[sssd] config_file_version = 2 # Number of times services should attempt to reconnect in the # event of a crash or restart before they give up reconnection_retries = 3 # If a back end is particularly slow you can raise this timeout here sbus_timeout = 30 services = nss, pam # SSSD will not start if you do not configure any domains. # Add new domain configurations as [domain/] sections, and # then add the list of domains (in the order you want them to be # queried) to the "domains" attribute below and uncomment it. # domains = LOCAL,LDAP domains = default [nss] # The following prevents SSSD from searching for the root user/group in # all domains (you can add here a comma-separated list of system accounts that # are always going to be /etc/passwd users, or that you want to filter out). filter_groups = root filter_users = root reconnection_retries = 3 # The entry_cache_timeout indicates the number of seconds to retain an # entry in cache before it is considered stale and must block to refresh. # The entry_cache_nowait_timeout indicates the number of seconds to # wait before updating the cache out-of-band. (NSS requests will still # be returned from cache until the full entry_cache_timeout). Setting this # value to 0 turns this feature off (default). # entry_cache_timeout = 600 # entry_cache_nowait_timeout = 300 [pam] reconnection_retries = 3 # Example domain configurations # Note that enabling enumeration in the following configurations will have a # moderate performance impact while enumerations are actually running, and # may increase the time necessary to detect network disconnection. # Consequently, the default value for enumeration is FALSE. # Refer to the sssd.conf man page for full details. # Example LOCAL domain that stores all users natively in the SSSD internal # directory. These local users and groups are not visible in /etc/passwd; it # now contains only root and system accounts. # [domain/LOCAL] # description = LOCAL Users domain # id_provider = local # enumerate = true # min_id = 500 # max_id = 999 # Example native LDAP domain # ldap_schema can be set to "rfc2307", which uses the "memberuid" attribute # for group membership, or to "rfc2307bis", which uses the "member" attribute # to denote group membership. Changes to this setting affect only how we # determine the groups a user belongs to and will have no negative effect on # data about the user itself. If you do not know this value, ask an # administrator. # [domain/LDAP] # id_provider = ldap # auth_provider = ldap # ldap_schema = rfc2307 # ldap_uri = ldap://ldap.mydomain.org # ldap_search_base = dc=mydomain,dc=org # ldap_tls_reqcert = demand # cache_credentials = true # enumerate = False # Example LDAP domain where the LDAP server is an Active Directory server. # [domain/AD] # description = LDAP domain with AD server # enumerate = false # min_id = 1000 # # id_provider = ldap # auth_provider = ldap # ldap_uri = ldap://your.ad.server.com # ldap_schema = rfc2307bis # ldap_user_search_base = cn=users,dc=example,dc=com # ldap_group_search_base = cn=users,dc=example,dc=com # ldap_default_bind_dn = cn=Administrator,cn=Users,dc=example,dc=com # ldap_default_authtok_type = password # ldap_default_authtok = YOUR_PASSWORD # ldap_user_object_class = person # ldap_user_name = msSFU30Name # ldap_user_uid_number = msSFU30UidNumber # ldap_user_gid_number = msSFU30GidNumber # ldap_user_home_directory = msSFU30HomeDirectory # ldap_user_shell = msSFU30LoginShell # ldap_user_principal = userPrincipalName # ldap_group_object_class = group # ldap_group_name = msSFU30Name # ldap_group_gid_number = msSFU30GidNumber # ldap_force_upper_case_realm = True [domain/default] debug_level = 10 cache_credentials = True id_provider = ldap chpass_provider = krb5 auth_provider = krb5 ldap_search_base = dc=net,dc=wm,dc=edu ldap_tls_cacertdir = /etc/openldap/cacerts ldap_uri = ldap://titan.safety.net.wm.edu # ldap_id_use_start_tls = True krb5_realm = NET.WM.EDU krb5_server = titan.safety.net.wm.edu krb5_kdcip = titan.safety.net.wm.edu krb5_renewable_lifetime = 5m krb5_renew_interval = 30