> The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations ..

As a long time Linux user on personal machines, I found myself for the first time a couple of years ago needing to support a small team and given them all login access to our small cluster. I figured, hey it's annoying to coordinate user ids over these machines, I should just set up OpenLDAP.. little did I know.. honestly I'm pretty handy at dealing with Linux but I was shocked to discover how complicated and annoying it was to set up and use OpenLDAP with NFS automounting home directories.

For the first time in my life I was like, "oh this is why people spend years studying system administration.."

I did get it working eventually but it was hard to trust it and the configuration GUI was not very good and I never fully got passwd working properly so I had to intervene to help people change their passwords.. in the end we ended up just using manually coordinated local accounts.

The whole time I'm just thinking, I must be missing something, it can't be this bad.. I'm still a bit flabbergasted by the experience.

I don't think it's exactly the same thing as sssd is primarily a cache. You can use pam_krb5 on Linux too. But can you disconnect your FreeBSD laptop and work as normal from cache? I agree that sssd is quite finicky however, and I'd love a simpler alternative.

Would be highly interested in learning more about this setup particularly the PowerDNS integration.