Troubleshoot SSSD integration

Resolve common problems when identity-provider users cannot sign in through the PAM issuer after you mount the SSSD pipes. Complete the prerequisites and verification steps in Authenticating with SSSD and the PAM issuer first, then match a symptom below to diagnostic commands and corrective actions.

Authentication service cannot retrieve authentication info

The SSSD pipes are not mounted or not accessible. Verify the volume mount in the quadlet file. If SELinux is enforcing, check for denials:

sudo ausearch -m avc -ts recent

Authentication failure with no entries in sssd_pam.log

This behavior often indicates an sssd-client version mismatch between the container and host. Verify that the host runs SSSD 2.9.x:

rpm -q sssd

NSS works but PAM fails

Confirm that PAM authentication works inside the container:

sudo podman exec flightctl-pam-issuer pamtester flightctl _<user>_ authenticate

If authentication fails on the host before you mount the pipes, the issue is in the SSSD or identity provider configuration, not the container. Verify domain sign-in on the host (for example, with id <user> and your organization’s SSSD troubleshooting procedures).

SSSD PAM log shows received 7

The identity provider rejected the authentication attempt. Verify the user’s password and check the SSSD domain backend log (/var/log/sssd/sssd<domain>.log) for details.

Pipes visible but permission denied

SELinux might be blocking access. Temporarily disable enforcement to confirm:

sudo setenforce 0

If this resolves the issue, create a targeted SELinux policy module as described in Mounting SSSD pipes.