I've deployed a pre-production IPA environment which is similar to the example domains
above. I have a user signed smart-card which does not share a CA with the IPA domain. I
want to configure SSSD to fail closed if the OCSP responder (identified on the card) is
not available. I see in the sssd.conf file where I can enable OCSP to an alternate URL,
but I don't find an option to set to OCSP as 'required'. I've ran a
network capture and see the OCSP responder replying to my request when authenticating via
SmartCard, I now want to force authentication to require OCSP validation and not default
'open' or 'success' when OCSP is unavailable. Is there a method of
setting either sssd.conf or an attribute in ipa to force this type of configuration?