Linux Identity Management and File Sharing
The Linux Identity Management and File Sharing domain tests integrating Linux hosts with AD or LDAP identities through SSSD or winbind, making those identities usable through NSS and PAM, and keeping file ownership consistent across shared storage.
NSS, PAM and identity sources
nsswitch.conf decides where passwd and group lookups go. A typical AD client uses passwd: files sss and group: files sss, or winbind instead of sss. getent passwd user and id user are the fastest checks that NSS resolution works. PAM must include the matching module, such as pam_sss or pam_winbind, for auth, account, password and session. Home directories are created on first login by pam_mkhomedir or oddjob-mkhomedir, and access can be restricted with pam_access or an SSSD access provider.
SSSD and winbind
SSSD is configured in /etc/sssd/sssd.conf with domains = example.com, id_provider = ad, auth_provider = ad, and often access_provider = ad. realm discover example.com and realm join -U Administrator example.com perform discovery and join; systemctl enable --now sssd starts the service. For AD, ldap_id_mapping = True lets SSSD generate POSIX IDs, while POSIX attributes can be used instead. Winbind is the Samba alternative and relies on idmap config ranges plus net ads join. Do not let both services manage the same domain unintentionally.
File sharing consistency
Samba and NFS exports must present the same UID/GID for the same user on every server. If ID mapping changes after files exist, ownership appears to shift. POSIX ACLs, extended attributes, and NFSv4 idmapd settings all affect access. Test with getfacl, setfacl, ls -n, and id on both client and server.
Worked example
An admin joins a host with realm join, sets id_provider = ad and ldap_id_mapping = True, starts SSSD, and runs getent passwd for a domain user. The user can log in but has no home directory, so the admin enables oddjob-mkhomedir. Reasoning: SSSD supplies identity and authentication, PAM session handling creates the home directory, and stable ID mapping keeps ownership correct on the Samba share.
Traps
Using enumerate = true on a large domain; clearing or changing ID mapping after files exist; stale SSSD cache after configuration changes; and mixing SSSD and winbind for one domain.