nb: SDDM cannot offer the LDAP account at login #275

New issue

Closed

opened 2026-08-07 16:29:47 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-07 16:29:47 +02:00

Owner

The greeter builds its user list from getpwent(), and NSS modules load only inside nsncd whose protocol has no enumeration request — so SSSD can never appear there, which is why #269 dropped enumerate. where-is-my-sddm-theme also has no username field (sddm#406 is still open), so there is no way to reach dominik.polakovics from the greeter at all. Only dominik and epicenter are selectable.

Declare the LDAP account in users.users on nb, pinned to the LDAP uid/gid/home, with no password so pam_unix fails and PAM falls through to pam_sss → krb5 — keeping the Kerberos password authoritative and the login still yielding a TGT.

Also persist /var/lib/sddm, which holds SDDM's state.conf (last user, last session). It is not in nb's impermanence list today, so the greeter forgets the selection on every boot.

This is the hybrid ADR-0022 already anticipates: home-manager.users.<name> and sops.secrets.*.owner both require the user in users.users, so this declaration is where the deferred dominik → dominik.polakovics collapse will land.

The greeter builds its user list from `getpwent()`, and NSS modules load only inside nsncd whose protocol has no enumeration request — so SSSD can never appear there, which is why #269 dropped `enumerate`. `where-is-my-sddm-theme` also has no username field ([sddm#406](https://github.com/sddm/sddm/issues/406) is still open), so there is no way to reach `dominik.polakovics` from the greeter at all. Only `dominik` and `epicenter` are selectable. Declare the LDAP account in `users.users` on `nb`, pinned to the LDAP uid/gid/home, with **no password** so pam_unix fails and PAM falls through to pam_sss → krb5 — keeping the Kerberos password authoritative and the login still yielding a TGT. Also persist `/var/lib/sddm`, which holds SDDM's `state.conf` (last user, last session). It is not in `nb`'s impermanence list today, so the greeter forgets the selection on every boot. This is the hybrid ADR-0022 already anticipates: `home-manager.users.<name>` and `sops.secrets.*.owner` both require the user in `users.users`, so this declaration is where the deferred `dominik` → `dominik.polakovics` collapse will land.

dominik.polakovics added the

enhancement

label

2026-08-07 16:29:47 +02:00

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-07 16:34:55 +02:00

feat(nb): declare the LDAP account so SDDM can offer it #276

dominik.polakovics closed this issue

2026-08-07 16:40:41 +02:00