[sssd] config_file_version = 2 services = nss, pam, ssh, sudo # SSSD will not start if you do not configure any domains. # Add new domain configurations as [domain/] sections, and # then add the list of domains (in the order you want them to be # queried) to the "domains" attribute below and uncomment it. domains = AE-DIR [local] create_homedir = true [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] [domain/AE-DIR] id_provider = ldap auth_provider = ldap debug_level = 9 # Note that enabling enumeration will have a moderate performance impact. # Consequently, the default value for enumeration is FALSE. # Refer to the sssd.conf man page for full details. enumerate = true ldap_tls_cacert = /etc/ssl/certs/stroeder.com-server-ca-2009-07.crt ldap_auth_use_start_tls = False ldap_id_use_start_tls = False ldap_uri = ldaps://ldap.example.com:2342 ldap_sasl_mech = EXTERNAL ldap_tls_cert = /etc/sssd/ae-dir.example.com.crt ldap_tls_key = /etc/sssd/ae-dir.example.com.key ldap_search_base = ou=ae-dir ldap_schema = rfc2307bis ldap_user_object_class = posixAccount ldap_group_object_class = posixGroup # avoid protocol incompatibilities with newer sssd versions by disabling deref: ldap_deref_threshold = 0 ldap_user_home_directory = homeDirectory ldap_user_shell = loginShell ldap_user_ssh_public_key = sshPublicKey # Allow offline logins by locally storing password hashes (default: false). cache_credentials = true ldap_purge_cache_timeout = 3