freeipa

#9346 Add support for socket-activated SSSD services
Opened by jaxxy. Modified

Open
Close Issue

Request for enhancement

SSSD currently supports either self-managed or socket-activated servces. These two systems are mutually exclusive (i.e, if you're using a socket-activated service you can't also have it be managed by SSSD). On certain systems, such as Debian, socket-activated services are the default for all responders, leading to a conflict with the FreeIPA configuration that is generated.

It would be nice to have first-class support for this in FreeIPA, either as an explicit or auto-detected install-time option that instead of placing the active services in sssd.conf would disable/enable the appropriate sockets via systemd.

As it stands, one must first disable all SSSD socket-activated services before installing the IPA server or client components in order to avoid conflicts and unit startup failures.

Few notes on implementation.

ipaplatform.base.tasks provides a namespace for tasks that can be overridden per platform. These tasks then called as a part of the individual configuration. A new task (or set of tasks) for SSSD services configuration can be added there and later used in ipaclient/install/client.py:configure_sssd_conf().

It would probably be better to refactor SSSD configuration code as a whole and move it to ipaplatform.base.tasks. For quite some time SSSD does support configuration snippets and we should start using them for all our configuration details.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.