blog

SSO on Linux using authentik

SSO on Linux using authentik

Anthentik LDAP outpost

Docker compose

This is installed on a seperate machene to segment the network and keep authentik away form the docker socket.

services:
authentik_ldap:
    restart: unless-stopped
    image: ghcr.io/goauthentik/ldap:2026.8.2
    ports:
        - 636:6636
    environment:
        AUTHENTIK_HOST: https://auth.jarand.site
        AUTHENTIK_INSECURE: "false"
        AUTHENTIK_TOKEN: ${token}

.env

Put your outpost token form authentik

token=

Ansible

Ansible variables

Variable name Description
sssd_conf_path File path for the SSSD config file
ldap_server LDAP server IP or domain name
ldap_group Group in authentik, this group allows login
ldap_user Your service account in authentik for SSSD
ldap_key Your service account's password
base_dn Your ldap server's base DN (default: dc=authentik,dc=io)

Ansible playbook

Clean hostname task is spesific to my enviorment due to using .lan domains on my hosts in the inventory files

## Clean hostname
- name: remove .lan form hostnames
  set_fact:
    ansible_host_valid: "{{ ansible_host | replace('.lan', '') }}"

## Install SSSD
- name: Install LDAP and SSSD packages
  apt:
    name:
    - sssd
    - sssd-ldap
    - ldap-utils
    - libnss-sss
    - libpam-sss
    - ca-certificates
    update_cache: yes

## Configure SSSD
- name: Configure /etc/sssd/sssd.conf
  copy:
    dest: "{{ sssd_conf_path }}"
    content: |
    [nss]
    filter_groups = root
    filter_users = root
    reconnection_retries = 3

    [sssd]
    config_file_version = 2
    reconnection_retries = 3
    domains = authentik
    services = nss, pam, ssh

    [pam]
    reconnection_retries = 3

    [domain/authentik]

    cache_credentials = false
    id_provider = ldap
    chpass_provider = ldap
    auth_provider = ldap
    access_provider = ldap
    ldap_uri = ldaps://{{ ldap_server }}:636

    ldap_schema = rfc2307bis
    ldap_search_base = {{ base_dn }}
    ldap_user_search_base = ou=users,{{ base_dn }}
    ldap_group_search_base = {{ base_dn }}

    ldap_user_object_class = user
    ldap_user_name = cn
    ldap_group_object_class = group
    ldap_group_name = cn

    ldap_access_order = filter
    ldap_access_filter = (&(|(memberOf=cn={{ ldap_group }}-login,ou=groups,{{ base_dn }}))(ak-active=TRUE))
    ldap_default_bind_dn = cn={{ ldap_user }},ou=users,{{ base_dn }}
    ldap_default_authtok = {{ ldap_key }}
    ldap_tls_reqcert = demand

    ldap_user_ssh_public_key = sshPublicKey
    override_shell = /bin/bash
    sudo_provider = ldap
    owner: root
    group: root
    mode: 0600

## Start / Restart SSSD
- name: Ensure sssd service is enabled and restarted
  service:
    name: sssd
    state: restarted
    enabled: yes

## Config SSH
- name: Configure SSH to use sss_ssh_authorizedkeys
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: "^{{ item.key }}"
    line: "{{ item.key }} {{ item.value }}"
    state: present
  loop:
    - { key: 'AuthorizedKeysCommand', value: '/usr/bin/sss_ssh_authorizedkeys' }
    - { key: 'AuthorizedKeysCommandUser', value: 'nobody' }

- name: Restart SSHD
  service:
    name: ssh
    state: restarted

## Configure PAM
- name: Ensure PAM configuration for su supports SSSD
  blockinfile:
    path: /etc/pam.d/su
    block: |
    auth            sufficient      pam_sss.so
    auth            sufficient      pam_rootok.so
    auth            required        pam_unix.so use_first_pass
    account         required        pam_unix.so
    session         required        pam_unix.so

## Enable home dir
- name: Enable create home dir
  shell: /usr/sbin/pam-auth-update --enable mkhomedir

Resources