ldap_id_mapping = False
            

For proper operation, this option should be specified as the lower-case version of the long version of the Active Directory domain.

The short domain name (also known as the NetBIOS or the flat name) is autodetected by the SSSD.

For proper operation, this option must be specified in all lower-case and as the fully qualified domain name of the Active Directory domain. For example:

ad_enabled_domains = sales.example.com, eng.example.com
                            

The short domain name (also known as the NetBIOS or the flat name) will be autodetected by SSSD.

Default: Not set

This is optional if autodiscovery is enabled. For more information on service discovery, refer to the “SERVICE DISCOVERY” section.

Note: Trusted domains will always auto-discover servers even if the primary server is explicitly defined in the ad_server option.

This field is used to determine the host principal in use in the keytab. It must match the hostname for which the keytab was issued.

If true and service discovery (see Service Discovery paragraph at the bottom of the man page) is enabled, the SSSD will first attempt to discover the Active Directory server to connect to using the Active Directory Site Discovery and fall back to the DNS SRV records if no AD site is found. The DNS SRV configuration, including the discovery domain, is used during site discovery as well.

Default: true

The option also supports specifying different filters per domain or forest. This extended filter would consist of: “KEYWORD:NAME:FILTER”. The keyword can be either “DOM”, “FOREST” or missing.

If the keyword equals to “DOM” or is missing, then “NAME” specifies the domain or subdomain the filter applies to. If the keyword equals to “FOREST”, then the filter equals to all domains from the forest specified by “NAME”.

Multiple filters can be separated with the “?” character, similarly to how search bases work.

Nested group membership must be searched for using a special OID “:1.2.840.113556.1.4.1941:” in addition to the full DOM:domain.example.org: syntax to ensure the parser does not attempt to interpret the colon characters associated with the OID. If you do not use this OID then nested group membership will not be resolved. See usage example below and refer here for further information about the OID: [MS-ADTS] section LDAP extensions[1]

The most specific match is always used. For example, if the option specified filter for a domain the user is a member of and a global filter, the per-domain filter would be applied. If there are more matches with the same specification, the first one is used.

Examples:

# apply filter on domain called dom1 only:
dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)
# apply filter on domain called dom2 only:
DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)
# apply filter on forest called EXAMPLE.COM only:
FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)
# apply filter for a member of a nested group in dom1:
DOM:dom1:(memberOf:1.2.840.113556.1.4.1941:=cn=nestedgroup,ou=groups,dc=example,dc=com)
                        

Default: Not set

Default: Not set

Please note that disabling Global Catalog support does not disable retrieving users from trusted domains. The SSSD would connect to the LDAP port of trusted domains instead. However, Global Catalog must be used in order to resolve cross-domain group memberships.

Default: true

GPO-based access control functionality uses GPO policy settings to determine whether or not a particular user is allowed to logon to a particular host.

NOTE: The current version of SSSD does not support host (computer) entries in the GPO 'Security Filtering' list. Only user and group entries are supported. Host entries in the list have no effect.

NOTE: If the operation mode is set to enforcing, it is possible that users that were previously allowed logon access will now be denied logon access (as dictated by the GPO policy settings). In order to facilitate a smooth transition for administrators, a permissive mode is available that will not enforce the access control rules, but will evaluate them and will output a syslog message if access would have been denied. By examining the logs, administrators can then make the necessary changes before setting the mode to enforcing.

There are three supported values for this option:

Default: enforcing

Default: False (seconds)

Default: False

Default: 5 (seconds)

Note: Using the Group Policy Management Editor this value is called "Allow log on locally" and "Deny log on locally".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “login”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_interactive = +my_pam_service, -login
                            

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “sshd”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_remote_interactive = +my_pam_service, -sshd
                            

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Access this computer from the network" and "Deny access to this computer from the network".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “ftp”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_network = +my_pam_service, -ftp
                            

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Allow log on as a batch job" and "Deny log on as a batch job".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “crond”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_batch = +my_pam_service, -crond
                            

Note: Cron service name may differ depending on Linux distribution used.

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Allow log on as a service" and "Deny log on as a service".

It is possible to add a PAM service name to the default set by using “+service_name”. Since the default set is empty, it is not possible to remove a PAM service name from the default set. For example, in order to add a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_service = +my_pam_service
                            

Default: not set

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for unconditionally permitted access (e.g. “sudo”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_permit = +my_pam_service, -sudo
                            

Default: the default set of PAM service names includes:

It is possible to add a PAM service name to the default set by using “+service_name”. Since the default set is empty, it is not possible to remove a PAM service name from the default set. For example, in order to add a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_deny = +my_pam_service
                            

Default: not set

Supported values for this option include:

Default: deny

Default: 30 days

Default: 86400:750 (24h and 15m)

Default: False

NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, the default Kerberos realm must be set properly in /etc/krb5.conf

Default: true

Default: 3600 (seconds)

Default: Use the IP addresses of the interface which is used for AD LDAP connection

Example: dyndns_iface = em1, vnet1, vnet2

Default: 86400 (24 hours)

Default: True

Default: False (let nsupdate choose the protocol)

Default: GSS-TSIG

Setting this option makes sense for environments where the DNS server is different from the identity server.

Please note that this option will be only used in fallback attempt when previous attempt using autodetected settings failed.

Default: None (let nsupdate choose the server)

%u

%U

%d

%f

%l

%P

%o

%H

%%

This option can also be set per-domain.

example:

override_homedir = /home/%u
        

Default: Not set (SSSD will use the value retrieved from LDAP)

Default: /home

To disable the creation of the configuration snippets set the parameter to 'none'.

Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)

[domain/EXAMPLE]
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
ad_server = dc1.example.com
ad_hostname = client.example.com
ad_domain = example.com

access_provider = ldap
ldap_access_order = expire
ldap_account_expire_policy = ad