Hi sieroux,
based on the provided information for joining ubuntu-clients into an UCS domain, i could successfully join my Debian testsystem into such a domain.
Here is how i did it.
I installed a clean UCS 4.2 server without selecting any components.
UCS Domain Name: example.com
IP: 192.168.22.100
The client system (Debian 8.7.1) was also installed without any additional Software. DNS was set to the IP of the UCS server and domain set equal to the UCS Domain Name.
Login as root to the client system and execute the following script:
#!/bin/bash
# Install required packages
apt-get install -y sudo lsb-release krb5-user sssd-ldap
# Set IP of the domain controller
export MASTER_IP=192.168.22.100
mkdir /etc/univention
ssh -n root@${MASTER_IP} 'ucr shell | grep -v ^hostname=' >/etc/univention/ucr_master
echo "master_ip=${MASTER_IP}" >>/etc/univention/ucr_master
chmod 660 /etc/univention/ucr_master
. /etc/univention/ucr_master
echo "${MASTER_IP} ${ldap_master}" >>/etc/hosts
# Download the SSL certificate
mkdir -p /etc/univention/ssl/ucsCA/
wget -O /etc/univention/ssl/ucsCA/CAcert.pem http://${ldap_master}/ucs-root-ca.crt
# Create an account and save the password
password="$(tr -dc A-Za-z0-9_ </dev/urandom | head -c20)"
ssh -n root@${ldap_master} udm computers/linux create --position "cn=computers,${ldap_base}" --set name=$(hostname) --set password="${password}" --set operatingSystem="$(lsb_release -is)" --set operatingSystemVersion="$(lsb_release -rs)"
printf '%s' "$password" >/etc/ldap.secret
chmod 0400 /etc/ldap.secret
# Create ldap.conf
cat >/etc/ldap/ldap.conf <<__EOF__
TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem
URI ldap://$ldap_master:7389
BASE $ldap_base
__EOF__
# Create sssd.conf
cat >/etc/sssd/sssd.conf <<___EOF___
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam, sudo
domains = $kerberos_realm
[nss]
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/$kerberos_realm]
auth_provider = krb5
krb5_kdcip = ${master_ip}
krb5_realm = ${kerberos_realm}
krb5_server = ${ldap_master}
krb5_kpasswd = ${ldap_master}
id_provider = ldap
ldap_uri = ldap://${ldap_master}:7389
ldap_search_base = ${ldap_base}
ldap_tls_reqcert = never
ldap_tls_cacert = /etc/ldap/cacerts/CAcert.pem
cache_credentials = true
enumerate = true
ldap_default_bind_dn = cn=$(hostname),cn=computers,${ldap_base}
ldap_default_authtok_type = password
ldap_default_authtok = $(cat /etc/ldap.secret)
___EOF___
chmod 600 /etc/sssd/sssd.conf
/etc/init.d/sssd start
The script asks you twice for the password of the Domain-Administrator eg. root
Now check if everything works (replace UCS.EXAMPLE.COM with the FQDN of your DC):
root@test:~# ktutil
ktutil: add_entry -password -p Administrator@UCS.EXAMPLE.COM -k 1 -e aes128-cts-hmac-sha1-96
Password for Administrator@UCS.EXAMPLE.COM:
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 1 Administrator@UCS.EXAMPLE.COM
ktutil: q
root@test:~# su Administrator
Administrator@test:/root$ exit
exit
root@test:~# getent passwd Administrator
Administrator:*:2002:5000:Administrator:/home/Administrator:/bin/bash
Create any Account in your UCS-Webinterface and try to login via SSH.
There was no need for any other configuration of nsswitch.conf or PAM.
Have fun 
