I have a CentOS 8 HPC cluster setup with a login node that is connected to an active directory via sssd/kerberos. Only the login node is accessible from the user network. Users use their normal domain account to access the login node. All the cluster traffic is within a separate network, which is routed through the login node.
Internally the cluster uses SSH keys for authentication. However, so far this only works for the clusters local users listed in passwd. Now I would like the login node to provide the AD user mapping for uid/gid to the compute nodes within the cluster. I.e the AD users log into the login node with their AD account / kerberos and within the cluster use SSH keys.
What would be the best way to archive this? I thought about replicating the AD users with an LDAP server on the login node and from there provide them to the cluster nodes. The cluster is stateless, so joining the domain with sssd/kerberos on each node at boot does not seem to be an option.