How does SSSD give a Linux host access to Active Directory users?

SSSD is the client to a remote identity provider (here AD): it fetches identity and authentication data from the provider and caches it locally, without creating local accounts.

* Applications keep using NSS and PAM; SSSD fetches from AD (1) and serves from its cache (2). *

Two phases:

1. Fetch: the SSSD client connects to the remote provider, here Active Directory, and gets identity data (users, groups, UIDs and GIDs over LDAP) and authenticates the user (Kerberos).
2. Cache: the result is stored in a local cache. Later lookups are fast, and with cached credentials a user can still log in when the domain controller cannot be reached, for example on a laptop.

Applications never talk to SSSD directly. They keep using the normal interfaces: NSS for "who is user X" (getent passwd) and PAM for "is this password correct". SSSD plugs in behind both.

SSSD does not create local accounts. The users stay in AD and are only resolved at runtime. A home directory can be created for them at first login, and it remains after they log out.

Go deeper:

• sssd.io: Introduction — what SSSD is for and how it caches.
• sssd.io: SSSD Architecture — responders, back ends and the cache in detail.