-from into other containers. These containers just need to have the SSSD client installed and can use the SSSD server remotely.
Optional parameters are:
| Option | Default | Description |
|---|---|---|
| LDAP_USER_PRINCIPAL | userPricipalName | The LDAP attribute identifying the user name for Kerberos. Set this to a nonexisting entry if this differs from the actiol username. |
| KERBEROS_DNS_DISCOVERY_DOMAIN | ${KERBEROS_REALM} | Change this, if your DNS uses another domain suffic than your AD realm. |
| LDAP_ENUMERATE | false | If set to true all users and groups will be downloaded at startup. May cause bad performance. |
| LDAP_IGNORE_GROUP_MEMBERS | true | If set to false getent group <groupname> will contain all group members. May cause bad performance. |
If something goes wrong run the container with
docker run --name sssd ... sssd sssd -d 0x0270 -f
In a second console go into the container and try
getent USERNAME
Substitute USERNAME with a username that certainly exists. If nothing is displayed, the user lookup over the LDAP connection does not work. Look into /var/log/sssd for further hints.
Secondly you can run
login USERNAME
and enter the correct password. If it says "login incorrect", then the AD part is somehow misconfigured. Again look into /var/log/sssd for further hints.
This image offers just enough options that it fits my usecase. If you would like to exend the list of options feel free to make a PR.