Keeping POSIX IDs in sync with AD
We're close to launching a new University shared cluster with attached research storage, the VM that handles accessing the research storage (and also a user's cluster directories if they wish) is connected to our AD via winbind so we can get the shares mounted via CIFS on the Windows managed devices.
The issue is trying to ensure the converted POSIX IDs that winbind makes stay in sync with standard LDAP lookups that SSSD does (to the same DCs) on the rest of the cluster. We've had success so far at least by telling SSSD to keep it within a range and using ``ldap_idmap_autorid_compat`` but we've found if a user would change their password SSSD hands them a completely different user ID until we clear SSSD's cache (or possibly wait for it to resync itself which isn't ideal).
Since the cluster itself is in it's own containerized network with very little if any access to the rest of the University network, joining the rest of the system to our AD is a non-starter. We're thinking of setting up a Keycloak VM that ties into our AD so that way POSIX IDs are handled entirely by Keycloak and there's no conflict issues. Is it worth setting up though?