1SSSD-LDAP-ATTRIBUT(5) File Formats and Conventions SSSD-LDAP-ATTRIBUT(5)
2
6 sssd-ldap-attributes - SSSD LDAP Provider: Mapping Attributes
7
9 This manual page describes the mapping attributes of SSSD LDAP provider
10 sssd-ldap(5). Refer to the sssd-ldap(5) manual page for full details
11 about SSSD LDAP provider configuration options.
12
14 ldap_user_object_class (string)
15 The object class of a user entry in LDAP.
16 Default: posixAccount
18 ldap_user_name (string)
20 The LDAP attribute that corresponds to the user's login name.
21 Default: uid (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)
23 ldap_user_uid_number (string)
25 The LDAP attribute that corresponds to the user's id.
26 Default: uidNumber
28 ldap_user_gid_number (string)
30 The LDAP attribute that corresponds to the user's primary group id.
31 Default: gidNumber
33 ldap_user_primary_group (string)
35 Active Directory primary group attribute for ID-mapping. Note that
36 this attribute should only be set manually if you are running the
37 “ldap” provider with ID mapping.
38 Default: unset (LDAP), primaryGroupID (AD)
40 ldap_user_gecos (string)
42 The LDAP attribute that corresponds to the user's gecos field.
43 Default: gecos
45 ldap_user_home_directory (string)
47 The LDAP attribute that contains the name of the user's home
48 directory.
49 Default: homeDirectory (LDAP and IPA), unixHomeDirectory (AD)
51 ldap_user_shell (string)
53 The LDAP attribute that contains the path to the user's default
54 shell.
55 Default: loginShell
57 ldap_user_uuid (string)
59 The LDAP attribute that contains the UUID/GUID of an LDAP user
60 object.
61 Default: not set in the general case, objectGUID for AD and
63 ipaUniqueID for IPA
64 ldap_user_objectsid (string)
66 The LDAP attribute that contains the objectSID of an LDAP user
67 object. This is usually only necessary for ActiveDirectory servers.
68 Default: objectSid for ActiveDirectory, not set for other servers.
70 ldap_user_modify_timestamp (string)
72 The LDAP attribute that contains timestamp of the last modification
73 of the parent object.
74 Default: modifyTimestamp
76 ldap_user_shadow_last_change (string)
78 When using ldap_pwd_policy=shadow, this parameter contains the name
79 of an LDAP attribute corresponding to its shadow(5) counterpart
80 (date of the last password change).
81 Default: shadowLastChange
83 ldap_user_shadow_min (string)
85 When using ldap_pwd_policy=shadow, this parameter contains the name
86 of an LDAP attribute corresponding to its shadow(5) counterpart
87 (minimum password age).
88 Default: shadowMin
90 ldap_user_shadow_max (string)
92 When using ldap_pwd_policy=shadow, this parameter contains the name
93 of an LDAP attribute corresponding to its shadow(5) counterpart
94 (maximum password age).
95 Default: shadowMax
97 ldap_user_shadow_warning (string)
99 When using ldap_pwd_policy=shadow, this parameter contains the name
100 of an LDAP attribute corresponding to its shadow(5) counterpart
101 (password warning period).
102 Default: shadowWarning
104 ldap_user_shadow_inactive (string)
106 When using ldap_pwd_policy=shadow, this parameter contains the name
107 of an LDAP attribute corresponding to its shadow(5) counterpart
108 (password inactivity period).
109 Default: shadowInactive
111 ldap_user_shadow_expire (string)
113 When using ldap_pwd_policy=shadow or
114 ldap_account_expire_policy=shadow, this parameter contains the name
115 of an LDAP attribute corresponding to its shadow(5) counterpart
116 (account expiration date).
117 Default: shadowExpire
119 ldap_user_krb_last_pwd_change (string)
121 When using ldap_pwd_policy=mit_kerberos, this parameter contains
122 the name of an LDAP attribute storing the date and time of last
123 password change in kerberos.
124 Default: krbLastPwdChange
126 ldap_user_krb_password_expiration (string)
128 When using ldap_pwd_policy=mit_kerberos, this parameter contains
129 the name of an LDAP attribute storing the date and time when
130 current password expires.
131 Default: krbPasswordExpiration
133 ldap_user_ad_account_expires (string)
135 When using ldap_account_expire_policy=ad, this parameter contains
136 the name of an LDAP attribute storing the expiration time of the
137 account.
138 Default: accountExpires
140 ldap_user_ad_user_account_control (string)
142 When using ldap_account_expire_policy=ad, this parameter contains
143 the name of an LDAP attribute storing the user account control bit
144 field.
145 Default: userAccountControl
147 ldap_ns_account_lock (string)
149 When using ldap_account_expire_policy=rhds or equivalent, this
150 parameter determines if access is allowed or not.
151 Default: nsAccountLock
153 ldap_user_nds_login_disabled (string)
155 When using ldap_account_expire_policy=nds, this attribute
156 determines if access is allowed or not.
157 Default: loginDisabled
159 ldap_user_nds_login_expiration_time (string)
161 When using ldap_account_expire_policy=nds, this attribute
162 determines until which date access is granted.
163 Default: loginDisabled
165 ldap_user_nds_login_allowed_time_map (string)
167 When using ldap_account_expire_policy=nds, this attribute
168 determines the hours of a day in a week when access is granted.
169 Default: loginAllowedTimeMap
171 ldap_user_principal (string)
173 The LDAP attribute that contains the user's Kerberos User Principal
174 Name (UPN).
175 Default: krbPrincipalName
177 ldap_user_extra_attrs (string)
179 Comma-separated list of LDAP attributes that SSSD would fetch along
180 with the usual set of user attributes.
181 The list can either contain LDAP attribute names only, or
183 colon-separated tuples of SSSD cache attribute name and LDAP
184 attribute name. In case only LDAP attribute name is specified, the
185 attribute is saved to the cache verbatim. Using a custom SSSD
186 attribute name might be required by environments that configure
187 several SSSD domains with different LDAP schemas.
188 Please note that several attribute names are reserved by SSSD,
190 notably the “name” attribute. SSSD would report an error if any of
191 the reserved attribute names is used as an extra attribute name.
192 Examples:
194 ldap_user_extra_attrs = telephoneNumber
196 Save the “telephoneNumber” attribute from LDAP as “telephoneNumber”
198 to the cache.
199 ldap_user_extra_attrs = phone:telephoneNumber
201 Save the “telephoneNumber” attribute from LDAP as “phone” to the
203 cache.
204 Default: not set
206 ldap_user_ssh_public_key (string)
208 The LDAP attribute that contains the user's SSH public keys.
209 Default: sshPublicKey
211 ldap_user_fullname (string)
213 The LDAP attribute that corresponds to the user's full name.
214 Default: cn
216 ldap_user_member_of (string)
218 The LDAP attribute that lists the user's group memberships.
219 Default: memberOf
221 ldap_user_authorized_service (string)
223 If access_provider=ldap and ldap_access_order=authorized_service,
224 SSSD will use the presence of the authorizedService attribute in
225 the user's LDAP entry to determine access privilege.
226 An explicit deny (!svc) is resolved first. Second, SSSD searches
228 for explicit allow (svc) and finally for allow_all (*).
229 Please note that the ldap_access_order configuration option must
231 include “authorized_service” in order for the
232 ldap_user_authorized_service option to work.
233 Some distributions (such as Fedora-29+ or RHEL-8) always include
235 the “systemd-user” PAM service as part of the login process.
236 Therefore when using service-based access control, the
237 “systemd-user” service might need to be added to the list of
238 allowed services.
239 Default: authorizedService
241 ldap_user_authorized_host (string)
243 If access_provider=ldap and ldap_access_order=host, SSSD will use
244 the presence of the host attribute in the user's LDAP entry to
245 determine access privilege.
246 An explicit deny (!host) is resolved first. Second, SSSD searches
248 for explicit allow (host) and finally for allow_all (*).
249 Please note that the ldap_access_order configuration option must
251 include “host” in order for the ldap_user_authorized_host option to
252 work.
253 Default: host
255 ldap_user_authorized_rhost (string)
257 If access_provider=ldap and ldap_access_order=rhost, SSSD will use
258 the presence of the rhost attribute in the user's LDAP entry to
259 determine access privilege. Similarly to host verification process.
260 An explicit deny (!rhost) is resolved first. Second, SSSD searches
262 for explicit allow (rhost) and finally for allow_all (*).
263 Please note that the ldap_access_order configuration option must
265 include “rhost” in order for the ldap_user_authorized_rhost option
266 to work.
267 Default: rhost
269 ldap_user_certificate (string)
271 Name of the LDAP attribute containing the X509 certificate of the
272 user.
273 Default: userCertificate;binary
275 ldap_user_email (string)
277 Name of the LDAP attribute containing the email address of the
278 user.
279 Note: If an email address of a user conflicts with an email address
281 or fully qualified name of another user, then SSSD will not be able
282 to serve those users properly. If for some reason several users
283 need to share the same email address then set this option to a
284 nonexistent attribute name in order to disable user lookup/login by
285 email.
286 Default: mail
288
290 ldap_group_object_class (string)
291 The object class of a group entry in LDAP.
292 Default: posixGroup
294 ldap_group_name (string)
296 The LDAP attribute that corresponds to the group name.
297 Default: cn (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)
299 ldap_group_gid_number (string)
301 The LDAP attribute that corresponds to the group's id.
302 Default: gidNumber
304 ldap_group_member (string)
306 The LDAP attribute that contains the names of the group's members.
307 Default: memberuid (rfc2307) / member (rfc2307bis)
309 ldap_group_uuid (string)
311 The LDAP attribute that contains the UUID/GUID of an LDAP group
312 object.
313 Default: not set in the general case, objectGUID for AD and
315 ipaUniqueID for IPA
316 ldap_group_objectsid (string)
318 The LDAP attribute that contains the objectSID of an LDAP group
319 object. This is usually only necessary for ActiveDirectory servers.
320 Default: objectSid for ActiveDirectory, not set for other servers.
322 ldap_group_modify_timestamp (string)
324 The LDAP attribute that contains timestamp of the last modification
325 of the parent object.
326 Default: modifyTimestamp
328 ldap_group_type (string)
330 The LDAP attribute that contains an integer value indicating the
331 type of the group and maybe other flags.
332 This attribute is currently only used by the AD provider to
334 determine if a group is a domain local groups and has to be
335 filtered out for trusted domains.
336 Default: groupType in the AD provider, otherwise not set
338 ldap_group_external_member (string)
340 The LDAP attribute that references group members that are defined
341 in an external domain. At the moment, only IPA's external members
342 are supported.
343 Default: ipaExternalMember in the IPA provider, otherwise unset.
345
347 ldap_netgroup_object_class (string)
348 The object class of a netgroup entry in LDAP.
349 In IPA provider, ipa_netgroup_object_class should be used instead.
351 Default: nisNetgroup
353 ldap_netgroup_name (string)
355 The LDAP attribute that corresponds to the netgroup name.
356 In IPA provider, ipa_netgroup_name should be used instead.
358 Default: cn
360 ldap_netgroup_member (string)
362 The LDAP attribute that contains the names of the netgroup's
363 members.
364 In IPA provider, ipa_netgroup_member should be used instead.
366 Default: memberNisNetgroup
368 ldap_netgroup_triple (string)
370 The LDAP attribute that contains the (host, user, domain) netgroup
371 triples.
372 This option is not available in IPA provider.
374 Default: nisNetgroupTriple
376 ldap_netgroup_modify_timestamp (string)
378 The LDAP attribute that contains timestamp of the last modification
379 of the parent object.
380 This option is not available in IPA provider.
382 Default: modifyTimestamp
384
386 ldap_host_object_class (string)
387 The object class of a host entry in LDAP.
388 Default: ipService
390 ldap_host_name (string)
392 The LDAP attribute that corresponds to the host's name.
393 Default: cn
395 ldap_host_fqdn (string)
397 The LDAP attribute that corresponds to the host's fully-qualified
398 domain name.
399 Default: fqdn
401 ldap_host_serverhostname (string)
403 The LDAP attribute that corresponds to the host's name.
404 Default: serverHostname
406 ldap_host_member_of (string)
408 The LDAP attribute that lists the host's group memberships.
409 Default: memberOf
411 ldap_host_ssh_public_key (string)
413 The LDAP attribute that contains the host's SSH public keys.
414 Default: sshPublicKey
416 ldap_host_uuid (string)
418 The LDAP attribute that contains the UUID/GUID of an LDAP host
419 object.
420 Default: not set
422
424 ldap_service_object_class (string)
425 The object class of a service entry in LDAP.
426 Default: ipService
428 ldap_service_name (string)
430 The LDAP attribute that contains the name of service attributes and
431 their aliases.
432 Default: cn
434 ldap_service_port (string)
436 The LDAP attribute that contains the port managed by this service.
437 Default: ipServicePort
439 ldap_service_proto (string)
441 The LDAP attribute that contains the protocols understood by this
442 service.
443 Default: ipServiceProtocol
445
447 ldap_sudorule_object_class (string)
448 The object class of a sudo rule entry in LDAP.
449 Default: sudoRole
451 ldap_sudorule_name (string)
453 The LDAP attribute that corresponds to the sudo rule name.
454 Default: cn
456 ldap_sudorule_command (string)
458 The LDAP attribute that corresponds to the command name.
459 Default: sudoCommand
461 ldap_sudorule_host (string)
463 The LDAP attribute that corresponds to the host name (or host IP
464 address, host IP network, or host netgroup)
465 Default: sudoHost
467 ldap_sudorule_user (string)
469 The LDAP attribute that corresponds to the user name (or UID, group
470 name or user's netgroup)
471 Default: sudoUser
473 ldap_sudorule_option (string)
475 The LDAP attribute that corresponds to the sudo options.
476 Default: sudoOption
478 ldap_sudorule_runasuser (string)
480 The LDAP attribute that corresponds to the user name that commands
481 may be run as.
482 Default: sudoRunAsUser
484 ldap_sudorule_runasgroup (string)
486 The LDAP attribute that corresponds to the group name or group GID
487 that commands may be run as.
488 Default: sudoRunAsGroup
490 ldap_sudorule_notbefore (string)
492 The LDAP attribute that corresponds to the start date/time for when
493 the sudo rule is valid.
494 Default: sudoNotBefore
496 ldap_sudorule_notafter (string)
498 The LDAP attribute that corresponds to the expiration date/time,
499 after which the sudo rule will no longer be valid.
500 Default: sudoNotAfter
502 ldap_sudorule_order (string)
504 The LDAP attribute that corresponds to the ordering index of the
505 rule.
506 Default: sudoOrder
508
510 ldap_autofs_map_object_class (string)
511 The object class of an automount map entry in LDAP.
512 Default: nisMap (rfc2307, autofs_provider=ad), otherwise
514 automountMap
515 ldap_autofs_map_name (string)
517 The name of an automount map entry in LDAP.
518 Default: nisMapName (rfc2307, autofs_provider=ad), otherwise
520 automountMapName
521 ldap_autofs_entry_object_class (string)
523 The object class of an automount entry in LDAP. The entry usually
524 corresponds to a mount point.
525 Default: nisObject (rfc2307, autofs_provider=ad), otherwise
527 automount
528 ldap_autofs_entry_key (string)
530 The key of an automount entry in LDAP. The entry usually
531 corresponds to a mount point.
532 Default: cn (rfc2307, autofs_provider=ad), otherwise automountKey
534 ldap_autofs_entry_value (string)
536 The key of an automount entry in LDAP. The entry usually
537 corresponds to a mount point.
538 Default: nisMapEntry (rfc2307, autofs_provider=ad), otherwise
540 automountInformation
541
543 ldap_iphost_object_class (string)
544 The object class of an iphost entry in LDAP.
545 Default: ipHost
547 ldap_iphost_name (string)
549 The LDAP attribute that contains the name of the IP host attributes
550 and their aliases.
551 Default: cn
553 ldap_iphost_number (string)
555 The LDAP attribute that contains the IP host address.
556 Default: ipHostNumber
558
560 ldap_ipnetwork_object_class (string)
561 The object class of an ipnetwork entry in LDAP.
562 Default: ipNetwork
564 ldap_ipnetwork_name (string)
566 The LDAP attribute that contains the name of the IP network
567 attributes and their aliases.
568 Default: cn
570 ldap_ipnetwork_number (string)
572 The LDAP attribute that contains the IP network address.
573 Default: ipNetworkNumber
575
577 sssd(8), sssd.conf(5), sssd-ldap(5), sssd-krb5(5), sssd-simple(5),
578 sssd-ipa(5), sssd-ad(5), sssd-files(5), sssd-sudo(5), sssd-session-
579 recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8),
580 sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(8),
581 sss_ssh_knownhostsproxy(8), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)
582 sssd-systemtap(5)
583
585 The SSSD upstream - https://github.com/SSSD/sssd/
586SSSD 02/19/2021 SSSD-LDAP-ATTRIBUT(5)