Transitioning Enterprise Linux Authentication at Scale: Migrating from Commercial VAS to Native SSSD Architecture with Near-Zero Disruption

Enterprises that rely on legacy commercial Unix authentication agents face rising licensing costs, vendor lock-in, and integration friction during Linux major-version upgrades. This paper presents a systematic framework for migrating a production fleet of 8,000 Red Hat Enterprise Linux (RHEL) servers from One Identity Authentication Services (VAS) to the native, open-source System Security Services Daemon (SSSD). The framework combines an asynchronous control plane built on Python and FastAPI, idempotent Ansible roles, and a per-node state machine with automated pre-flight, validation, and rollback gates. Its central design rule is that identity must be preserved bit-for-bit: every user and group resolves to the same UID, GID, home directory, and shell before and after cutover. Across 8,000 servers migrated in four waves between February and October 2023, the approach cut the median per-host maintenance window by 82% (45 to 8 minutes), reduced authentication dropouts during cutover by 97% (126 to 4), and recorded zero identity drift and zero rollbacks. It removed $1.216 million in annual licensing fees for a one-off engineering cost of $46,000. Reference implementation (Ansible roles and control-plane API): https://github.com/balaramaa/enterprise-linux-vasd-to-sssd-migration This is a preprint and has not been peer reviewed.