SSSD cache for as long as you need. If you don't have an auth server or network then you are in deeper trouble. (even AD can be n-tier active active) AD/LDAP a

SSSD cache for as long as you need. If you don't have an auth server or network then you are in deeper trouble. (even AD can be n-tier active active) AD/LDAP allows SSO for everything ssh, bash, gmail, AWS console, etc. Because its a centralised, when someone leaves, or their account is compromised then its one place to change it. Crucially its one source of truth across the entire estate, not just for "servers" or "desktops" As for "massive configuration, maintenance and ugly design." Its really not. Also purity of design is not getting the job done. Your approach is ok if you only have a few servers and a handful of users. The point of ansible/puppet/salt/$other playbooks is that 90% of the work is done for you. All you have to do is input your users, and roll out the SSSD conf (after testing) Even by hand openLDAP isn't that hard. As for the rhetorical question about /etc/hosts you wouldn't because thats what nslcd/sssd/Program caches are for.