Should SSSD perform AD access validation for matching local users?

Question

I have been spending many, many happy hours exploring the sssd configuration needed to integrate RHEL7 and Active Directory. A large portion of those have included looking through the many posts here on SSSD and AD integration, particularly to do with local UID lookups in AD. Whilst these have been enlightening, none seem to cover my scenario.

My problem at present is that I can login via SSH using a windows user ("DOMAIN1\sales1" using the windows user's password) and SSSD will validate the state of the windows user correctly. If the windows user is disabled, or the account is expired, the login fails - all as it should be.

If I login via SSH using a linux user with the same id as the windows user ("sales1" using the linux user's password) SSSD will lookup and match the windows user in AD but will NOT validate the AD account. I have applied the linux users UID to the uidNumber attribute of the windows user in order to help the AD-linux user match, but nothing I try seems to influence the AD user state validation when logging in using linux user credentials.

sssd.conf

[sssd]
domains = domain1.local
config_file_version = 2
services = nss, pam
debug_level = 7


[domain/domain1.local]
ad_domain = domain1.local
krb5_realm = DOMAIN1.LOCAL
realmd_tags = manages-system joined-with-adcli 

id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad

## We do NOT want offline caching of Windows authentications
cache_credentials = False
krb5_store_password_if_offline = False

## Found this ticket for sssd: https://fedorahosted.org/sssd/ticket/2851
## might be the GC lookup that is stopping expired users from being denied access
ad_enable_gc = False
ldap_id_mapping = False
override_homedir = /home/%u
default_shell = /bin/bash
debug_level = 8

nsswitch.conf

passwd:     files sss
shadow:     files sss
group:      files sss
hosts:      files dns
bootparams: nisplus [NOTFOUND=return] files
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss
netgroup:   files sss
publickey:  nisplus
automount:  files
aliases:    files nisplus

pam.d/password-auth-ac

(as configured by authconfig)

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [default=1 success=ok] pam_localuser.so
auth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_sss.so forward_pass
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_oddjob_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

Is what I am attempting to achieve at all viable using SSSD?

Edit #1

I am very new to sssd and the impact of the AD integration on a RHEL system, so I think my approach to solving my requirements is all wrong.

I have an existing RHEL stand-alone server running an application that uses the linux user authentication (passwd, shadow, groups). I have been given the requirement to validate application users within ad prior to allowing their access to the linux application. The application MUST continue to use existing linux user and group ids as it is not currently capable of dealing with either long windows users or user id with "@", and a large portion of the acl behaviour is built on the existing group.

My original approach (which lead to the asking of this question) was to use sssd & realm to join RHEL to AD and then (via pam/sssd ) get the linux login to find a matching AD user for the linux user, most likely using POSIX attributes on the windows user, and validate their AD account.

I think what I actually need to achieve is
- Establish a map/relationship between an AD user and a local linux user that uses the application

When such a map/relationship exists:
- Only require the AD password at login
- Validate the AD account access status (account enabled/not expired/GPO logon rights/member of the right AD group)
- Always use the local username, uid, and gid of the mapped user

I think using the realm permit --groups adgroup@dlomain.ad will allow me to restrict AD user logins to a specific AD group (we do not currently want to have windows users logging into linux, outside of the above application use case).
What I am not sure about is the best way to map AD users to existing linux users. The application currently creates and maintains the linux user accounts so any solution needs to be able to work with this.

From what I have read over the past 2 weeks, I think my options are:
- Use SSSD local overrides to map between AD and linux users.
I have no experience with this so am relying on articles like SSSD Local overrides as indicators that this is viable
- Rely on POSIX attributes being defined on the AD user.
This does imply that these values will be used by the user on EVERY server they connect to that also references the POSIX attributes. I'm not sure if this is sensible in the long term. Testing has shown that with the uid, uidNumber, and gidNumber defined on a windows user when the user logs in linux uses these values. This does impose a maintenance effort to ensure these values are defined on the AD user.
- Install IPA and use id views.
I have no experience with installing or setting this up, but my reading indicates this is a possible option. There does seem to be additional installation, configuration and maintenance costs for using this option.

So I think I now need to confirm if these are indeed the only options, or if there are others I am not aware of, and of the available options which is best suited to my minimal AD integration need.

Answer 1

Yes, it's correct. As a matter of fact, it's a design decision of SSSD to only care about users that SSSD itself is able to serve (getent passwd -s sss $someuser).

If you want to keep using local users with remote password (why though? sssd has caching..) you want to use id_provider=proxy and a remote auth_provider. See for example my blog post on the topic: https://jhrozek.wordpress.com/2015/07/17/get-rid-of-calling-manually-calling-kinit-with-sssds-help/