sssd authentication

I'm looking to setup sssd to authenticate users against AD but have the users account and group membership be in sssd. I would then like to have sssd distribute this information to other sssd machines. This would allow a single sssd instance to manage my whole linux infrastructure.

I know this should be possible but I'm unable to find any documentation on how to setup/configure this. Maybe sssd isn't the right tool. If so what is the right tool?