On Thu, Jul 20, 2017 at 02:33:50PM +0200, John Keates via FreeIPA-users wrote:
Hi,
Using SSSD 1.15.2-1 and FreeIPA Client 4.4.4-1 on Debian Stretch 9.0 generates a broken
SSSD configuration.
Adding the services manually to sssd.conf fixes this:
services = nss, sudo, pam, ssh
For some reason, ipa-client-install thinks we have socket-activated SSSD services, but we
don’t. From the SSSD package, we only get:
- sssd.service
- sssd-secrets.socket
- sssd-secrets.service
There seems to be a mismatch between what gets configured in sssd.conf and what is
actually on the system.
I should probably report it as a bug against the Debian package, but I wonder where the
assumption for SSSD.conf is made. It is definitely generated by ipa-client-install, but
maybe it’s because it sees the socket-activated SSSD components as a requirement?
There was a thread on Mar 3rd titled "ipa-client-install generates bad
sssd.conf", you might want to check it out although I didn't see any
conclusion in the thread..