# cat /lib/systemd/system/sssd.service
[Unit]
Description=System Security Services Daemon
# SSSD must be running before we permit user sessions
Before=systemd-user-sessions.service nss-user-lookup.target
Wants=nss-user-lookup.target
StartLimitIntervalSec=50s
StartLimitBurst=5
ConditionPathExists=|/etc/sssd/sssd.conf
ConditionDirectoryNotEmpty=|/etc/sssd/conf.d/
[Service]
Environment=DEBUG_LOGGER=--logger=files
EnvironmentFile=-/etc/sysconfig/sssd
ExecStartPre=+-/bin/chown -f sssd:sssd /etc/sssd/sssd.conf
ExecStartPre=+-/bin/chown -f -R sssd:sssd /etc/sssd/conf.d
ExecStartPre=+-/bin/chown -f -R sssd:sssd /etc/sssd/pki
ExecStart=/usr/sbin/sssd -i ${DEBUG_LOGGER}
Type=notify
NotifyAccess=main
Restart=on-abnormal
CapabilityBoundingSet= CAP_CHOWN CAP_DAC_OVERRIDE CAP_SETGID CAP_SETUID CAP_DAC_READ_SEARCH 
SecureBits=noroot noroot-locked
User=sssd
Group=sssd
# If service configured to be run under "root", uncomment "SupplementaryGroups"
#SupplementaryGroups=sssd
[Install]
WantedBy=multi-user.target

# augtool print /augeas//error | grep sssd.service
/augeas/files/etc/systemd/system/multi-user.target.wants/sssd.service/error = "parse_failed"
/augeas/files/etc/systemd/system/multi-user.target.wants/sssd.service/error/pos = "413"
/augeas/files/etc/systemd/system/multi-user.target.wants/sssd.service/error/line = "14"
/augeas/files/etc/systemd/system/multi-user.target.wants/sssd.service/error/char = "0"
/augeas/files/etc/systemd/system/multi-user.target.wants/sssd.service/error/lens = "/usr/share/augeas/lenses/dist/inifile.aug:497.25-.43:"
/augeas/files/etc/systemd/system/multi-user.target.wants/sssd.service/error/message = "Get did not match entire input"
/augeas/files/lib/systemd/system/sssd.service/error = "parse_failed"
/augeas/files/lib/systemd/system/sssd.service/error/pos = "413"
/augeas/files/lib/systemd/system/sssd.service/error/line = "14"
/augeas/files/lib/systemd/system/sssd.service/error/char = "0"
/augeas/files/lib/systemd/system/sssd.service/error/lens = "/usr/share/augeas/lenses/dist/inifile.aug:497.25-.43:"
/augeas/files/lib/systemd/system/sssd.service/error/message = "Get did not match entire input"