What does realm join do, and what do cache_credentials = True and krb5_store_password_if_offline = True in sssd.conf mean?

realm join creates a computer account in AD and writes the Kerberos and SSSD configuration; the two options let domain users log in, and get Kerberos tickets later, while the DC cannot be reached.

sudo realm join -U labadmin g001.ckteck.com uses an AD admin account to:

• create a computer account for the host in AD and store its secret in /etc/krb5.keytab, so the host can prove its identity to the domain,
• write /etc/sssd/sssd.conf and the Kerberos settings,
• switch NSS and PAM over to SSSD.

The two options in sssd.conf:

• cache_credentials = True: after a successful online logon, SSSD stores a hash of the password locally. If the DC is offline later, the user can still log in against that cache.
• krb5_store_password_if_offline = True: if logon happens offline, SSSD keeps the password (in the kernel keyring) and requests the Kerberos ticket automatically as soon as the DC is back, so the user gets single sign-on without logging in again.

The trade-off: availability goes up, but a password-derived secret now lives on the client, and a password changed or account disabled in AD does not reach an offline machine right away.

Go deeper:

• sssd.io: Joining AD Domain — what a join sets up and how to do it with realmd.
• Debian manpage: sssd.conf(5) — the cache_credentials option and offline behaviour.
• Debian manpage: sssd-krb5(5) — krb5_store_password_if_offline and ticket renewal.