On su, 14 maalis 2021, lejeczek via FreeIPA-users wrote:
Hi guys.
What each option in sssd.conf mean & does I can try to learn from man
pages, but I'd like to ask why would there be differences between
masters?
A) first master
[domain/priv.my.dom.private]
access_provider = ipa
auth_provider = ipa
cache_credentials = True
chpass_provider = ipa
id_provider = ipa
ipa_domain = priv.my.dom.private
ipa_hostname = drunk.priv.my.dom.private
ipa_server = drunk.priv.my.dom.private
ipa_server_mode = True
krb5_store_password_if_offline = True
ldap_tls_cacert = /etc/ipa/ca.crt
B) next master
[domain/priv.my.dom.private]
access_provider = ipa
auth_provider = ipa
autofs_provider = ipa
cache_credentials = True
chpass_provider = ipa
hostid_provider = ipa
id_provider = ipa
ipa_domain = priv.my.dom.private
ipa_hostname = sucker.priv.my.dom.private
ipa_server_mode = True
ipa_server = sucker.priv.my.dom.private
krb5_store_password_if_offline = True
ldap_tls_cacert = /etc/ipa/ca.crt
session_provider = ipa
subdomains_provider = ipa
sudo_provider = ipa
Both config are result of 'ipa-server/replica' process, no manual
interventions and both systems virtually identical in terms of
soft/hardware.
None of IPA setup tools change SSSD configuration to enable hostid,
sessions or subdomains providers explicitly. We simply do not set them
at all.
There is no real need to add most of other *_provider=ipa explicitly
because setting 'id_provider=ipa' automatically enables all of the
supported ones. According to sssd.conf(5), only 'access_provider' option
has a default that needs override (defaults to 'permit'). The rest
defaults to either the same value as 'id_provider' or 'auth_provider'.
And 'auth_provider' defaults to 'id_provider' too.
So look at your other tools.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland