What I use for Hortonworks HDP (Hadoop) systems, but should work for anyone.
Some configurations are tuned for Active Directory without relying on 'sssd-ad' such that the hosts don't need to join the domain.
sudo yum install sssd sssd-ldap sssd-krb5 sssd-tools authconfig \
oddjob oddjob-mkhomedir openldap-clients cyrus-sasl-gssapi \