sssd_ldap Cookbook

May 13, 2026 · View on GitHub

This cookbook provides an sssd_ldap custom resource that installs SSSD and configures LDAP authentication. As part of the setup it can also remove the NSCD package as NSCD is known to interfere with SSSD (https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/usingnscd-sssd.html).

Requirements

Platforms

AlmaLinux 8+
Amazon Linux 2023+
CentOS Stream 9+
Debian 11+
Fedora
Oracle Linux 8+
Red Hat Enterprise Linux 8+
Rocky Linux 8+
Ubuntu 22.04+

Arbitrary key/value pairs may be added to the sssd_conf property hash. These key/values will be expanded in the domain block of sssd.conf. This allows you to set any SSSD configuration value you want, not just ones provided by the default property value.

sssd_ldap

Migration

Upgrading from older cookbook releases that used sssd_ldap::default and node['sssd_ldap'] attributes is a breaking change. Replace recipe includes and node attributes with the sssd_ldap resource. See migration.md.

CA Certificates

If you manage your own CA then the easiest way to inject the certificate for system-wide use is as follows:

RHEL

cp ca.crt /etc/pki/ca-trust/source/anchors
update-ca-trust enable
update-ca-trust extract

Debian

cp ca.crt /usr/local/share/ca-certificates
update-ca-certificates

Maintainers

This cookbook is maintained by Chef's Community Cookbook Engineering team. Our goal is to improve cookbook quality and to aid the community in contributing to cookbooks. To learn more about our team, process, and design goals see our team documentation. To learn more about contributing to cookbooks like this see our contributing documentation, or if you have general questions about this cookbook come chat with us in #cookbok-engineering on the Chef Community Slack