ldap_id_mapping = False


            

For proper operation, this option should be specified as the lower-case version of the long version of the Active Directory domain.

The short domain name (also known as the NetBIOS or the flat name) is autodetected by the SSSD.

During the discovery of the domains SSSD will filter out some domains where flags or attributes indicate that they do not belong to the local forest or are not trusted. If ad_enabled_domains is set, SSSD will try to enable all listed domains.

For proper operation, this option must be specified in all lower-case and as the fully qualified domain name of the Active Directory domain. For example:

ad_enabled_domains = sales.example.com, eng.example.com


                            

The short domain name (also known as the NetBIOS or the flat name) will be autodetected by SSSD.

Default: Not set

This is optional if autodiscovery is enabled. For more information on service discovery, refer to the “SERVICE DISCOVERY” section.

Note: Trusted domains will always auto-discover servers even if the primary server is explicitly defined in the ad_server option.

This field is used to determine the host principal in use in the keytab and to perform dynamic DNS updates. It must match the hostname for which the keytab was issued.

If true and service discovery (see Service Discovery paragraph at the bottom of the man page) is enabled, the SSSD will first attempt to discover the Active Directory server to connect to using the Active Directory Site Discovery and fall back to the DNS SRV records if no AD site is found. The DNS SRV configuration, including the discovery domain, is used during site discovery as well.

Default: true

The option also supports specifying different filters per domain or forest. This extended filter would consist of: “KEYWORD:NAME:FILTER”. The keyword can be either “DOM”, “FOREST” or missing.

If the keyword equals to “DOM” or is missing, then “NAME” specifies the domain or subdomain the filter applies to. If the keyword equals to “FOREST”, then the filter equals to all domains from the forest specified by “NAME”.

Multiple filters can be separated with the “?” character, similarly to how search bases work.

Nested group membership must be searched for using a special OID “:1.2.840.113556.1.4.1941:” in addition to the full DOM:domain.example.org: syntax to ensure the parser does not attempt to interpret the colon characters associated with the OID. If you do not use this OID then nested group membership will not be resolved. See usage example below and refer here for further information about the OID: [MS-ADTS] section LDAP extensions[2]

The most specific match is always used. For example, if the option specified filter for a domain the user is a member of and a global filter, the per-domain filter would be applied. If there are more matches with the same specification, the first one is used.

Examples:

# apply filter on domain called dom1 only:
dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)
# apply filter on domain called dom2 only:
DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)
# apply filter on forest called EXAMPLE.COM only:
FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)
# apply filter for a member of a nested group in dom1:
DOM:dom1:(memberOf:1.2.840.113556.1.4.1941:=cn=nestedgroup,ou=groups,dc=example,dc=com)


                        

Default: Not set

Default: Not set

Please note that disabling Global Catalog support does not disable retrieving users from trusted domains. The SSSD would connect to the LDAP port of trusted domains instead. However, Global Catalog must be used in order to resolve cross-domain group memberships.

Default: true

GPO-based access control functionality uses GPO policy settings to determine whether or not a particular user is allowed to logon to the host. For more information on the supported policy settings please refer to the “ad_gpo_map” options.

Please note that current version of SSSD does not support Active Directory's built-in groups. Built-in groups (such as Administrators with SID S-1-5-32-544) in GPO access control rules will be ignored by SSSD. See upstream issue tracker https://github.com/SSSD/sssd/issues/5063 .

Before performing access control SSSD applies group policy security filtering on the GPOs. For every single user login, the applicability of the GPOs that are linked to the host is checked. In order for a GPO to apply to a user, the user or at least one of the groups to which it belongs must have following permissions on the GPO:

By default, the Authenticated Users group is present on a GPO and this group has both Read and Apply Group Policy access rights. Since authentication of a user must have been completed successfully before GPO security filtering and access control are started, the Authenticated Users group permissions on the GPO always apply also to the user.

NOTE: If the operation mode is set to enforcing, it is possible that users that were previously allowed logon access will now be denied logon access (as dictated by the GPO policy settings). In order to facilitate a smooth transition for administrators, a permissive mode is available that will not enforce the access control rules, but will evaluate them and will output a syslog message if access would have been denied. By examining the logs, administrators can then make the necessary changes before setting the mode to enforcing. For logging GPO-based access control debug level 'trace functions' is required (see sssctl(8) manual page).

There are three supported values for this option:

Default: enforcing

Default: False

The following 2 tables should illustrate when a user is allowed or rejected based on the allow and deny login rights defined on the server-side and the setting of ad_gpo_implicit_deny.

Default: False

Default: 5 (seconds)

Note: Using the Group Policy Management Editor this value is called "Allow log on locally" and "Deny log on locally".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “login”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_interactive = +my_pam_service, -login


                            

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “sshd”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_remote_interactive = +my_pam_service, -sshd


                            

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Access this computer from the network" and "Deny access to this computer from the network".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “ftp”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_network = +my_pam_service, -ftp


                            

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Allow log on as a batch job" and "Deny log on as a batch job".

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for this logon right (e.g. “crond”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_batch = +my_pam_service, -crond


                            

Note: Cron service name may differ depending on Linux distribution used.

Default: the default set of PAM service names includes:

Note: Using the Group Policy Management Editor this value is called "Allow log on as a service" and "Deny log on as a service".

It is possible to add a PAM service name to the default set by using “+service_name”. Since the default set is empty, it is not possible to remove a PAM service name from the default set. For example, in order to add a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_service = +my_pam_service


                            

Default: not set

It is possible to add another PAM service name to the default set by using “+service_name” or to explicitly remove a PAM service name from the default set by using “-service_name”. For example, in order to replace a default PAM service name for unconditionally permitted access (e.g. “sudo”) with a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_permit = +my_pam_service, -sudo


                            

Default: the default set of PAM service names includes:

It is possible to add a PAM service name to the default set by using “+service_name”. Since the default set is empty, it is not possible to remove a PAM service name from the default set. For example, in order to add a custom pam service name (e.g. “my_pam_service”), you would use the following configuration:

ad_gpo_map_deny = +my_pam_service


                            

Default: not set

Supported values for this option include:

Default: deny

Default: 30 days

Default: 86400:750 (24h and 15m)

Default: false

Default: False

Please note that setting this option to “true” will be against the intention of Domain Local group in Active Directory and SHOULD ONLY BE USED TO FACILITATE MIGRATION FROM OTHER SOLUTIONS. Although the group exists and user can be member of the group the intention is that the group should be only used in the domain it is defined and in no others. Since there is only one type of POSIX groups the only way to achieve this on the Linux side is to ignore those groups. This is also done by Active Directory as can be seen in the PAC of the Kerberos ticket for a local service or in tokenGroups requests where remote Domain Local groups are missing as well.

Given the comments above, if this option is set to “true” the tokenGroups request must be disabled by setting “ldap_use_tokengroups” to “false” to get consistent group-memberships of a users. Additionally the Global Catalog lookup should be skipped as well by setting “ad_enable_gc” to “false”. Finally it might be necessary to modify “ldap_group_nesting_level” if the remote Domain Local groups can only be found with a deeper nesting level.

Default: False

NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, the default Kerberos realm must be set properly in /etc/krb5.conf

Default: true

Default: 3600 (seconds)

Default: Use the IP addresses of the interface which is used for AD LDAP connection

Example: dyndns_iface = em1, vnet1, vnet2

Default: 86400 (24 hours)

Note that dyndns_update_per_family parameter does not apply for PTR record updates. Those updates are always sent separately.

Default: True

Default: False (let nsupdate choose the protocol)

Default: GSS-TSIG

Default: Same as dyndns_auth

Setting this option makes sense for environments where the DNS server is different from the identity server.

Please note that this option will be only used in fallback attempt when previous attempt using autodetected settings failed.

Default: None (let nsupdate choose the server)

Default: true

%u

%U

%d

%f

%l

%P

%o

%h

%H

%%

This option can also be set per-domain.

example:

override_homedir = /home/%u


        

Default: Not set (SSSD will use the value retrieved from LDAP)

Please note, the home directory from a specific override for the user, either locally (see sss_override(8)) or centrally managed IPA id-overrides, has a higher precedence and will be used instead of the value given by override_homedir.

Default: /home

To disable the creation of the configuration snippets set the parameter to 'none'.

Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)

[domain/EXAMPLE]
id_provider = ad
auth_provider = ad
access_provider = ad
chpass_provider = ad
ad_server = dc1.example.com
ad_hostname = client.example.com
ad_domain = example.com

access_provider = ldap
ldap_access_order = expire
ldap_account_expire_policy = ad