# SSSD Manual pages

sssd-ad 5 File Formats and Conventions
sssd-ad SSSD Active Directory provider

### DESCRIPTION

This manual page describes the configuration of the AD provider for sssd 8 . For a detailed syntax reference, refer to the FILE FORMAT section of the sssd.conf 5 manual page.

The AD provider is a back end used to connect to an Active Directory server. This provider requires that the machine be joined to the AD domain and a keytab is available.

The AD provider supports connecting to Active Directory 2008 R2 or later. Earlier versions may work, but are unsupported.

The AD provider can be used to get user information and authenticate users from trusted domains. Currently only trusted domains in the same forest are recognized. In addition servers from trusted domains are always auto-discovered.

The AD provider accepts the same options used by the sssd-ldap 5 identity provider and the sssd-krb5 5 authentication provider with some exceptions described below.

However, it is neither necessary nor recommended to set these options. The AD provider can also be used as an access, chpass, sudo and autofs provider. No configuration of the access provider is required on the client side.

By default, the AD provider will map UID and GID values from the objectSID parameter in Active Directory. For details on this, see the ID MAPPING section below. If you want to disable ID mapping and instead rely on POSIX attributes defined in Active Directory, you should set

    ldap_id_mapping = False

In order to retrieve users and groups using POSIX attributes from trusted domains, the AD administrator must make sure that the POSIX attributes are replicated to the Global Catalog.

Users, groups and other entities served by SSSD are always treated as case-insensitive in the AD provider for compatibility with Active Directory's LDAP implementation.

### CONFIGURATION OPTIONS

Refer to the section DOMAIN SECTIONS of the sssd.conf 5 manual page for details on the configuration of an SSSD domain.

ad_domain (string)

  Specifies the name of the Active Directory domain. This is optional. If not provided, the configuration domain name is used.

  For proper operation, this option should be specified as the lower-case version of the long version of the Active Directory domain.

  The short domain name (also known as the NetBIOS or the flat name) is autodetected by the SSSD.

ad_server, ad_backup_server (string)

  The comma-separated list of hostnames of the AD servers to which SSSD should connect in order of preference. For more information on failover and server redundancy, see the FAILOVER section.

  This is optional if autodiscovery is enabled. For more information on service discovery, refer to the SERVICE DISCOVERY section.

  Note: Trusted domains will always auto-discover servers even if the primary server is explicitly defined in the ad_server option.

ad_hostname (string)

  Optional. May be set on machines where the hostname(5) does not reflect the fully qualified name used in the Active Directory domain to identify this host.

  This field is used to determine the host principal in use in the keytab. It must match the hostname for which the keytab was issued.

ad_enable_dns_sites (boolean)

  Enables DNS sites - location based service discovery.

  If true and service discovery (see Service Discovery paragraph at the bottom of the man page) is enabled, the SSSD will first attempt to discover the Active Directory server to connect to using the Active Directory Site Discovery and fall back to the DNS SRV records if no AD site is found. The DNS SRV configuration, including the discovery domain, is used during site discovery as well.

  Default: true

ad_access_filter (string)

  This option specifies LDAP access control filter that the user must match in order to be allowed access. Please note that the access_provider option must be explicitly set to ad in order for this option to have an effect.

  The option also supports specifying different filters per domain or forest. This extended filter would consist of: KEYWORD:NAME:FILTER. The keyword can be either DOM, FOREST or missing.

  If the keyword equals to DOM or is missing, then NAME specifies the domain or subdomain the filter applies to. If the keyword equals to FOREST, then the filter equals to all domains from the forest specified by NAME.

  Multiple filters can be separated with the ? character, similarly to how search bases work.

  The most specific match is always used. For example, if the option specified filter for a domain the user is a member of and a global filter, the per-domain filter would be applied. If there are more matches with the same specification, the first one is used.

  Examples:

      # apply filter on domain called dom1 only:
      dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)

      # apply filter on domain called dom2 only:
      DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)

      # apply filter on forest called EXAMPLE.COM only:
      FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)

  Default: Not set

ad_site (string)

  Specify AD site to which client should try to connect. If this option is not provided, the AD site will be auto-discovered.

  Default: Not set

ad_enable_gc (boolean)

  By default, the SSSD connects to the Global Catalog first to retrieve users from trusted domains and uses the LDAP port to retrieve group memberships or as a fallback. Disabling this option makes the SSSD only connect to the LDAP port of the current AD server.

  Please note that disabling Global Catalog support does not disable retrieving users from trusted domains. The SSSD would connect to the LDAP port of trusted domains instead. However, Global Catalog must be used in order to resolve cross-domain group memberships.

  Default: true

ad_gpo_access_control (string)

  This option specifies the operation mode for GPO-based access control functionality: whether it operates in disabled mode, enforcing mode, or permissive mode. Please note that the access_provider option must be explicitly set to ad in order for this option to have an effect.

  GPO-based access control functionality uses GPO policy settings to determine whether or not a particular user is allowed to logon to a particular host.

  NOTE: If the operation mode is set to enforcing, it is possible that users that were previously allowed logon access will now be denied logon access (as dictated by the GPO policy settings). In order to facilitate a smooth transition for administrators, a permissive mode is available that will not enforce the access control rules, but will evaluate them and will output a syslog message if access would have been denied. By examining the logs, administrators can then make the necessary changes before setting the mode to enforcing.

  There are three supported values for this option:

  - disabled: GPO-based access control rules are neither evaluated nor enforced.

  - enforcing: GPO-based access control rules are evaluated and enforced.

  - permissive: GPO-based access control rules are evaluated, but not enforced. Instead, a syslog message will be emitted indicating that the user would have been denied access if this option's value were set to enforcing.

  Default: permissive

  Default: enforcing

ad_gpo_cache_timeout (integer)

  The amount of time between lookups of GPO policy files against the AD server. This will reduce the latency and load on the AD server if there are many access-control requests made in a short period.

  Default: 5 (seconds)

ad_gpo_map_interactive (string)

  A comma-separated list of PAM service names for which GPO-based access control is evaluated based on the InteractiveLogonRight and DenyInteractiveLogonRight policy settings.

  Note: Using the Group Policy Management Editor this value is called "Allow log on locally" and "Deny log on locally".

  It is possible to add another PAM service name to the default set by using +service_name or to explicitly remove a PAM service name from the default set by using -service_name. For example, in order to replace a default PAM service name for this logon right (e.g. login) with a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_interactive = +my_pam_service, -login

  Default: the default set of PAM service names includes:

  - login

  - su

  - su-l

  - gdm-fingerprint

  - gdm-password

  - gdm-smartcard

  - kdm

  - lightdm

  - lxdm

  - sddm

  - xdm

ad_gpo_map_remote_interactive (string)

  A comma-separated list of PAM service names for which GPO-based access control is evaluated based on the RemoteInteractiveLogonRight and DenyRemoteInteractiveLogonRight policy settings.

  Note: Using the Group Policy Management Editor this value is called "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services".

  It is possible to add another PAM service name to the default set by using +service_name or to explicitly remove a PAM service name from the default set by using -service_name. For example, in order to replace a default PAM service name for this logon right (e.g. sshd) with a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_remote_interactive = +my_pam_service, -sshd

  Default: the default set of PAM service names includes:

  - sshd

  - cockpit

ad_gpo_map_network (string)

  A comma-separated list of PAM service names for which GPO-based access control is evaluated based on the NetworkLogonRight and DenyNetworkLogonRight policy settings.

  Note: Using the Group Policy Management Editor this value is called "Access this computer from the network" and "Deny access to this computer from the network".

  It is possible to add another PAM service name to the default set by using +service_name or to explicitly remove a PAM service name from the default set by using -service_name. For example, in order to replace a default PAM service name for this logon right (e.g. ftp) with a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_network = +my_pam_service, -ftp

  Default: the default set of PAM service names includes:

  - ftp

  - samba

ad_gpo_map_batch (string)

  A comma-separated list of PAM service names for which GPO-based access control is evaluated based on the BatchLogonRight and DenyBatchLogonRight policy settings.

  Note: Using the Group Policy Management Editor this value is called "Allow log on as a batch job" and "Deny log on as a batch job".

  It is possible to add another PAM service name to the default set by using +service_name or to explicitly remove a PAM service name from the default set by using -service_name. For example, in order to replace a default PAM service name for this logon right (e.g. crond) with a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_batch = +my_pam_service, -crond

  Default: the default set of PAM service names includes:

  - crond

ad_gpo_map_service (string)

  A comma-separated list of PAM service names for which GPO-based access control is evaluated based on the ServiceLogonRight and DenyServiceLogonRight policy settings.

  Note: Using the Group Policy Management Editor this value is called "Allow log on as a service" and "Deny log on as a service".

  It is possible to add a PAM service name to the default set by using +service_name. Since the default set is empty, it is not possible to remove a PAM service name from the default set. For example, in order to add a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_service = +my_pam_service

  Default: not set

ad_gpo_map_permit (string)

  A comma-separated list of PAM service names for which GPO-based access is always granted, regardless of any GPO Logon Rights.

  It is possible to add another PAM service name to the default set by using +service_name or to explicitly remove a PAM service name from the default set by using -service_name. For example, in order to replace a default PAM service name for unconditionally permitted access (e.g. sudo) with a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_permit = +my_pam_service, -sudo

  Default: the default set of PAM service names includes:

  - sudo

  - sudo-i

  - systemd-user

ad_gpo_map_deny (string)

  A comma-separated list of PAM service names for which GPO-based access is always denied, regardless of any GPO Logon Rights.

  It is possible to add a PAM service name to the default set by using +service_name. Since the default set is empty, it is not possible to remove a PAM service name from the default set. For example, in order to add a custom pam service name (e.g. my_pam_service), you would use the following configuration:

      ad_gpo_map_deny = +my_pam_service

  Default: not set

ad_gpo_default_right (string)

  This option defines how access control is evaluated for PAM service names that are not explicitly listed in one of the ad_gpo_map_* options. This option can be set in two different manners. First, this option can be set to use a default logon right. For example, if this option is set to 'interactive', it means that unmapped PAM service names will be processed based on the InteractiveLogonRight and DenyInteractiveLogonRight policy settings. Alternatively, this option can be set to either always permit or always deny access for unmapped PAM service names.

  Supported values for this option include:

  - interactive

  - remote_interactive

  - network

  - batch

  - service

  - permit

  - deny

  Default: deny

ad_maximum_machine_account_password_age (integer)

  SSSD will check once a day if the machine account password is older than the given age in days and try to renew it. A value of 0 will disable the renewal attempt.

  Default: 30 days

ad_machine_account_password_renewal_opts (string)

  This option should only be used to test the machine account renewal task. The option expect 2 integers seperated by a colon (':'). The first integer defines the interval in seconds how often the task is run. The second specifies the inital timeout in seconds before the task is run for the first time after startup.

  Default: 86400:750 (24h and 15m)

dyndns_update (boolean)

  Optional. This option tells SSSD to automatically update the Active Directory DNS server with the IP address of this client. The update is secured using GSS-TSIG. As a consequence, the Active Directory administrator only needs to allow secure updates for the DNS zone. The IP address of the AD LDAP connection is used for the updates, if it is not otherwise specified by using the dyndns_iface option.

  NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, the default Kerberos realm must be set properly in /etc/krb5.conf

  Default: true

dyndns_ttl (integer)

  The TTL to apply to the client DNS record when updating it. If dyndns_update is false this has no effect. This will override the TTL serverside if set by an administrator.

  Default: 3600 (seconds)

dyndns_iface (string)

  Optional. Applicable only when dyndns_update is true. Choose the interface or a list of interfaces whose IP addresses should be used for dynamic DNS updates. Special value * implies that IPs from all interfaces should be used.

  Default: Use the IP addresses of the interface which is used for AD LDAP connection

  Example: dyndns_iface = em1, vnet1, vnet2

dyndns_refresh_interval (integer)

  How often should the back end perform periodic DNS update in addition to the automatic update performed when the back end goes online. This option is optional and applicable only when dyndns_update is true.

  Default: 86400 (24 hours)

dyndns_update_ptr (bool)

  Whether the PTR record should also be explicitly updated when updating the client's DNS records. Applicable only when dyndns_update is true.

  Default: True

dyndns_force_tcp (bool)

  Whether the nsupdate utility should default to using TCP for communicating with the DNS server.

  Default: False (let nsupdate choose the protocol)

dyndns_server (string)

  The DNS server to use when performing a DNS update. In most setups, it's recommended to leave this option unset.

  Setting this option makes sense for environments where the DNS server is different from the identity server.

  Please note that this option will be only used in fallback attempt when previous attempt using autodetected settings failed.

  Default: None (let nsupdate choose the server)

krb5_use_enterprise_principal (boolean)

  Specifies if the user principal should be treated as enterprise principal. See section 5 of RFC 6806 for more details about enterprise principals.

  Default: true

  Note that this default differs from the traditional Kerberos provider back end.

krb5_confd_path (string)

  Absolute path of a directory where SSSD should place Kerberos configuration snippets.

  To disable the creation of the configuration snippets set the parameter to 'none'.

  Default: not set (krb5.include.d subdirectory of SSSD's pubconf directory)

### EXAMPLE

The following example assumes that SSSD is correctly configured and example.com is one of the domains in the [sssd] section. This example shows only the AD provider-specific options.

    [domain/EXAMPLE]
    id_provider = ad
    auth_provider = ad
    access_provider = ad
    chpass_provider = ad

    ad_server = dc1.example.com
    ad_hostname = client.example.com
    ad_domain = example.com

### NOTES

The AD access control provider checks if the account is expired. It has the same effect as the following configuration of the LDAP provider:

    access_provider = ldap
    ldap_access_order = expire
    ldap_account_expire_policy = ad

However, unless the ad access control provider is explicitly configured, the default access provider is permit. Please note that if you configure an access provider other than ad, you need to set all the connection parameters (such as LDAP URIs and encryption details) manually.

When the autofs provider is set to ad, the RFC2307 schema attribute mapping (nisMap, nisObject, ...) is used, because these attributes are included the default Active Directory schema.