SSSD has been really, REALLY good to my group... except during initial setup. The logging failed me several times in trying to track down problems. The biggest one was when one of the our sysadmins had mistyped "default". Everything appeared to be connecting, getting data from LDAP... and then SSSD would crash with an empty log file.
It worked fine on all of our other machines with the incorrect spelling. The versions of Debian and SSSD were the same. I assume some library was different, but I never found it. I eventually noticed the typo, fixed it, and everything started working.
That was a couple of years ago. After those initial debugging hurdles, it has "just worked" through upgrades and major software changes.
I'm probably jinxing it by praising it. I'm now expecting SSH to stop working on every machine.
Trust me, setting up sssd with debug logging etc. is like the second coming of Jebus compared to ye olde school way of doing it with pam_krb5 + nss_ldap..
It worked fine on all of our other machines with the incorrect spelling. The versions of Debian and SSSD were the same. I assume some library was different, but I never found it. I eventually noticed the typo, fixed it, and everything started working.
That was a couple of years ago. After those initial debugging hurdles, it has "just worked" through upgrades and major software changes.
I'm probably jinxing it by praising it. I'm now expecting SSH to stop working on every machine.