From 2b4bbf6675ed36ad6f0646d89db09a0a0b224e24 Mon Sep 17 00:00:00 2001
From: Fagani Hajizada <fhajizada@nvidia.com>
Date: Thu, 11 Dec 2025 12:59:25 +0100
Subject: [PATCH 1/3] feat: add SSSD support to slurmctld container

---
 schedmd/slurm/25.11/rockylinux9/Dockerfile       |  7 +++++++
 .../files/etc/supervisord.d/slurmctld.ini        |  1 +
 .../files/usr/local/bin/slurmctld-entrypoint.sh  | 16 +++++++++++++++-
 schedmd/slurm/25.11/ubuntu24.04/Dockerfile       |  7 +++++++
 .../files/etc/supervisor/conf.d/slurmctld.conf   |  1 +
 .../files/usr/local/bin/slurmctld-entrypoint.sh  | 16 +++++++++++++++-
 schedmd/slurm/master/rockylinux9/Dockerfile      |  7 +++++++
 .../files/etc/supervisord.d/slurmctld.ini        |  1 +
 .../files/usr/local/bin/slurmctld-entrypoint.sh  | 16 +++++++++++++++-
 schedmd/slurm/master/ubuntu24.04/Dockerfile      |  7 +++++++
 .../files/etc/supervisor/conf.d/slurmctld.conf   |  1 +
 .../files/usr/local/bin/slurmctld-entrypoint.sh  | 16 +++++++++++++++-
 12 files changed, 92 insertions(+), 4 deletions(-)

diff --git a/schedmd/slurm/25.11/rockylinux9/Dockerfile b/schedmd/slurm/25.11/rockylinux9/Dockerfile
index b9311af..aa72a50 100644
--- a/schedmd/slurm/25.11/rockylinux9/Dockerfile
+++ b/schedmd/slurm/25.11/rockylinux9/Dockerfile
@@ -153,15 +153,22 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked <<EOR
 set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   socat \
+  authselect sssd sssd-ad sssd-ldap \
   ./slurm-slurmctld-[0-9]*.rpm \
   ./slurm-[0-9]*.rpm
 rm *.rpm
+# Configure
+sed -i -E "s/^passwd:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+sed -i -E "s/^group:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+mkdir -p /etc/authselect
+authselect select sssd with-mkhomedir --force
 EOR
 
 COPY files/etc/supervisord.conf /etc/
 COPY \
   files/etc/supervisord.d/slurmctld.ini \
   files/etc/supervisord.d/fakesystemd.ini \
+  files/etc/supervisord.d/sssd.ini \
   /etc/supervisord.d/
 COPY files/usr/local/bin/fakesystemd.sh /usr/local/bin/
 COPY files/usr/local/bin/slurmctld-entrypoint.sh /usr/local/bin/entrypoint.sh
diff --git a/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/slurmctld.ini b/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/slurmctld.ini
index 0cac135..8448686 100644
--- a/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/slurmctld.ini
+++ b/schedmd/slurm/25.11/rockylinux9/files/etc/supervisord.d/slurmctld.ini
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [program:slurmctld]
+user=slurm
 environment=NOTIFY_SOCKET="/tmp/fakesystemd.sock"
 command=bash -xc "exec slurmctld --systemd %(ENV_SLURMCTLD_OPTIONS)s"
 stdout_logfile=/dev/stdout
diff --git a/schedmd/slurm/25.11/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh b/schedmd/slurm/25.11/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh
index d20b92e..a4880ef 100755
--- a/schedmd/slurm/25.11/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh
+++ b/schedmd/slurm/25.11/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh
@@ -4,11 +4,25 @@
 
 set -euo pipefail
 
-# Additional arguments to pass to slurmctld.
+# Additional arguments to pass to daemons.
 export SLURMCTLD_OPTIONS="${SLURMCTLD_OPTIONS:-} $*"
+export SSSD_OPTIONS="${SSSD_OPTIONS:-}"
 
 function main() {
 	mkdir -p /run/slurmctld/
+	chown slurm:slurm /run/slurmctld/
+	mkdir -p /run/dbus/
+	rm -f /var/run/dbus/pid
+
+	# Copy SSSD config with correct permissions if mounted
+	# The operator mounts it to /run/sssd-mounted/ with fsGroup (group-readable)
+	# We copy to /etc/sssd/ and set strict permissions (SSSD requires root:root 0600)
+	if [[ -f /run/sssd-mounted/sssd.conf ]]; then
+		mkdir -p /etc/sssd
+		cp /run/sssd-mounted/sssd.conf /etc/sssd/sssd.conf
+		chmod 0600 /etc/sssd/sssd.conf
+		chown root:root /etc/sssd/sssd.conf
+	fi
 
 	exec supervisord -c /etc/supervisord.conf
 }
diff --git a/schedmd/slurm/25.11/ubuntu24.04/Dockerfile b/schedmd/slurm/25.11/ubuntu24.04/Dockerfile
index 59bc801..77d6d68 100644
--- a/schedmd/slurm/25.11/ubuntu24.04/Dockerfile
+++ b/schedmd/slurm/25.11/ubuntu24.04/Dockerfile
@@ -141,6 +141,7 @@ set -xeuo pipefail
 apt-get -qq update
 apt-get -qq -y install --no-install-recommends --fix-broken \
   socat \
+  authselect sssd sssd-ad sssd-ldap libpam-sss libnss-sss \
   ./slurm-smd-client_[0-9]*.deb \
   ./slurm-smd-client-dbgsym_[0-9]*.ddeb \
   ./slurm-smd-dev_[0-9]*.deb \
@@ -150,11 +151,17 @@ apt-get -qq -y install --no-install-recommends --fix-broken \
   ./slurm-smd_[0-9]*.deb \
   ./slurm-smd-dbgsym_[0-9]*.ddeb
 rm *.deb && rm *.ddeb
+# Configure
+sed -i -E "s/^passwd:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+sed -i -E "s/^group:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+mkdir -p /etc/authselect
+authselect select sssd with-mkhomedir --force
 EOR
 
 COPY files/etc/supervisor/supervisord.conf /etc/supervisor/
 COPY \
   files/etc/supervisor/conf.d/slurmctld.conf \
+  files/etc/supervisor/conf.d/sssd.conf \
   /etc/supervisor/conf.d/
 COPY files/usr/local/bin/slurmctld-entrypoint.sh /usr/local/bin/entrypoint.sh
 
diff --git a/schedmd/slurm/25.11/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf b/schedmd/slurm/25.11/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf
index 0cac135..8448686 100644
--- a/schedmd/slurm/25.11/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf
+++ b/schedmd/slurm/25.11/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [program:slurmctld]
+user=slurm
 environment=NOTIFY_SOCKET="/tmp/fakesystemd.sock"
 command=bash -xc "exec slurmctld --systemd %(ENV_SLURMCTLD_OPTIONS)s"
 stdout_logfile=/dev/stdout
diff --git a/schedmd/slurm/25.11/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh b/schedmd/slurm/25.11/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh
index 98ff8d3..f78bac5 100755
--- a/schedmd/slurm/25.11/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh
+++ b/schedmd/slurm/25.11/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh
@@ -4,11 +4,25 @@
 
 set -euo pipefail
 
-# Additional arguments to pass to slurmctld.
+# Additional arguments to pass to daemons.
 export SLURMCTLD_OPTIONS="${SLURMCTLD_OPTIONS:-} $*"
+export SSSD_OPTIONS="${SSSD_OPTIONS:-}"
 
 function main() {
 	mkdir -p /run/slurmctld/
+	chown slurm:slurm /run/slurmctld/
+	mkdir -p /run/dbus/
+	rm -f /var/run/dbus/pid
+
+	# Copy SSSD config with correct permissions if mounted
+	# The operator mounts it to /run/sssd-mounted/ with fsGroup (group-readable)
+	# We copy to /etc/sssd/ and set strict permissions (SSSD requires root:root 0600)
+	if [[ -f /run/sssd-mounted/sssd.conf ]]; then
+		mkdir -p /etc/sssd
+		cp /run/sssd-mounted/sssd.conf /etc/sssd/sssd.conf
+		chmod 0600 /etc/sssd/sssd.conf
+		chown root:root /etc/sssd/sssd.conf
+	fi
 
 	exec supervisord -c /etc/supervisor/supervisord.conf
 }
diff --git a/schedmd/slurm/master/rockylinux9/Dockerfile b/schedmd/slurm/master/rockylinux9/Dockerfile
index 446cd62..1a70967 100644
--- a/schedmd/slurm/master/rockylinux9/Dockerfile
+++ b/schedmd/slurm/master/rockylinux9/Dockerfile
@@ -153,15 +153,22 @@ RUN --mount=type=cache,target=/var/cache/dnf,sharing=locked <<EOR
 set -xeuo pipefail
 dnf -q -y install --setopt='install_weak_deps=False' \
   socat \
+  authselect sssd sssd-ad sssd-ldap \
   ./slurm-slurmctld-[0-9]*.rpm \
   ./slurm-[0-9]*.rpm
 rm *.rpm
+# Configure
+sed -i -E "s/^passwd:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+sed -i -E "s/^group:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+mkdir -p /etc/authselect
+authselect select sssd with-mkhomedir --force
 EOR
 
 COPY files/etc/supervisord.conf /etc/
 COPY \
   files/etc/supervisord.d/slurmctld.ini \
   files/etc/supervisord.d/fakesystemd.ini \
+  files/etc/supervisord.d/sssd.ini \
   /etc/supervisord.d/
 COPY files/usr/local/bin/fakesystemd.sh /usr/local/bin/
 COPY files/usr/local/bin/slurmctld-entrypoint.sh /usr/local/bin/entrypoint.sh
diff --git a/schedmd/slurm/master/rockylinux9/files/etc/supervisord.d/slurmctld.ini b/schedmd/slurm/master/rockylinux9/files/etc/supervisord.d/slurmctld.ini
index 0cac135..8448686 100644
--- a/schedmd/slurm/master/rockylinux9/files/etc/supervisord.d/slurmctld.ini
+++ b/schedmd/slurm/master/rockylinux9/files/etc/supervisord.d/slurmctld.ini
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [program:slurmctld]
+user=slurm
 environment=NOTIFY_SOCKET="/tmp/fakesystemd.sock"
 command=bash -xc "exec slurmctld --systemd %(ENV_SLURMCTLD_OPTIONS)s"
 stdout_logfile=/dev/stdout
diff --git a/schedmd/slurm/master/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh b/schedmd/slurm/master/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh
index d20b92e..a4880ef 100755
--- a/schedmd/slurm/master/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh
+++ b/schedmd/slurm/master/rockylinux9/files/usr/local/bin/slurmctld-entrypoint.sh
@@ -4,11 +4,25 @@
 
 set -euo pipefail
 
-# Additional arguments to pass to slurmctld.
+# Additional arguments to pass to daemons.
 export SLURMCTLD_OPTIONS="${SLURMCTLD_OPTIONS:-} $*"
+export SSSD_OPTIONS="${SSSD_OPTIONS:-}"
 
 function main() {
 	mkdir -p /run/slurmctld/
+	chown slurm:slurm /run/slurmctld/
+	mkdir -p /run/dbus/
+	rm -f /var/run/dbus/pid
+
+	# Copy SSSD config with correct permissions if mounted
+	# The operator mounts it to /run/sssd-mounted/ with fsGroup (group-readable)
+	# We copy to /etc/sssd/ and set strict permissions (SSSD requires root:root 0600)
+	if [[ -f /run/sssd-mounted/sssd.conf ]]; then
+		mkdir -p /etc/sssd
+		cp /run/sssd-mounted/sssd.conf /etc/sssd/sssd.conf
+		chmod 0600 /etc/sssd/sssd.conf
+		chown root:root /etc/sssd/sssd.conf
+	fi
 
 	exec supervisord -c /etc/supervisord.conf
 }
diff --git a/schedmd/slurm/master/ubuntu24.04/Dockerfile b/schedmd/slurm/master/ubuntu24.04/Dockerfile
index ce9a73b..1093d63 100644
--- a/schedmd/slurm/master/ubuntu24.04/Dockerfile
+++ b/schedmd/slurm/master/ubuntu24.04/Dockerfile
@@ -141,6 +141,7 @@ set -xeuo pipefail
 apt-get -qq update
 apt-get -qq -y install --no-install-recommends --fix-broken \
   socat \
+  authselect sssd sssd-ad sssd-ldap libpam-sss libnss-sss \
   ./slurm-smd-client_[0-9]*.deb \
   ./slurm-smd-client-dbgsym_[0-9]*.ddeb \
   ./slurm-smd-dev_[0-9]*.deb \
@@ -150,11 +151,17 @@ apt-get -qq -y install --no-install-recommends --fix-broken \
   ./slurm-smd_[0-9]*.deb \
   ./slurm-smd-dbgsym_[0-9]*.ddeb
 rm *.deb && rm *.ddeb
+# Configure
+sed -i -E "s/^passwd:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+sed -i -E "s/^group:[[:space:]]+/&slurm /g" /etc/nsswitch.conf
+mkdir -p /etc/authselect
+authselect select sssd with-mkhomedir --force
 EOR
 
 COPY files/etc/supervisor/supervisord.conf /etc/supervisor/
 COPY \
   files/etc/supervisor/conf.d/slurmctld.conf \
+  files/etc/supervisor/conf.d/sssd.conf \
   /etc/supervisor/conf.d/
 COPY files/usr/local/bin/slurmctld-entrypoint.sh /usr/local/bin/entrypoint.sh
 
diff --git a/schedmd/slurm/master/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf b/schedmd/slurm/master/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf
index 0cac135..8448686 100644
--- a/schedmd/slurm/master/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf
+++ b/schedmd/slurm/master/ubuntu24.04/files/etc/supervisor/conf.d/slurmctld.conf
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [program:slurmctld]
+user=slurm
 environment=NOTIFY_SOCKET="/tmp/fakesystemd.sock"
 command=bash -xc "exec slurmctld --systemd %(ENV_SLURMCTLD_OPTIONS)s"
 stdout_logfile=/dev/stdout
diff --git a/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh b/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh
index 98ff8d3..f78bac5 100755
--- a/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh
+++ b/schedmd/slurm/master/ubuntu24.04/files/usr/local/bin/slurmctld-entrypoint.sh
@@ -4,11 +4,25 @@
 
 set -euo pipefail
 
-# Additional arguments to pass to slurmctld.
+# Additional arguments to pass to daemons.
 export SLURMCTLD_OPTIONS="${SLURMCTLD_OPTIONS:-} $*"
+export SSSD_OPTIONS="${SSSD_OPTIONS:-}"
 
 function main() {
 	mkdir -p /run/slurmctld/
+	chown slurm:slurm /run/slurmctld/
+	mkdir -p /run/dbus/
+	rm -f /var/run/dbus/pid
+
+	# Copy SSSD config with correct permissions if mounted
+	# The operator mounts it to /run/sssd-mounted/ with fsGroup (group-readable)
+	# We copy to /etc/sssd/ and set strict permissions (SSSD requires root:root 0600)
+	if [[ -f /run/sssd-mounted/sssd.conf ]]; then
+		mkdir -p /etc/sssd
+		cp /run/sssd-mounted/sssd.conf /etc/sssd/sssd.conf
+		chmod 0600 /etc/sssd/sssd.conf
+		chown root:root /etc/sssd/sssd.conf
+	fi
 
 	exec supervisord -c /etc/supervisor/supervisord.conf
 }

From 9b2a915c65293dfb747635e9d18fd64bb56d8ac9 Mon Sep 17 00:00:00 2001
From: Fagani Hajizada <fagani.hajizada@gmail.com>
Date: Wed, 17 Dec 2025 15:31:25 +0100
Subject: [PATCH 2/3] Update schedmd/slurm/25.11/rockylinux9/Dockerfile

Co-authored-by: Vivian Hafener <79525734+vivian-hafener@users.noreply.github.com>
---
 schedmd/slurm/25.11/rockylinux9/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/schedmd/slurm/25.11/rockylinux9/Dockerfile b/schedmd/slurm/25.11/rockylinux9/Dockerfile
index aa72a50..9862c8c 100644
--- a/schedmd/slurm/25.11/rockylinux9/Dockerfile
+++ b/schedmd/slurm/25.11/rockylinux9/Dockerfile
@@ -167,7 +167,7 @@ EOR
 COPY files/etc/supervisord.conf /etc/
 COPY \
   files/etc/supervisord.d/slurmctld.ini \
-  files/etc/supervisord.d/fakesystemd.ini \
+  files/etc/supervisord.d/fakesystemd-slurm.ini \
   files/etc/supervisord.d/sssd.ini \
   /etc/supervisord.d/
 COPY files/usr/local/bin/fakesystemd.sh /usr/local/bin/

From 428cddf112f595537da7acb02803e178ee1e7654 Mon Sep 17 00:00:00 2001
From: Fagani Hajizada <fagani.hajizada@gmail.com>
Date: Wed, 17 Dec 2025 15:31:46 +0100
Subject: [PATCH 3/3] Update schedmd/slurm/master/rockylinux9/Dockerfile

Co-authored-by: Vivian Hafener <79525734+vivian-hafener@users.noreply.github.com>
---
 schedmd/slurm/master/rockylinux9/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/schedmd/slurm/master/rockylinux9/Dockerfile b/schedmd/slurm/master/rockylinux9/Dockerfile
index 1a70967..e575b4b 100644
--- a/schedmd/slurm/master/rockylinux9/Dockerfile
+++ b/schedmd/slurm/master/rockylinux9/Dockerfile
@@ -167,7 +167,7 @@ EOR
 COPY files/etc/supervisord.conf /etc/
 COPY \
   files/etc/supervisord.d/slurmctld.ini \
-  files/etc/supervisord.d/fakesystemd.ini \
+  files/etc/supervisord.d/fakesystemd-slurm.ini \
   files/etc/supervisord.d/sssd.ini \
   /etc/supervisord.d/
 COPY files/usr/local/bin/fakesystemd.sh /usr/local/bin/