In this lesson, you will learn how to configure DNS service records (SRV) to allow your Linux identity clients to automatically discover authentication endpoints without hardcoding server addresses.
Moving Beyond Static Configuration
In large-scale infrastructure, managing static configuration files for LDAP or Kerberos servers becomes a maintenance burden. If an authentication server fails or is migrated, updating every client node manually is prone to error. By leveraging DNS Service Discovery (SRV records), you decouple your PAM and SSSD configuration from specific IP addresses, allowing your identity stack to query the network for the current, authoritative authentication endpoints.
Implementing SRV Records
DNS SRV records allow you to specify the service, protocol, priority, weight, and target hostname. For a typical LDAP/Kerberos environment, you would define records in your zone file like this:
_ldap._tcp.example.com. IN SRV 10 0 389 auth-primary.example.com.
_ldap._tcp.example.com. IN SRV 20 0 389 auth-backup.example.com.
_kerberos._udp.example.com. IN SRV 0 0 88 kdc-primary.example.com.
When SSSD or your PAM stack initiates a lookup, it queries these records. The priority field (e.g., 10 vs 20) ensures that clients always attempt to connect to the primary server first, automatically failing over to the backup if the primary is unreachable.
Configuring SSSD for Discovery
To utilize this in your identity stack, you configure SSSD to "discover" rather than "point." In your /etc/sssd/sssd.conf, you remove the explicit ldap_uri or krb5_server directives and instead use the domain's discovery mechanism:
[domain/example.com]
dns_discovery_domain = example.com
# SSSD will now query _ldap._tcp.example.com automatically
This setup enables "location-aware" authentication. If you add new authentication nodes or replace hardware, you simply update the DNS record; the clients will automatically discover the new infrastructure during their next lookup cycle without requiring a restart of the PAM or SSSD services. This creates a resilient, self-healing identity layer that scales horizontally with your network.
Key Takeaway: DNS SRV records allow identity services to dynamically locate authentication endpoints, removing the need for fragile, static IP configurations and enabling seamless failover for your PAM stack.