1SSSD-LDAP(5) File Formats and Conventions SSSD-LDAP(5)
2
6 sssd-ldap - SSSD LDAP provider
7
9 This manual page describes the configuration of LDAP domains for
10 sssd(8). Refer to the “FILE FORMAT” section of the sssd.conf(5) manual
11 page for detailed syntax information.
12 You can configure SSSD to use more than one LDAP domain.
14 LDAP back end supports id, auth, access and chpass providers. If you
16 want to authenticate against an LDAP server either TLS/SSL or LDAPS is
17 required. sssd does not support authentication over an unencrypted
18 channel. If the LDAP server is used only as an identity provider, an
19 encrypted channel is not needed. Please refer to “ldap_access_filter”
20 config option for more information about using LDAP as an access
21 provider.
22
24 All of the common configuration options that apply to SSSD domains also
25 apply to LDAP domains. Refer to the “DOMAIN SECTIONS” section of the
26 sssd.conf(5) manual page for full details.
27 ldap_uri, ldap_backup_uri (string)
29 Specifies the comma-separated list of URIs of the LDAP servers to
30 which SSSD should connect in the order of preference. Refer to the
31 “FAILOVER” section for more information on failover and server
32 redundancy. If neither option is specified, service discovery is
33 enabled. For more information, refer to the “SERVICE DISCOVERY”
34 section.
35 The format of the URI must match the format defined in RFC 2732:
37 ldap[s]://<host>[:port]
39 For explicit IPv6 addresses, <host> must be enclosed in brackets []
41 example: ldap://[fc00::126:25]:389
43 ldap_chpass_uri, ldap_chpass_backup_uri (string)
45 Specifies the comma-separated list of URIs of the LDAP servers to
46 which SSSD should connect in the order of preference to change the
47 password of a user. Refer to the “FAILOVER” section for more
48 information on failover and server redundancy.
49 To enable service discovery ldap_chpass_dns_service_name must be
51 set.
52 Default: empty, i.e. ldap_uri is used.
54 ldap_search_base (string)
56 The default base DN to use for performing LDAP user operations.
57 Starting with SSSD 1.7.0, SSSD supports multiple search bases using
59 the syntax:
60 search_base[?scope?[filter][?search_base?scope?[filter]]*]
62 The scope can be one of "base", "onelevel" or "subtree".
64 The filter must be a valid LDAP search filter as specified by
66 http://www.ietf.org/rfc/rfc2254.txt
67 Examples:
69 ldap_search_base = dc=example,dc=com (which is equivalent to)
71 ldap_search_base = dc=example,dc=com?subtree?
72 ldap_search_base =
74 cn=host_specific,dc=example,dc=com?subtree?(host=thishost)?dc=example.com?subtree?
75 Note: It is unsupported to have multiple search bases which
77 reference identically-named objects (for example, groups with the
78 same name in two different search bases). This will lead to
79 unpredictable behavior on client machines.
80 Default: If not set, the value of the defaultNamingContext or
82 namingContexts attribute from the RootDSE of the LDAP server is
83 used. If defaultNamingContext does not exist or has an empty value
84 namingContexts is used. The namingContexts attribute must have a
85 single value with the DN of the search base of the LDAP server to
86 make this work. Multiple values are are not supported.
87 ldap_schema (string)
89 Specifies the Schema Type in use on the target LDAP server.
90 Depending on the selected schema, the default attribute names
91 retrieved from the servers may vary. The way that some attributes
92 are handled may also differ.
93 Four schema types are currently supported:
95 · rfc2307
97 · rfc2307bis
99 · IPA
101 · AD
103 The main difference between these schema types is how group
105 memberships are recorded in the server. With rfc2307, group members
106 are listed by name in the memberUid attribute. With rfc2307bis and
107 IPA, group members are listed by DN and stored in the member
108 attribute. The AD schema type sets the attributes to correspond
109 with Active Directory 2008r2 values.
110 Default: rfc2307
112 ldap_pwmodify_mode (string)
114 Specify the operation that is used to modify user password.
115 Two modes are currently supported:
117 · exop - Password Modify Extended Operation (RFC 3062)
119 · ldap_modify - Direct modification of userPassword (not
121 recommended).
122 Note: First, a new connection is established to verify current
124 password by binding as the user that requested password change. If
125 successful, this connection is used to change the password
126 therefore the user must have write access to userPassword
127 attribute.
128 Default: exop
130 ldap_default_bind_dn (string)
132 The default bind DN to use for performing LDAP operations.
133 ldap_default_authtok_type (string)
135 The type of the authentication token of the default bind DN.
136 The two mechanisms currently supported are:
138 password
140 obfuscated_password
142 Default: password
144 ldap_default_authtok (string)
146 The authentication token of the default bind DN. Only clear text
147 passwords are currently supported.
148 ldap_user_object_class (string)
150 The object class of a user entry in LDAP.
151 Default: posixAccount
153 ldap_user_name (string)
155 The LDAP attribute that corresponds to the user's login name.
156 Default: uid (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)
158 ldap_user_uid_number (string)
160 The LDAP attribute that corresponds to the user's id.
161 Default: uidNumber
163 ldap_user_gid_number (string)
165 The LDAP attribute that corresponds to the user's primary group id.
166 Default: gidNumber
168 ldap_user_primary_group (string)
170 Active Directory primary group attribute for ID-mapping. Note that
171 this attribute should only be set manually if you are running the
172 “ldap” provider with ID mapping.
173 Default: unset (LDAP), primaryGroupID (AD)
175 ldap_user_gecos (string)
177 The LDAP attribute that corresponds to the user's gecos field.
178 Default: gecos
180 ldap_user_home_directory (string)
182 The LDAP attribute that contains the name of the user's home
183 directory.
184 Default: homeDirectory (LDAP and IPA), unixHomeDirectory (AD)
186 ldap_user_shell (string)
188 The LDAP attribute that contains the path to the user's default
189 shell.
190 Default: loginShell
192 ldap_user_uuid (string)
194 The LDAP attribute that contains the UUID/GUID of an LDAP user
195 object.
196 Default: not set in the general case, objectGUID for AD and
198 ipaUniqueID for IPA
199 ldap_user_objectsid (string)
201 The LDAP attribute that contains the objectSID of an LDAP user
202 object. This is usually only necessary for ActiveDirectory servers.
203 Default: objectSid for ActiveDirectory, not set for other servers.
205 ldap_user_modify_timestamp (string)
207 The LDAP attribute that contains timestamp of the last modification
208 of the parent object.
209 Default: modifyTimestamp
211 ldap_user_shadow_last_change (string)
213 When using ldap_pwd_policy=shadow, this parameter contains the name
214 of an LDAP attribute corresponding to its shadow(5) counterpart
215 (date of the last password change).
216 Default: shadowLastChange
218 ldap_user_shadow_min (string)
220 When using ldap_pwd_policy=shadow, this parameter contains the name
221 of an LDAP attribute corresponding to its shadow(5) counterpart
222 (minimum password age).
223 Default: shadowMin
225 ldap_user_shadow_max (string)
227 When using ldap_pwd_policy=shadow, this parameter contains the name
228 of an LDAP attribute corresponding to its shadow(5) counterpart
229 (maximum password age).
230 Default: shadowMax
232 ldap_user_shadow_warning (string)
234 When using ldap_pwd_policy=shadow, this parameter contains the name
235 of an LDAP attribute corresponding to its shadow(5) counterpart
236 (password warning period).
237 Default: shadowWarning
239 ldap_user_shadow_inactive (string)
241 When using ldap_pwd_policy=shadow, this parameter contains the name
242 of an LDAP attribute corresponding to its shadow(5) counterpart
243 (password inactivity period).
244 Default: shadowInactive
246 ldap_user_shadow_expire (string)
248 When using ldap_pwd_policy=shadow or
249 ldap_account_expire_policy=shadow, this parameter contains the name
250 of an LDAP attribute corresponding to its shadow(5) counterpart
251 (account expiration date).
252 Default: shadowExpire
254 ldap_user_krb_last_pwd_change (string)
256 When using ldap_pwd_policy=mit_kerberos, this parameter contains
257 the name of an LDAP attribute storing the date and time of last
258 password change in kerberos.
259 Default: krbLastPwdChange
261 ldap_user_krb_password_expiration (string)
263 When using ldap_pwd_policy=mit_kerberos, this parameter contains
264 the name of an LDAP attribute storing the date and time when
265 current password expires.
266 Default: krbPasswordExpiration
268 ldap_user_ad_account_expires (string)
270 When using ldap_account_expire_policy=ad, this parameter contains
271 the name of an LDAP attribute storing the expiration time of the
272 account.
273 Default: accountExpires
275 ldap_user_ad_user_account_control (string)
277 When using ldap_account_expire_policy=ad, this parameter contains
278 the name of an LDAP attribute storing the user account control bit
279 field.
280 Default: userAccountControl
282 ldap_ns_account_lock (string)
284 When using ldap_account_expire_policy=rhds or equivalent, this
285 parameter determines if access is allowed or not.
286 Default: nsAccountLock
288 ldap_user_nds_login_disabled (string)
290 When using ldap_account_expire_policy=nds, this attribute
291 determines if access is allowed or not.
292 Default: loginDisabled
294 ldap_user_nds_login_expiration_time (string)
296 When using ldap_account_expire_policy=nds, this attribute
297 determines until which date access is granted.
298 Default: loginDisabled
300 ldap_user_nds_login_allowed_time_map (string)
302 When using ldap_account_expire_policy=nds, this attribute
303 determines the hours of a day in a week when access is granted.
304 Default: loginAllowedTimeMap
306 ldap_user_principal (string)
308 The LDAP attribute that contains the user's Kerberos User Principal
309 Name (UPN).
310 Default: krbPrincipalName
312 ldap_user_extra_attrs (string)
314 Comma-separated list of LDAP attributes that SSSD would fetch along
315 with the usual set of user attributes.
316 The list can either contain LDAP attribute names only, or
318 colon-separated tuples of SSSD cache attribute name and LDAP
319 attribute name. In case only LDAP attribute name is specified, the
320 attribute is saved to the cache verbatim. Using a custom SSSD
321 attribute name might be required by environments that configure
322 several SSSD domains with different LDAP schemas.
323 Please note that several attribute names are reserved by SSSD,
325 notably the “name” attribute. SSSD would report an error if any of
326 the reserved attribute names is used as an extra attribute name.
327 Examples:
329 ldap_user_extra_attrs = telephoneNumber
331 Save the “telephoneNumber” attribute from LDAP as “telephoneNumber”
333 to the cache.
334 ldap_user_extra_attrs = phone:telephoneNumber
336 Save the “telephoneNumber” attribute from LDAP as “phone” to the
338 cache.
339 Default: not set
341 ldap_user_ssh_public_key (string)
343 The LDAP attribute that contains the user's SSH public keys.
344 Default: sshPublicKey
346 ldap_force_upper_case_realm (boolean)
348 Some directory servers, for example Active Directory, might deliver
349 the realm part of the UPN in lower case, which might cause the
350 authentication to fail. Set this option to a non-zero value if you
351 want to use an upper-case realm.
352 Default: false
354 ldap_enumeration_refresh_timeout (integer)
356 Specifies how many seconds SSSD has to wait before refreshing its
357 cache of enumerated records.
358 Default: 300
360 ldap_purge_cache_timeout (integer)
362 Determine how often to check the cache for inactive entries (such
363 as groups with no members and users who have never logged in) and
364 remove them to save space.
365 Setting this option to zero will disable the cache cleanup
367 operation. Please note that if enumeration is enabled, the cleanup
368 task is required in order to detect entries removed from the server
369 and can't be disabled. By default, the cleanup task will run every
370 3 hours with enumeration enabled.
371 Default: 0 (disabled)
373 ldap_user_fullname (string)
375 The LDAP attribute that corresponds to the user's full name.
376 Default: cn
378 ldap_user_member_of (string)
380 The LDAP attribute that lists the user's group memberships.
381 Default: memberOf
383 ldap_user_authorized_service (string)
385 If access_provider=ldap and ldap_access_order=authorized_service,
386 SSSD will use the presence of the authorizedService attribute in
387 the user's LDAP entry to determine access privilege.
388 An explicit deny (!svc) is resolved first. Second, SSSD searches
390 for explicit allow (svc) and finally for allow_all (*).
391 Please note that the ldap_access_order configuration option must
393 include “authorized_service” in order for the
394 ldap_user_authorized_service option to work.
395 Some distributions (such as Fedora-29+ or RHEL-8) always include
397 the “systemd-user” PAM service as part of the login process.
398 Therefore when using service-based access control, the
399 “systemd-user” service might need to be added to the list of
400 allowed services.
401 Default: authorizedService
403 ldap_user_authorized_host (string)
405 If access_provider=ldap and ldap_access_order=host, SSSD will use
406 the presence of the host attribute in the user's LDAP entry to
407 determine access privilege.
408 An explicit deny (!host) is resolved first. Second, SSSD searches
410 for explicit allow (host) and finally for allow_all (*).
411 Please note that the ldap_access_order configuration option must
413 include “host” in order for the ldap_user_authorized_host option to
414 work.
415 Default: host
417 ldap_user_authorized_rhost (string)
419 If access_provider=ldap and ldap_access_order=rhost, SSSD will use
420 the presence of the rhost attribute in the user's LDAP entry to
421 determine access privilege. Similarly to host verification process.
422 An explicit deny (!rhost) is resolved first. Second, SSSD searches
424 for explicit allow (rhost) and finally for allow_all (*).
425 Please note that the ldap_access_order configuration option must
427 include “rhost” in order for the ldap_user_authorized_rhost option
428 to work.
429 Default: rhost
431 ldap_user_certificate (string)
433 Name of the LDAP attribute containing the X509 certificate of the
434 user.
435 Default: userCertificate;binary
437 ldap_user_email (string)
439 Name of the LDAP attribute containing the email address of the
440 user.
441 Note: If an email address of a user conflicts with an email address
443 or fully qualified name of another user, then SSSD will not be able
444 to serve those users properly. If for some reason several users
445 need to share the same email address then set this option to a
446 nonexistent attribute name in order to disable user lookup/login by
447 email.
448 Default: mail
450 ldap_group_object_class (string)
452 The object class of a group entry in LDAP.
453 Default: posixGroup
455 ldap_group_name (string)
457 The LDAP attribute that corresponds to the group name.
458 Default: cn (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)
460 ldap_group_gid_number (string)
462 The LDAP attribute that corresponds to the group's id.
463 Default: gidNumber
465 ldap_group_member (string)
467 The LDAP attribute that contains the names of the group's members.
468 Default: memberuid (rfc2307) / member (rfc2307bis)
470 ldap_group_uuid (string)
472 The LDAP attribute that contains the UUID/GUID of an LDAP group
473 object.
474 Default: not set in the general case, objectGUID for AD and
476 ipaUniqueID for IPA
477 ldap_group_objectsid (string)
479 The LDAP attribute that contains the objectSID of an LDAP group
480 object. This is usually only necessary for ActiveDirectory servers.
481 Default: objectSid for ActiveDirectory, not set for other servers.
483 ldap_group_modify_timestamp (string)
485 The LDAP attribute that contains timestamp of the last modification
486 of the parent object.
487 Default: modifyTimestamp
489 ldap_group_type (integer)
491 The LDAP attribute that contains an integer value indicating the
492 type of the group and maybe other flags.
493 This attribute is currently only used by the AD provider to
495 determine if a group is a domain local groups and has to be
496 filtered out for trusted domains.
497 Default: groupType in the AD provider, otherwise not set
499 ldap_group_external_member (string)
501 The LDAP attribute that references group members that are defined
502 in an external domain. At the moment, only IPA's external members
503 are supported.
504 Default: ipaExternalMember in the IPA provider, otherwise unset.
506 ldap_group_nesting_level (integer)
508 If ldap_schema is set to a schema format that supports nested
509 groups (e.g. RFC2307bis), then this option controls how many levels
510 of nesting SSSD will follow. This option has no effect on the
511 RFC2307 schema.
512 Note: This option specifies the guaranteed level of nested groups
514 to be processed for any lookup. However, nested groups beyond this
515 limit may be returned if previous lookups already resolved the
516 deeper nesting levels. Also, subsequent lookups for other groups
517 may enlarge the result set for original lookup if re-queried.
518 If ldap_group_nesting_level is set to 0 then no nested groups are
520 processed at all. However, when connected to Active-Directory
521 Server 2008 and later using “id_provider=ad” it is furthermore
522 required to disable usage of Token-Groups by setting
523 ldap_use_tokengroups to false in order to restrict group nesting.
524 Default: 2
526 ldap_use_tokengroups
528 This options enables or disables use of Token-Groups attribute when
529 performing initgroup for users from Active Directory Server 2008
530 and later.
531 Default: True for AD and IPA otherwise False.
533 ldap_netgroup_object_class (string)
535 The object class of a netgroup entry in LDAP.
536 In IPA provider, ipa_netgroup_object_class should be used instead.
538 Default: nisNetgroup
540 ldap_netgroup_name (string)
542 The LDAP attribute that corresponds to the netgroup name.
543 In IPA provider, ipa_netgroup_name should be used instead.
545 Default: cn
547 ldap_netgroup_member (string)
549 The LDAP attribute that contains the names of the netgroup's
550 members.
551 In IPA provider, ipa_netgroup_member should be used instead.
553 Default: memberNisNetgroup
555 ldap_netgroup_triple (string)
557 The LDAP attribute that contains the (host, user, domain) netgroup
558 triples.
559 This option is not available in IPA provider.
561 Default: nisNetgroupTriple
563 ldap_netgroup_modify_timestamp (string)
565 The LDAP attribute that contains timestamp of the last modification
566 of the parent object.
567 This option is not available in IPA provider.
569 Default: modifyTimestamp
571 ldap_host_object_class (string)
573 The object class of a host entry in LDAP.
574 Default: ipService
576 ldap_host_name (string)
578 The LDAP attribute that corresponds to the host's name.
579 Default: cn
581 ldap_host_fqdn (string)
583 The LDAP attribute that corresponds to the host's fully-qualified
584 domain name.
585 Default: fqdn
587 ldap_host_serverhostname (string)
589 The LDAP attribute that corresponds to the host's name.
590 Default: serverHostname
592 ldap_host_member_of (string)
594 The LDAP attribute that lists the host's group memberships.
595 Default: memberOf
597 ldap_host_search_base (string)
599 Optional. Use the given string as search base for host objects.
600 See “ldap_search_base” for information about configuring multiple
602 search bases.
603 Default: the value of ldap_search_base
605 ldap_host_ssh_public_key (string)
607 The LDAP attribute that contains the host's SSH public keys.
608 Default: sshPublicKey
610 ldap_host_uuid (string)
612 The LDAP attribute that contains the UUID/GUID of an LDAP host
613 object.
614 Default: not set
616 ldap_service_object_class (string)
618 The object class of a service entry in LDAP.
619 Default: ipService
621 ldap_service_name (string)
623 The LDAP attribute that contains the name of service attributes and
624 their aliases.
625 Default: cn
627 ldap_service_port (string)
629 The LDAP attribute that contains the port managed by this service.
630 Default: ipServicePort
632 ldap_service_proto (string)
634 The LDAP attribute that contains the protocols understood by this
635 service.
636 Default: ipServiceProtocol
638 ldap_service_search_base (string)
640 An optional base DN, search scope and LDAP filter to restrict LDAP
641 searches for this attribute type.
642 syntax:
644 search_base[?scope?[filter][?search_base?scope?[filter]]*]
646 The scope can be one of "base", "onelevel" or "subtree". The scope
648 functions as specified in section 4.5.1.2 of
649 http://tools.ietf.org/html/rfc4511
650 The filter must be a valid LDAP search filter as specified by
652 http://www.ietf.org/rfc/rfc2254.txt
653 For examples of this syntax, please refer to the “ldap_search_base”
655 examples section.
656 Default: the value of ldap_search_base
658 Please note that specifying scope or filter is not supported for
660 searches against an Active Directory Server that might yield a
661 large number of results and trigger the Range Retrieval extension
662 in the response.
663 ldap_search_timeout (integer)
665 Specifies the timeout (in seconds) that ldap searches are allowed
666 to run before they are cancelled and cached results are returned
667 (and offline mode is entered)
668 Note: this option is subject to change in future versions of the
670 SSSD. It will likely be replaced at some point by a series of
671 timeouts for specific lookup types.
672 Default: 6
674 ldap_enumeration_search_timeout (integer)
676 Specifies the timeout (in seconds) that ldap searches for user and
677 group enumerations are allowed to run before they are cancelled and
678 cached results are returned (and offline mode is entered)
679 Default: 60
681 ldap_network_timeout (integer)
683 Specifies the timeout (in seconds) after which the
684 poll(2)/select(2) following a connect(2) returns in case of no
685 activity.
686 Default: 6
688 ldap_opt_timeout (integer)
690 Specifies a timeout (in seconds) after which calls to synchronous
691 LDAP APIs will abort if no response is received. Also controls the
692 timeout when communicating with the KDC in case of SASL bind, the
693 timeout of an LDAP bind operation, password change extended
694 operation and the StartTLS operation.
695 Default: 8
697 ldap_connection_expire_timeout (integer)
699 Specifies a timeout (in seconds) that a connection to an LDAP
700 server will be maintained. After this time, the connection will be
701 re-established. If used in parallel with SASL/GSSAPI, the sooner of
702 the two values (this value vs. the TGT lifetime) will be used.
703 Default: 900 (15 minutes)
705 ldap_page_size (integer)
707 Specify the number of records to retrieve from LDAP in a single
708 request. Some LDAP servers enforce a maximum limit per-request.
709 Default: 1000
711 ldap_disable_paging (boolean)
713 Disable the LDAP paging control. This option should be used if the
714 LDAP server reports that it supports the LDAP paging control in its
715 RootDSE but it is not enabled or does not behave properly.
716 Example: OpenLDAP servers with the paging control module installed
718 on the server but not enabled will report it in the RootDSE but be
719 unable to use it.
720 Example: 389 DS has a bug where it can only support a one paging
722 control at a time on a single connection. On busy clients, this can
723 result in some requests being denied.
724 Default: False
726 ldap_disable_range_retrieval (boolean)
728 Disable Active Directory range retrieval.
729 Active Directory limits the number of members to be retrieved in a
731 single lookup using the MaxValRange policy (which defaults to 1500
732 members). If a group contains more members, the reply would include
733 an AD-specific range extension. This option disables parsing of the
734 range extension, therefore large groups will appear as having no
735 members.
736 Default: False
738 ldap_sasl_minssf (integer)
740 When communicating with an LDAP server using SASL, specify the
741 minimum security level necessary to establish the connection. The
742 values of this option are defined by OpenLDAP.
743 Default: Use the system default (usually specified by ldap.conf)
745 ldap_deref_threshold (integer)
747 Specify the number of group members that must be missing from the
748 internal cache in order to trigger a dereference lookup. If less
749 members are missing, they are looked up individually.
750 You can turn off dereference lookups completely by setting the
752 value to 0. Please note that there are some codepaths in SSSD, like
753 the IPA HBAC provider, that are only implemented using the
754 dereference call, so even with dereference explicitly disabled,
755 those parts will still use dereference if the server supports it
756 and advertises the dereference control in the rootDSE object.
757 A dereference lookup is a means of fetching all group members in a
759 single LDAP call. Different LDAP servers may implement different
760 dereference methods. The currently supported servers are 389/RHDS,
761 OpenLDAP and Active Directory.
762 Note: If any of the search bases specifies a search filter, then
764 the dereference lookup performance enhancement will be disabled
765 regardless of this setting.
766 Default: 10
768 ldap_tls_reqcert (string)
770 Specifies what checks to perform on server certificates in a TLS
771 session, if any. It can be specified as one of the following
772 values:
773 never = The client will not request or check any server
775 certificate.
776 allow = The server certificate is requested. If no certificate is
778 provided, the session proceeds normally. If a bad certificate is
779 provided, it will be ignored and the session proceeds normally.
780 try = The server certificate is requested. If no certificate is
782 provided, the session proceeds normally. If a bad certificate is
783 provided, the session is immediately terminated.
784 demand = The server certificate is requested. If no certificate is
786 provided, or a bad certificate is provided, the session is
787 immediately terminated.
788 hard = Same as “demand”
790 Default: hard
792 ldap_tls_cacert (string)
794 Specifies the file that contains certificates for all of the
795 Certificate Authorities that sssd will recognize.
796 Default: use OpenLDAP defaults, typically in
798 /etc/openldap/ldap.conf
799 ldap_tls_cacertdir (string)
801 Specifies the path of a directory that contains Certificate
802 Authority certificates in separate individual files. Typically the
803 file names need to be the hash of the certificate followed by '.0'.
804 If available, cacertdir_rehash can be used to create the correct
805 names.
806 Default: use OpenLDAP defaults, typically in
808 /etc/openldap/ldap.conf
809 ldap_tls_cert (string)
811 Specifies the file that contains the certificate for the client's
812 key.
813 Default: not set
815 ldap_tls_key (string)
817 Specifies the file that contains the client's key.
818 Default: not set
820 ldap_tls_cipher_suite (string)
822 Specifies acceptable cipher suites. Typically this is a colon
823 separated list. See ldap.conf(5) for format.
824 Default: use OpenLDAP defaults, typically in
826 /etc/openldap/ldap.conf
827 ldap_id_use_start_tls (boolean)
829 Specifies that the id_provider connection must also use tls to
830 protect the channel.
831 Default: false
833 ldap_id_mapping (boolean)
835 Specifies that SSSD should attempt to map user and group IDs from
836 the ldap_user_objectsid and ldap_group_objectsid attributes instead
837 of relying on ldap_user_uid_number and ldap_group_gid_number.
838 Currently this feature supports only ActiveDirectory objectSID
840 mapping.
841 Default: false
843 ldap_min_id, ldap_max_id (integer)
845 In contrast to the SID based ID mapping which is used if
846 ldap_id_mapping is set to true the allowed ID range for
847 ldap_user_uid_number and ldap_group_gid_number is unbound. In a
848 setup with sub/trusted-domains this might lead to ID collisions. To
849 avoid collisions ldap_min_id and ldap_max_id can be set to restrict
850 the allowed range for the IDs which are read directly from the
851 server. Sub-domains can then pick other ranges to map IDs.
852 Default: not set (both options are set to 0)
854 ldap_sasl_mech (string)
856 Specify the SASL mechanism to use. Currently only GSSAPI and
857 GSS-SPNEGO are tested and supported.
858 If the backend supports sub-domains the value of ldap_sasl_mech is
860 automatically inherited to the sub-domains. If a different value is
861 needed for a sub-domain it can be overwritten by setting
862 ldap_sasl_mech for this sub-domain explicitly. Please see TRUSTED
863 DOMAIN SECTION in sssd.conf(5) for details.
864 Default: not set
866 ldap_sasl_authid (string)
868 Specify the SASL authorization id to use. When GSSAPI/GSS-SPNEGO
869 are used, this represents the Kerberos principal used for
870 authentication to the directory. This option can either contain the
871 full principal (for example host/myhost@EXAMPLE.COM) or just the
872 principal name (for example host/myhost). By default, the value is
873 not set and the following principals are used:
874 hostname@REALM
876 netbiosname$@REALM
877 host/hostname@REALM
878 *$@REALM
879 host/*@REALM
880 host/*
881 If none of them are found, the first principal in keytab is
884 returned.
885 Default: host/hostname@REALM
887 ldap_sasl_realm (string)
889 Specify the SASL realm to use. When not specified, this option
890 defaults to the value of krb5_realm. If the ldap_sasl_authid
891 contains the realm as well, this option is ignored.
892 Default: the value of krb5_realm.
894 ldap_sasl_canonicalize (boolean)
896 If set to true, the LDAP library would perform a reverse lookup to
897 canonicalize the host name during a SASL bind.
898 Default: false;
900 ldap_krb5_keytab (string)
902 Specify the keytab to use when using SASL/GSSAPI/GSS-SPNEGO.
903 Default: System keytab, normally /etc/krb5.keytab
905 ldap_krb5_init_creds (boolean)
907 Specifies that the id_provider should init Kerberos credentials
908 (TGT). This action is performed only if SASL is used and the
909 mechanism selected is GSSAPI or GSS-SPNEGO.
910 Default: true
912 ldap_krb5_ticket_lifetime (integer)
914 Specifies the lifetime in seconds of the TGT if GSSAPI or
915 GSS-SPNEGO is used.
916 Default: 86400 (24 hours)
918 krb5_server, krb5_backup_server (string)
920 Specifies the comma-separated list of IP addresses or hostnames of
921 the Kerberos servers to which SSSD should connect in the order of
922 preference. For more information on failover and server redundancy,
923 see the “FAILOVER” section. An optional port number (preceded by a
924 colon) may be appended to the addresses or hostnames. If empty,
925 service discovery is enabled - for more information, refer to the
926 “SERVICE DISCOVERY” section.
927 When using service discovery for KDC or kpasswd servers, SSSD first
929 searches for DNS entries that specify _udp as the protocol and
930 falls back to _tcp if none are found.
931 This option was named “krb5_kdcip” in earlier releases of SSSD.
933 While the legacy name is recognized for the time being, users are
934 advised to migrate their config files to use “krb5_server” instead.
935 krb5_realm (string)
937 Specify the Kerberos REALM (for SASL/GSSAPI/GSS-SPNEGO auth).
938 Default: System defaults, see /etc/krb5.conf
940 krb5_canonicalize (boolean)
942 Specifies if the host principal should be canonicalized when
943 connecting to LDAP server. This feature is available with MIT
944 Kerberos >= 1.7
945 Default: false
947 krb5_use_kdcinfo (boolean)
949 Specifies if the SSSD should instruct the Kerberos libraries what
950 realm and which KDCs to use. This option is on by default, if you
951 disable it, you need to configure the Kerberos library using the
952 krb5.conf(5) configuration file.
953 See the sssd_krb5_locator_plugin(8) manual page for more
955 information on the locator plugin.
956 Default: true
958 ldap_pwd_policy (string)
960 Select the policy to evaluate the password expiration on the client
961 side. The following values are allowed:
962 none - No evaluation on the client side. This option cannot disable
964 server-side password policies.
965 shadow - Use shadow(5) style attributes to evaluate if the password
967 has expired.
968 mit_kerberos - Use the attributes used by MIT Kerberos to determine
970 if the password has expired. Use chpass_provider=krb5 to update
971 these attributes when the password is changed.
972 Default: none
974 Note: if a password policy is configured on server side, it always
976 takes precedence over policy set with this option.
977 ldap_referrals (boolean)
979 Specifies whether automatic referral chasing should be enabled.
980 Please note that sssd only supports referral chasing when it is
982 compiled with OpenLDAP version 2.4.13 or higher.
983 Chasing referrals may incur a performance penalty in environments
985 that use them heavily, a notable example is Microsoft Active
986 Directory. If your setup does not in fact require the use of
987 referrals, setting this option to false might bring a noticeable
988 performance improvement.
989 Default: true
991 ldap_dns_service_name (string)
993 Specifies the service name to use when service discovery is
994 enabled.
995 Default: ldap
997 ldap_chpass_dns_service_name (string)
999 Specifies the service name to use to find an LDAP server which
1000 allows password changes when service discovery is enabled.
1001 Default: not set, i.e. service discovery is disabled
1003 ldap_chpass_update_last_change (bool)
1005 Specifies whether to update the ldap_user_shadow_last_change
1006 attribute with days since the Epoch after a password change
1007 operation.
1008 Default: False
1010 ldap_access_filter (string)
1012 If using access_provider = ldap and ldap_access_order = filter
1013 (default), this option is mandatory. It specifies an LDAP search
1014 filter criteria that must be met for the user to be granted access
1015 on this host. If access_provider = ldap, ldap_access_order = filter
1016 and this option is not set, it will result in all users being
1017 denied access. Use access_provider = permit to change this default
1018 behavior. Please note that this filter is applied on the LDAP user
1019 entry only and thus filtering based on nested groups may not work
1020 (e.g. memberOf attribute on AD entries points only to direct
1021 parents). If filtering based on nested groups is required, please
1022 see sssd-simple(5).
1023 Example:
1025 access_provider = ldap
1027 ldap_access_filter = (employeeType=admin)
1028 This example means that access to this host is restricted to users
1031 whose employeeType attribute is set to "admin".
1032 Offline caching for this feature is limited to determining whether
1034 the user's last online login was granted access permission. If they
1035 were granted access during their last login, they will continue to
1036 be granted access while offline and vice versa.
1037 Default: Empty
1039 ldap_account_expire_policy (string)
1041 With this option a client side evaluation of access control
1042 attributes can be enabled.
1043 Please note that it is always recommended to use server side access
1045 control, i.e. the LDAP server should deny the bind request with a
1046 suitable error code even if the password is correct.
1047 The following values are allowed:
1049 shadow: use the value of ldap_user_shadow_expire to determine if
1051 the account is expired.
1052 ad: use the value of the 32bit field
1054 ldap_user_ad_user_account_control and allow access if the second
1055 bit is not set. If the attribute is missing access is granted. Also
1056 the expiration time of the account is checked.
1057 rhds, ipa, 389ds: use the value of ldap_ns_account_lock to check if
1059 access is allowed or not.
1060 nds: the values of ldap_user_nds_login_allowed_time_map,
1062 ldap_user_nds_login_disabled and
1063 ldap_user_nds_login_expiration_time are used to check if access is
1064 allowed. If both attributes are missing access is granted.
1065 This is an experimental feature, please use
1066 https://pagure.io/SSSD/sssd/ to report any issues.
1067 Please note that the ldap_access_order configuration option must
1069 include “expire” in order for the ldap_account_expire_policy option
1070 to work.
1071 Default: Empty
1073 ldap_access_order (string)
1075 Comma separated list of access control options. Allowed values are:
1076 filter: use ldap_access_filter
1078 lockout: use account locking. If set, this option denies access in
1080 case that ldap attribute 'pwdAccountLockedTime' is present and has
1081 value of '000001010000Z'. Please see the option ldap_pwdlockout_dn.
1082 Please note that 'access_provider = ldap' must be set for this
1083 feature to work.
1084 Please note that this option is superseded by the “ppolicy” option
1086 and might be removed in a future release.
1087 ppolicy: use account locking. If set, this option denies access in
1089 case that ldap attribute 'pwdAccountLockedTime' is present and has
1090 value of '000001010000Z' or represents any time in the past. The
1091 value of the 'pwdAccountLockedTime' attribute must end with 'Z',
1092 which denotes the UTC time zone. Other time zones are not currently
1093 supported and will result in "access-denied" when users attempt to
1094 log in. Please see the option ldap_pwdlockout_dn. Please note that
1095 'access_provider = ldap' must be set for this feature to work.
1096 expire: use ldap_account_expire_policy
1098 pwd_expire_policy_reject, pwd_expire_policy_warn,
1100 pwd_expire_policy_renew: These options are useful if users are
1101 interested in being warned that password is about to expire and
1102 authentication is based on using a different method than passwords
1103 - for example SSH keys.
1104 The difference between these options is the action taken if user
1106 password is expired: pwd_expire_policy_reject - user is denied to
1107 log in, pwd_expire_policy_warn - user is still able to log in,
1108 pwd_expire_policy_renew - user is prompted to change his password
1109 immediately.
1110 Note If user password is expired no explicit message is prompted by
1112 SSSD.
1113 Please note that 'access_provider = ldap' must be set for this
1115 feature to work. Also 'ldap_pwd_policy' must be set to an
1116 appropriate password policy.
1117 authorized_service: use the authorizedService attribute to
1119 determine access
1120 host: use the host attribute to determine access
1122 rhost: use the rhost attribute to determine whether remote host can
1124 access
1125 Please note, rhost field in pam is set by application, it is better
1127 to check what the application sends to pam, before enabling this
1128 access control option
1129 Default: filter
1131 Please note that it is a configuration error if a value is used
1133 more than once.
1134 ldap_pwdlockout_dn (string)
1136 This option specifies the DN of password policy entry on LDAP
1137 server. Please note that absence of this option in sssd.conf in
1138 case of enabled account lockout checking will yield access denied
1139 as ppolicy attributes on LDAP server cannot be checked properly.
1140 Example: cn=ppolicy,ou=policies,dc=example,dc=com
1142 Default: cn=ppolicy,ou=policies,$ldap_search_base
1144 ldap_deref (string)
1146 Specifies how alias dereferencing is done when performing a search.
1147 The following options are allowed:
1148 never: Aliases are never dereferenced.
1150 searching: Aliases are dereferenced in subordinates of the base
1152 object, but not in locating the base object of the search.
1153 finding: Aliases are only dereferenced when locating the base
1155 object of the search.
1156 always: Aliases are dereferenced both in searching and in locating
1158 the base object of the search.
1159 Default: Empty (this is handled as never by the LDAP client
1161 libraries)
1162 ldap_rfc2307_fallback_to_local_users (boolean)
1164 Allows to retain local users as members of an LDAP group for
1165 servers that use the RFC2307 schema.
1166 In some environments where the RFC2307 schema is used, local users
1168 are made members of LDAP groups by adding their names to the
1169 memberUid attribute. The self-consistency of the domain is
1170 compromised when this is done, so SSSD would normally remove the
1171 "missing" users from the cached group memberships as soon as
1172 nsswitch tries to fetch information about the user via getpw*() or
1173 initgroups() calls.
1174 This option falls back to checking if local users are referenced,
1176 and caches them so that later initgroups() calls will augment the
1177 local users with the additional LDAP groups.
1178 Default: false
1180 wildcard_limit (integer)
1182 Specifies an upper limit on the number of entries that are
1183 downloaded during a wildcard lookup.
1184 At the moment, only the InfoPipe responder supports wildcard
1186 lookups.
1187 Default: 1000 (often the size of one page)
1189
1191 The detailed instructions for configuration of sudo_provider are in the
1192 manual page sssd-sudo(5).
1193 ldap_sudorule_object_class (string)
1195 The object class of a sudo rule entry in LDAP.
1196 Default: sudoRole
1198 ldap_sudorule_name (string)
1200 The LDAP attribute that corresponds to the sudo rule name.
1201 Default: cn
1203 ldap_sudorule_command (string)
1205 The LDAP attribute that corresponds to the command name.
1206 Default: sudoCommand
1208 ldap_sudorule_host (string)
1210 The LDAP attribute that corresponds to the host name (or host IP
1211 address, host IP network, or host netgroup)
1212 Default: sudoHost
1214 ldap_sudorule_user (string)
1216 The LDAP attribute that corresponds to the user name (or UID, group
1217 name or user's netgroup)
1218 Default: sudoUser
1220 ldap_sudorule_option (string)
1222 The LDAP attribute that corresponds to the sudo options.
1223 Default: sudoOption
1225 ldap_sudorule_runasuser (string)
1227 The LDAP attribute that corresponds to the user name that commands
1228 may be run as.
1229 Default: sudoRunAsUser
1231 ldap_sudorule_runasgroup (string)
1233 The LDAP attribute that corresponds to the group name or group GID
1234 that commands may be run as.
1235 Default: sudoRunAsGroup
1237 ldap_sudorule_notbefore (string)
1239 The LDAP attribute that corresponds to the start date/time for when
1240 the sudo rule is valid.
1241 Default: sudoNotBefore
1243 ldap_sudorule_notafter (string)
1245 The LDAP attribute that corresponds to the expiration date/time,
1246 after which the sudo rule will no longer be valid.
1247 Default: sudoNotAfter
1249 ldap_sudorule_order (string)
1251 The LDAP attribute that corresponds to the ordering index of the
1252 rule.
1253 Default: sudoOrder
1255 ldap_sudo_full_refresh_interval (integer)
1257 How many seconds SSSD will wait between executing a full refresh of
1258 sudo rules (which downloads all rules that are stored on the
1259 server).
1260 The value must be greater than ldap_sudo_smart_refresh_interval
1262 Default: 21600 (6 hours)
1264 ldap_sudo_smart_refresh_interval (integer)
1266 How many seconds SSSD has to wait before executing a smart refresh
1267 of sudo rules (which downloads all rules that have USN higher than
1268 the highest server USN value that is currently known by SSSD).
1269 If USN attributes are not supported by the server, the
1271 modifyTimestamp attribute is used instead.
1272 Note: the highest USN value can be updated by three tasks: 1) By
1274 sudo full and smart refresh (if updated rules are found), 2) by
1275 enumeration of users and groups (if enabled and updated users or
1276 groups are found) and 3) by reconnecting to the server (by default
1277 every 15 minutes, see ldap_connection_expire_timeout).
1278 Default: 900 (15 minutes)
1280 ldap_sudo_use_host_filter (boolean)
1282 If true, SSSD will download only rules that are applicable to this
1283 machine (using the IPv4 or IPv6 host/network addresses and
1284 hostnames).
1285 Default: true
1287 ldap_sudo_hostnames (string)
1289 Space separated list of hostnames or fully qualified domain names
1290 that should be used to filter the rules.
1291 If this option is empty, SSSD will try to discover the hostname and
1293 the fully qualified domain name automatically.
1294 If ldap_sudo_use_host_filter is false then this option has no
1296 effect.
1297 Default: not specified
1299 ldap_sudo_ip (string)
1301 Space separated list of IPv4 or IPv6 host/network addresses that
1302 should be used to filter the rules.
1303 If this option is empty, SSSD will try to discover the addresses
1305 automatically.
1306 If ldap_sudo_use_host_filter is false then this option has no
1308 effect.
1309 Default: not specified
1311 ldap_sudo_include_netgroups (boolean)
1313 If true then SSSD will download every rule that contains a netgroup
1314 in sudoHost attribute.
1315 If ldap_sudo_use_host_filter is false then this option has no
1317 effect.
1318 Default: true
1320 ldap_sudo_include_regexp (boolean)
1322 If true then SSSD will download every rule that contains a wildcard
1323 in sudoHost attribute.
1324 If ldap_sudo_use_host_filter is false then this option has no
1326 effect.
1327 Note
1329 Using wildcard is an operation that is very costly to evaluate
1330 on the LDAP server side!
1331 Default: false
1332 This manual page only describes attribute name mapping. For detailed
1334 explanation of sudo related attribute semantics, see sudoers.ldap(5)
1335
1337 Some of the defaults for the parameters below are dependent on the LDAP
1338 schema.
1339 ldap_autofs_map_master_name (string)
1341 The name of the automount master map in LDAP.
1342 Default: auto.master
1344 ldap_autofs_map_object_class (string)
1346 The object class of an automount map entry in LDAP.
1347 Default: nisMap (rfc2307, autofs_provider=ad), otherwise
1349 automountMap
1350 ldap_autofs_map_name (string)
1352 The name of an automount map entry in LDAP.
1353 Default: nisMapName (rfc2307, autofs_provider=ad), otherwise
1355 automountMapName
1356 ldap_autofs_entry_object_class (string)
1358 The object class of an automount entry in LDAP. The entry usually
1359 corresponds to a mount point.
1360 Default: nisObject (rfc2307, autofs_provider=ad), otherwise
1362 automount
1363 ldap_autofs_entry_key (string)
1365 The key of an automount entry in LDAP. The entry usually
1366 corresponds to a mount point.
1367 Default: cn (rfc2307, autofs_provider=ad), otherwise automountKey
1369 ldap_autofs_entry_value (string)
1371 The key of an automount entry in LDAP. The entry usually
1372 corresponds to a mount point.
1373 Default: nisMapEntry (rfc2307, autofs_provider=ad), otherwise
1375 automountInformation
1376 Please note that the automounter only reads the master map on startup,
1378 so if any autofs-related changes are made to the sssd.conf, you
1379 typically also need to restart the automounter daemon after restarting
1380 the SSSD.
1381
1383 These options are supported by LDAP domains, but they should be used
1384 with caution. Please include them in your configuration only if you
1385 know what you are doing.
1386 ldap_netgroup_search_base (string)
1388 An optional base DN, search scope and LDAP filter to restrict LDAP
1389 searches for this attribute type.
1390 syntax:
1392 search_base[?scope?[filter][?search_base?scope?[filter]]*]
1394 The scope can be one of "base", "onelevel" or "subtree". The scope
1396 functions as specified in section 4.5.1.2 of
1397 http://tools.ietf.org/html/rfc4511
1398 The filter must be a valid LDAP search filter as specified by
1400 http://www.ietf.org/rfc/rfc2254.txt
1401 For examples of this syntax, please refer to the “ldap_search_base”
1403 examples section.
1404 Default: the value of ldap_search_base
1406 Please note that specifying scope or filter is not supported for
1408 searches against an Active Directory Server that might yield a
1409 large number of results and trigger the Range Retrieval extension
1410 in the response.
1411 ldap_user_search_base (string)
1413 An optional base DN, search scope and LDAP filter to restrict LDAP
1414 searches for this attribute type.
1415 syntax:
1417 search_base[?scope?[filter][?search_base?scope?[filter]]*]
1419 The scope can be one of "base", "onelevel" or "subtree". The scope
1421 functions as specified in section 4.5.1.2 of
1422 http://tools.ietf.org/html/rfc4511
1423 The filter must be a valid LDAP search filter as specified by
1425 http://www.ietf.org/rfc/rfc2254.txt
1426 For examples of this syntax, please refer to the “ldap_search_base”
1428 examples section.
1429 Default: the value of ldap_search_base
1431 Please note that specifying scope or filter is not supported for
1433 searches against an Active Directory Server that might yield a
1434 large number of results and trigger the Range Retrieval extension
1435 in the response.
1436 ldap_group_search_base (string)
1438 An optional base DN, search scope and LDAP filter to restrict LDAP
1439 searches for this attribute type.
1440 syntax:
1442 search_base[?scope?[filter][?search_base?scope?[filter]]*]
1444 The scope can be one of "base", "onelevel" or "subtree". The scope
1446 functions as specified in section 4.5.1.2 of
1447 http://tools.ietf.org/html/rfc4511
1448 The filter must be a valid LDAP search filter as specified by
1450 http://www.ietf.org/rfc/rfc2254.txt
1451 For examples of this syntax, please refer to the “ldap_search_base”
1453 examples section.
1454 Default: the value of ldap_search_base
1456 Please note that specifying scope or filter is not supported for
1458 searches against an Active Directory Server that might yield a
1459 large number of results and trigger the Range Retrieval extension
1460 in the response.
1461 Note
1463 If the option “ldap_use_tokengroups” is enabled, the searches
1464 against Active Directory will not be restricted and return all
1465 groups memberships, even with no GID mapping. It is recommended to
1466 disable this feature, if group names are not being displayed
1467 correctly.
1468 ldap_sudo_search_base (string)
1470 An optional base DN, search scope and LDAP filter to restrict LDAP
1471 searches for this attribute type.
1472 syntax:
1474 search_base[?scope?[filter][?search_base?scope?[filter]]*]
1476 The scope can be one of "base", "onelevel" or "subtree". The scope
1478 functions as specified in section 4.5.1.2 of
1479 http://tools.ietf.org/html/rfc4511
1480 The filter must be a valid LDAP search filter as specified by
1482 http://www.ietf.org/rfc/rfc2254.txt
1483 For examples of this syntax, please refer to the “ldap_search_base”
1485 examples section.
1486 Default: the value of ldap_search_base
1488 Please note that specifying scope or filter is not supported for
1490 searches against an Active Directory Server that might yield a
1491 large number of results and trigger the Range Retrieval extension
1492 in the response.
1493 ldap_autofs_search_base (string)
1495 An optional base DN, search scope and LDAP filter to restrict LDAP
1496 searches for this attribute type.
1497 syntax:
1499 search_base[?scope?[filter][?search_base?scope?[filter]]*]
1501 The scope can be one of "base", "onelevel" or "subtree". The scope
1503 functions as specified in section 4.5.1.2 of
1504 http://tools.ietf.org/html/rfc4511
1505 The filter must be a valid LDAP search filter as specified by
1507 http://www.ietf.org/rfc/rfc2254.txt
1508 For examples of this syntax, please refer to the “ldap_search_base”
1510 examples section.
1511 Default: the value of ldap_search_base
1513 Please note that specifying scope or filter is not supported for
1515 searches against an Active Directory Server that might yield a
1516 large number of results and trigger the Range Retrieval extension
1517 in the response.
1518
1520 The failover feature allows back ends to automatically switch to a
1521 different server if the current server fails.
1522 Failover Syntax
1524 The list of servers is given as a comma-separated list; any number of
1525 spaces is allowed around the comma. The servers are listed in order of
1526 preference. The list can contain any number of servers.
1527 For each failover-enabled config option, two variants exist: primary
1529 and backup. The idea is that servers in the primary list are preferred
1530 and backup servers are only searched if no primary servers can be
1531 reached. If a backup server is selected, a timeout of 31 seconds is
1532 set. After this timeout SSSD will periodically try to reconnect to one
1533 of the primary servers. If it succeeds, it will replace the current
1534 active (backup) server.
1535 The Failover Mechanism
1537 The failover mechanism distinguishes between a machine and a service.
1538 The back end first tries to resolve the hostname of a given machine; if
1539 this resolution attempt fails, the machine is considered offline. No
1540 further attempts are made to connect to this machine for any other
1541 service. If the resolution attempt succeeds, the back end tries to
1542 connect to a service on this machine. If the service connection attempt
1543 fails, then only this particular service is considered offline and the
1544 back end automatically switches over to the next service. The machine
1545 is still considered online and might still be tried for another
1546 service.
1547 Further connection attempts are made to machines or services marked as
1549 offline after a specified period of time; this is currently hard coded
1550 to 30 seconds.
1551 If there are no more machines to try, the back end as a whole switches
1553 to offline mode, and then attempts to reconnect every 30 seconds.
1554 Failover time outs and tuning
1556 Resolving a server to connect to can be as simple as running a single
1557 DNS query or can involve several steps, such as finding the correct
1558 site or trying out multiple host names in case some of the configured
1559 servers are not reachable. The more complex scenarios can take some
1560 time and SSSD needs to balance between providing enough time to finish
1561 the resolution process but on the other hand, not trying for too long
1562 before falling back to offline mode. If the SSSD debug logs show that
1563 the server resolution is timing out before a live server is contacted,
1564 you can consider changing the time outs.
1565 This section lists the available tunables. Please refer to their
1567 description in the sssd.conf(5), manual page.
1568 dns_resolver_server_timeout
1570 Time in milliseconds that sets how long would SSSD talk to a single
1571 DNS server before trying next one.
1572 Default: 1000
1574 dns_resolver_op_timeout
1576 Time in seconds to tell how long would SSSD try to resolve single
1577 DNS query (e.g. resolution of a hostname or an SRV record) before
1578 trying the next hostname or discovery domain.
1579 Default: 2
1581 dns_resolver_timeout
1583 How long would SSSD try to resolve a failover service. This service
1584 resolution internally might include several steps, such as
1585 resolving DNS SRV queries or locating the site.
1586 Default: 4
1588 For LDAP-based providers, the resolve operation is performed as part of
1590 an LDAP connection operation. Therefore, also the “ldap_opt_timeout>”
1591 timeout should be set to a larger value than “dns_resolver_timeout”
1592 which in turn should be set to a larger value than
1593 “dns_resolver_op_timeout” which should be larger than
1594 “dns_resolver_server_timeout”.
1595
1597 The service discovery feature allows back ends to automatically find
1598 the appropriate servers to connect to using a special DNS query. This
1599 feature is not supported for backup servers.
1600 Configuration
1602 If no servers are specified, the back end automatically uses service
1603 discovery to try to find a server. Optionally, the user may choose to
1604 use both fixed server addresses and service discovery by inserting a
1605 special keyword, “_srv_”, in the list of servers. The order of
1606 preference is maintained. This feature is useful if, for example, the
1607 user prefers to use service discovery whenever possible, and fall back
1608 to a specific server when no servers can be discovered using DNS.
1609 The domain name
1611 Please refer to the “dns_discovery_domain” parameter in the
1612 sssd.conf(5) manual page for more details.
1613 The protocol
1615 The queries usually specify _tcp as the protocol. Exceptions are
1616 documented in respective option description.
1617 See Also
1619 For more information on the service discovery mechanism, refer to RFC
1620 2782.
1621
1623 The ID-mapping feature allows SSSD to act as a client of Active
1624 Directory without requiring administrators to extend user attributes to
1625 support POSIX attributes for user and group identifiers.
1626 NOTE: When ID-mapping is enabled, the uidNumber and gidNumber
1628 attributes are ignored. This is to avoid the possibility of conflicts
1629 between automatically-assigned and manually-assigned values. If you
1630 need to use manually-assigned values, ALL values must be
1631 manually-assigned.
1632 Please note that changing the ID mapping related configuration options
1634 will cause user and group IDs to change. At the moment, SSSD does not
1635 support changing IDs, so the SSSD database must be removed. Because
1636 cached passwords are also stored in the database, removing the database
1637 should only be performed while the authentication servers are
1638 reachable, otherwise users might get locked out. In order to cache the
1639 password, an authentication must be performed. It is not sufficient to
1640 use sss_cache(8) to remove the database, rather the process consists
1641 of:
1642 · Making sure the remote servers are reachable
1644 · Stopping the SSSD service
1646 · Removing the database
1648 · Starting the SSSD service
1650 Moreover, as the change of IDs might necessitate the adjustment of
1652 other system properties such as file and directory ownership, it's
1653 advisable to plan ahead and test the ID mapping configuration
1654 thoroughly.
1655 Mapping Algorithm
1657 Active Directory provides an objectSID for every user and group object
1658 in the directory. This objectSID can be broken up into components that
1659 represent the Active Directory domain identity and the relative
1660 identifier (RID) of the user or group object.
1661 The SSSD ID-mapping algorithm takes a range of available UIDs and
1663 divides it into equally-sized component sections - called "slices"-.
1664 Each slice represents the space available to an Active Directory
1665 domain.
1666 When a user or group entry for a particular domain is encountered for
1668 the first time, the SSSD allocates one of the available slices for that
1669 domain. In order to make this slice-assignment repeatable on different
1670 client machines, we select the slice based on the following algorithm:
1671 The SID string is passed through the murmurhash3 algorithm to convert
1673 it to a 32-bit hashed value. We then take the modulus of this value
1674 with the total number of available slices to pick the slice.
1675 NOTE: It is possible to encounter collisions in the hash and subsequent
1677 modulus. In these situations, we will select the next available slice,
1678 but it may not be possible to reproduce the same exact set of slices on
1679 other machines (since the order that they are encountered will
1680 determine their slice). In this situation, it is recommended to either
1681 switch to using explicit POSIX attributes in Active Directory
1682 (disabling ID-mapping) or configure a default domain to guarantee that
1683 at least one is always consistent. See “Configuration” for details.
1684 Configuration
1686 Minimum configuration (in the “[domain/DOMAINNAME]” section):
1687 ldap_id_mapping = True
1689 ldap_schema = ad
1690 The default configuration results in configuring 10,000 slices, each
1692 capable of holding up to 200,000 IDs, starting from 200,000 and going
1693 up to 2,000,200,000. This should be sufficient for most deployments.
1694 Advanced Configuration
1696 ldap_idmap_range_min (integer)
1697 Specifies the lower bound of the range of POSIX IDs to use for
1698 mapping Active Directory user and group SIDs.
1699 NOTE: This option is different from “min_id” in that “min_id”
1701 acts to filter the output of requests to this domain, whereas
1702 this option controls the range of ID assignment. This is a
1703 subtle distinction, but the good general advice would be to
1704 have “min_id” be less-than or equal to “ldap_idmap_range_min”
1705 Default: 200000
1707 ldap_idmap_range_max (integer)
1709 Specifies the upper bound of the range of POSIX IDs to use for
1710 mapping Active Directory user and group SIDs.
1711 NOTE: This option is different from “max_id” in that “max_id”
1713 acts to filter the output of requests to this domain, whereas
1714 this option controls the range of ID assignment. This is a
1715 subtle distinction, but the good general advice would be to
1716 have “max_id” be greater-than or equal to
1717 “ldap_idmap_range_max”
1718 Default: 2000200000
1720 ldap_idmap_range_size (integer)
1722 Specifies the number of IDs available for each slice. If the
1723 range size does not divide evenly into the min and max values,
1724 it will create as many complete slices as it can.
1725 NOTE: The value of this option must be at least as large as the
1727 highest user RID planned for use on the Active Directory
1728 server. User lookups and login will fail for any user whose RID
1729 is greater than this value.
1730 For example, if your most recently-added Active Directory user
1732 has objectSid=S-1-5-21-2153326666-2176343378-3404031434-1107,
1733 “ldap_idmap_range_size” must be at least 1108 as range size is
1734 equal to maximal SID minus minimal SID plus one (e.g. 1108 =
1735 1107 - 0 + 1).
1736 It is important to plan ahead for future expansion, as changing
1738 this value will result in changing all of the ID mappings on
1739 the system, leading to users with different local IDs than they
1740 previously had.
1741 Default: 200000
1743 ldap_idmap_default_domain_sid (string)
1745 Specify the domain SID of the default domain. This will
1746 guarantee that this domain will always be assigned to slice
1747 zero in the ID map, bypassing the murmurhash algorithm
1748 described above.
1749 Default: not set
1751 ldap_idmap_default_domain (string)
1753 Specify the name of the default domain.
1754 Default: not set
1756 ldap_idmap_autorid_compat (boolean)
1758 Changes the behavior of the ID-mapping algorithm to behave more
1759 similarly to winbind's “idmap_autorid” algorithm.
1760 When this option is configured, domains will be allocated
1762 starting with slice zero and increasing monatomically with each
1763 additional domain.
1764 NOTE: This algorithm is non-deterministic (it depends on the
1766 order that users and groups are requested). If this mode is
1767 required for compatibility with machines running winbind, it is
1768 recommended to also use the “ldap_idmap_default_domain_sid”
1769 option to guarantee that at least one domain is consistently
1770 allocated to slice zero.
1771 Default: False
1773 ldap_idmap_helper_table_size (integer)
1775 Maximal number of secondary slices that is tried when
1776 performing mapping from UNIX id to SID.
1777 Note: Additional secondary slices might be generated when SID
1779 is being mapped to UNIX id and RID part of SID is out of range
1780 for secondary slices generated so far. If value of
1781 ldap_idmap_helper_table_size is equal to 0 then no additional
1782 secondary slices are generated.
1783 Default: 10
1785 Well-Known SIDs
1787 SSSD supports to look up the names of Well-Known SIDs, i.e. SIDs with a
1788 special hardcoded meaning. Since the generic users and groups related
1789 to those Well-Known SIDs have no equivalent in a Linux/UNIX environment
1790 no POSIX IDs are available for those objects.
1791 The SID name space is organized in authorities which can be seen as
1793 different domains. The authorities for the Well-Known SIDs are
1794 · Null Authority
1796 · World Authority
1798 · Local Authority
1800 · Creator Authority
1802 · NT Authority
1804 · Built-in
1806 The capitalized version of these names are used as domain names when
1808 returning the fully qualified name of a Well-Known SID.
1809 Since some utilities allow to modify SID based access control
1811 information with the help of a name instead of using the SID directly
1812 SSSD supports to look up the SID by the name as well. To avoid
1813 collisions only the fully qualified names can be used to look up
1814 Well-Known SIDs. As a result the domain names “NULL AUTHORITY”, “WORLD
1815 AUTHORITY”, “ LOCAL AUTHORITY”, “CREATOR AUTHORITY”, “NT AUTHORITY” and
1816 “BUILTIN” should not be used as domain names in sssd.conf.
1817
1819 The following example assumes that SSSD is correctly configured and
1820 LDAP is set to one of the domains in the [domains] section.
1821 [domain/LDAP]
1823 id_provider = ldap
1824 auth_provider = ldap
1825 ldap_uri = ldap://ldap.mydomain.org
1826 ldap_search_base = dc=mydomain,dc=org
1827 ldap_tls_reqcert = demand
1828 cache_credentials = true
1829
1832 The following example assumes that SSSD is correctly configured and to
1833 use the ldap_access_order=lockout.
1834 [domain/LDAP]
1836 id_provider = ldap
1837 auth_provider = ldap
1838 access_provider = ldap
1839 ldap_access_order = lockout
1840 ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org
1841 ldap_uri = ldap://ldap.mydomain.org
1842 ldap_search_base = dc=mydomain,dc=org
1843 ldap_tls_reqcert = demand
1844 cache_credentials = true
1845
1848 The descriptions of some of the configuration options in this manual
1849 page are based on the ldap.conf(5) manual page from the OpenLDAP 2.4
1850 distribution.
1851
1853 sssd(8), sssd.conf(5), sssd-ldap(5), sssd-krb5(5), sssd-simple(5),
1854 sssd-ipa(5), sssd-ad(5), sssd-files(5), sssd-sudo(5), sssd-session-
1855 recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8),
1856 sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(8),
1857 sss_ssh_knownhostsproxy(8), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)
1858 sssd-systemtap(5)
1859
1861 The SSSD upstream - https://pagure.io/SSSD/sssd/
1862SSSD 10/22/2019 SSSD-LDAP(5)