In this lesson, you will learn how to configure the System Security Services Daemon (SSSD) to ensure your users can still log in even when the connection to your central LDAP or Active Directory server is lost.
The Role of the SSSD Cache
When a user logs in via a remote provider like LDAP, SSSD doesn't just pass the request to the server; it acts as a smart intermediary. By default, SSSD maintains a local database (the cache) that stores user identity information and, if configured, hashes of the credentials. This allows the system to verify a user’s identity locally, effectively "remembering" the user after their initial successful login.
Enabling Offline Authentication
To enable this functionality, you must ensure that SSSD is configured to allow offline credential storage. This is primarily managed in the /etc/sssd/sssd.conf file under your specific domain section.
You need to set cache_credentials = True. This tells SSSD to save the hashed credentials locally whenever a user authenticates successfully.
[domain/your.domain.com]
id_provider = ldap
auth_provider = ldap
cache_credentials = True
offline_timeout = 3600
cache_credentials = True: Enables the local storage of password hashes.offline_timeout = 3600: Defines how long (in seconds) the system stays in "offline mode" before attempting to re-verify against the remote server once connectivity is restored.
Handling the "Offline" State
When the network link goes down, SSSD enters an offline state automatically. During this time, PAM requests are routed to the local cache rather than timing out waiting for a network response. This prevents the "system hang" that often occurs when a login process waits indefinitely for a unreachable LDAP server.
Keep in mind that while this provides resilience, it does not allow for password changes while offline. The cache is strictly for authentication verification based on the last known-good password. Once the network is back online, SSSD will periodically synchronize the cache with the remote directory, ensuring that account locks or password updates are eventually propagated.
Key Takeaway: Setting cache_credentials = True in your SSSD domain configuration provides high availability for user logins by enabling local verification of credentials during network outages.