Every guide to using SSSD for LDAP authentication I've found thus far shows you how to do more than just authenticate a user, such as provide their shell, groups, etc. I don't know how to remove those features without things breaking because there are several moving parts like SSSD, PAM, and NSS.
Due to limitations on what information is provided via LDAP (it's not AD), only authentication of users can be done. There isn't even a uid available because the only id provided via LDAP are consistently formatted alpha-numeric strings (won't work on linux). Basically, how can SSSD be configured on Ubuntu to treat ldap as the "shadow" database, but get the uid, groups, and shell from your local system databases (passwd, group).
This is currently done with libpam-ldap, but my understanding is there are better alternatives like libpam-ldapd and sssd, the latter of which RHEL has moved to. If I had to guess, it can be done similarly to how we currently do it, which is nss will check local databases first, and if the user doesn't have a shadow file entry, check ldap.
As a summary, if I can use SSSD or, as a backup, libpam-ldapd, to authenticate the following way:
uid -> /etc/passwd
authenticate -> ldap
shell -> /etc/passwd
groups -> /etc/group
Even better if it's possible to stop users from creating passwords locally that would end up in /etc/shadow thus causing it to check ldap at all in future login attempts. Also, all local and service accounts shouldn't be impacted, and ldap authenticated users can be determined with simple regex. I'll be very grateful for any good suggestions on how to handle this. Thanks!