SSSD-LDAP(5) NAME sssd-ldap - LDAP SSSD LDAP sssd(8). , << >> sssd.conf(5). SSSD LDAP. LDAP (id), (auth), (access) (chpass). LDAP, TLS/SSL LDAPS. sssd . LDAP , . , "ldap_access_filter", LDAP, . , SSSD, LDAP. << >> sssd.conf(5), . , ' LDAP SSSD sssd-ldap-attributes(5). ldap_uri, ldap_backup_uri () LDAP, , SSSD ' . <<>>, . , . << >>. , RFC 2732: ldap[s]://<>[:] IPv6 <> , [] : ldap://[fc00::126:25]:389 ldap_chpass_uri, ldap_chpass_backup_uri () LDAP, , SSSD ' . <<>>, . , , ldap_chpass_dns_service_name. : , ldap_uri. ldap_search_base () , LDAP. SSSD 1.7.0, SSSD : _[??[][?_??[]]*] , <> (), <> ( ) <> (). LDAP, http://www.ietf.org/rfc/rfc2254.txt : ldap_search_base = dc=example,dc=com ( ) ldap_search_base = dc=example,dc=com?subtree? ldap_search_base = cn=host_specific,dc=example,dc=com?subtree?(host=thishost)?dc=example.com?subtree? : ' ( ) . '. : , defaultNamingContext namingContexts RootDSE LDAP. defaultNamingContext , namingContexts. , namingContexts DN LDAP. . ldap_read_rootdse () SSSD RootDSE, LDAP . . , LDAP. , SSSD. : o anonymous o authenticated o never , <>, SSSD RootDSE. , SSSD . : anonymous ldap_schema () , LDAP . , , , . . : o rfc2307 o rfc2307bis o IPA o AD . rfc2307, memberUid. rfc2307bis IPA, (DN) member. AD, Active Directory 2008r2. : rfc2307 ldap_pwmodify_mode () , . : o exop -- (RFC 3062) o ldap_modify -- userPassword ( ). o exop_force - (RFC 3062), . LDAP, , ' . : ' ' , . ' , , userPassword. : exop ldap_default_bind_dn () ', LDAP. ldap_default_authtok_type () '. : password obfuscated_password : password , sss_obfuscate(8). ldap_default_authtok () '. ldap_force_upper_case_realm ( ) , Active Directory, UPN ( ), . , . : false ldap_enumeration_refresh_timeout ( ) , SSSD . : 300 ldap_purge_cache_timeout ( ) ( , ) . . , , , , , . , , , 3 . subdomain_inherit. : 0 () ldap_group_nesting_level ( ) ldap_schema , ( RFC2307bis), , SSSD. , RFC2307. : - . , , . , , . ldap_group_nesting_level 0, . , ' Active-Directory Server 2008 "id_provider=ad", (Token-Groups) ldap_use_tokengroups false . : 2 ldap_use_tokengroups Token-Groups initgroup Active Directory Server 2008 . subdomain_inherit. : True AD IPA, False. ldap_host_search_base () '. ' . <>, . : ldap_search_base ldap_subid_ranges_search_base (string) '. ' '. Default: the value of cn=subids,%basedn for IPA otherwise ldap_search_base. ldap_service_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). ldap_iphost_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). ldap_ipnetwork_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). ldap_search_timeout ( ) ( ) ldap, ( ) : SSSD. , . subdomain_inherit. : 6 ldap_enumeration_search_timeout ( ) ( ) ldap, ( ) : 60 ldap_network_timeout ( ) ( ), poll(2)/select(2) connect(2) . subdomain_inherit. : 6 ldap_opt_timeout ( ) ( ), LDAP , . KDC ' SASL, ' LDAP, StartTLS. subdomain_inherit. : 8 ldap_connection_expire_timeout ( ) ( ), ' LDAP. '. SASL/GSSAPI ( TGT). ' ( ) ldap_opt_timeout , , , ' . , , ' , ldap_connection_expire_timeout <= ldap_opt_timout , ldap_connection_expire_offset subdomain_inherit. : 900 (15 ) ldap_connection_expire_offset ( ) 0 , ldap_connection_expire_timeout. subdomain_inherit. : 0 ldap_connection_idle_timeout ( ) ( ), ' LDAP. ' , ' . , 0. subdomain_inherit. : 900 (15 ) ldap_page_size ( ) , LDAP . LDAP . : 1000 ldap_disable_paging ( ) LDAP. , LDAP LDAP RootDSE, . : OpenLDAP , , , RootDSE, . : 389 DS , ' , '. . : False ldap_disable_range_retrieval ( ) Active Directory. Active Directory MaxValRange ( 1500 ) , . , AD . , SSSD . , . SSSD . MaxValRange Active Directory. : False ldap_sasl_minssf ( ) LDAP SASL , '. OpenLDAP. : (, ldap.conf) ldap_sasl_maxssf ( ) LDAP SASL , '. OpenLDAP. : (, ldap.conf) ldap_deref_threshold ( ) , . , . 0. , , SSSD, HBAC IPA, , , , ' rootDSE. -- LDAP. LDAP . 389/RHDS, OpenLDAP Active Directory. : , , . : 10 ldap_ignore_unreadable_references ( ) LDAP, . <>, , , . , AD, ', sssd ' AD, LDAP . : False ldap_tls_reqcert () , TLS, . : never = . allow = . , . , . try = . , . , . demand = . , . hard = , "demand" : hard ldap_tls_cacert () , , sssd. : OpenLDAP, /etc/openldap/ldap.conf ldap_tls_cacertdir () , (CA). <<.0>>. openssl rehash c_rehash, . : OpenLDAP, /etc/openldap/ldap.conf ldap_tls_cert () , . : not set ldap_tls_key () , . : not set ldap_tls_cipher_suite () . . ldap.conf(5). : OpenLDAP, /etc/openldap/ldap.conf ldap_id_use_start_tls ( ) , ' id_provider tls . true . : true ldap_id_mapping ( ) , SSSD ldap_user_objectsid ldap_group_objectsid, ldap_user_uid_number ldap_group_gid_number. objectSID ActiveDirectory. : false ldap_min_id, ldap_max_id ( ) ' SID, , ldap_id_mapping true, ldap_user_uid_number ldap_group_gid_number . . , ldap_min_id ldap_max_id , . ' . : ( 0) ldap_sasl_mech () SASL, . GSSAPI GSS-SPNEGO. , ldap_sasl_mech . , ldap_sasl_mech . sssd.conf(5). : not set ldap_sasl_authid () SASL, . GSSAPI/GSS-SPNEGO, Kerberos, . ( host/myhost@EXAMPLE.COM) ( host/myhost). , : hostname@REALM netbiosname$@REALM host/hostname@REALM *$@REALM host/*@REALM netbiosname$@* host/* , . : /_@ ldap_sasl_realm () SASL, . , krb5_realm. ldap_sasl_authid , . : krb5_realm. ldap_sasl_canonicalize ( ) true (1), LDAP ' SASL. : false; ldap_krb5_keytab () , SASL/GSSAPI/GSS-SPNEGO. subdomain_inherit. : , /etc/krb5.keytab ldap_krb5_init_creds ( ) , id_provider Kerberos (TGT). , SASL GSSAPI GSS-SPNEGO. : true ldap_krb5_ticket_lifetime ( ) ( ) TGT, GSSAPI GSS-SPNEGO. subdomain_inherit. : 86400 (24 ) krb5_server, krb5_backup_server () IP- , , Kerberos, SSSD '. . <<>>. ( ). , . << >>. KDC kpasswd SSSD DNS, _udp. _tcp , . SSSD <>. , <> . krb5_realm () Kerberos ( SASL/GSSAPI/GSS-SPNEGO). : , . /etc/krb5.conf krb5_canonicalize ( ) , ' LDAP. MIT Kerberos >= 1.7 : false krb5_use_kdcinfo ( ) , SSSD Kerberos, KDC . , . , Kerberos krb5.conf(5). . (man) sssd_krb5_locator_plugin(8), . : true ldap_pwd_policy () . : none -- . . shadow -- shadow(5) , . mit_kerberos -- MIT Kerberos . chpass_provider=krb5 . : none : , , . ldap_referrals ( ) , . , sssd , OpenLDAP 2.4.13 . , . Microsoft Active Directory. ', <> . , false , LDAP SSSD Microsoft Active Directory. SSSD AD DC, . : true ldap_dns_service_name () , . : ldap ldap_chpass_dns_service_name () , LDAP, , . : , ldap_chpass_update_last_change ( ) , ldap_user_shadow_last_change . It is recommended to set this option explicitly if "ldap_pwd_policy = shadow" is used to let SSSD know if the LDAP server will update shadowLastChange LDAP attribute automatically after a password change or if SSSD has to update it. : False ldap_access_filter () access_provider = ldap ldap_access_order = filter ( ), '. LDAP, . access_provider = ldap ldap_access_order = filter, , . , access_provider = permit. , , LDAP, , (, memberOf AD ). , , , sssd-simple(5). : access_provider = ldap ldap_access_filter = (employeeType=admin) , employeeType <>. , . , . , . : ldap_account_expire_policy () . , , , LDAP ' , . : shadow: ldap_user_shadow_expire , . ad: 32- ldap_user_ad_user_account_control , . , . , . rhds, ipa, 389ds: ldap_ns_account_lock. nds: ldap_user_nds_login_allowed_time_map, ldap_user_nds_login_disabled ldap_user_nds_login_expiration_time. , . , , ldap_access_order "expire", ldap_account_expire_policy. : ldap_access_order () . : filter: ldap_access_filter lockout: . , , ldap <> <<000001010000Z>>. , ldap_pwdlockout_dn. , <>. , , <>, . ppolicy: . , ldap <> <<000001010000Z>> , . <> <>, UTC. , , . ldap_pwdlockout_dn. , , <>. expire: ldap_account_expire_policy pwd_expire_policy_reject, pwd_expire_policy_warn, pwd_expire_policy_renew: , , , , SSH. , , : o pwd_expire_policy_reject -- , o pwd_expire_policy_warn -- , o pwd_expire_policy_renew -- . , , , , <>. , <> shadow mit_kerberos. . authorized_service: authorizedService host: rhost: rhost , , , rhost pam . , pam, . : filter , , . ldap_pwdlockout_dn () DN LDAP. , , , sssd.conf, , ppolicy LDAP . : cn=ppolicy,ou=policies,dc=example,dc=com : cn=ppolicy,ou=policies,$ldap_search_base ldap_deref () . : never: . searching: ', ' . finding: ' . always: , ' . : ( LDAP never) ldap_rfc2307_fallback_to_local_users ( ) LDAP , RFC2307. , RFC2307, LDAP memberUid. , , SSSD , << >>, , nsswitch getpw*() initgroups(). , initgroups() LDAP. : false wildcard_limit ( ) , -. - InfoPipe. : 1000 ( ) ldap_library_debug_level ( ) libldap . libldap debug_level. OpenLDAP , -1 . : 0 ( libldap ) ldap_use_ppolicy ( ) . , . : true ldap_ppolicy_pwd_change_threshold ( ) , , , , . , 2, 2 : . : 0 SUDO sudo_provider (man) sssd-sudo(5). ldap_sudo_full_refresh_interval ( ) sudo SSSD . , . ldap_sudo_smart_refresh_interval 0. , ' . : 21600 (6 ) ldap_sudo_smart_refresh_interval ( ) sudo SSSD . , USN USN, SSSD. USN , modifyTimestamp. : USN : 1) sudo ( ), 2) ( ) 3) ' (, 15 , . ldap_connection_expire_timeout). 0. , ' . : 900 (15 ) ldap_sudo_random_offset ( ) 0 , . . , SSSD, sudo. , sudo . , 0. : 0 () ldap_sudo_use_host_filter ( ) true, SSSD , ' ( IPv4 IPv6 ). : true ldap_sudo_hostnames () , , . , SSSD ' . ldap_sudo_use_host_filter false, . : ldap_sudo_ip () IPv4 IPv6 . , SSSD . ldap_sudo_use_host_filter false, . : ldap_sudo_include_netgroups ( ) true, SSSD , (netgroup) sudoHost. ldap_sudo_use_host_filter false, . : true ldap_sudo_include_regexp ( ) true, SSSD , sudoHost. ldap_sudo_use_host_filter false, . Note - LDAP! : false . , ' sudo, sudoers.ldap(5). AUTOFS , , LDAP. ldap_autofs_map_master_name () LDAP. : auto.master ldap_autofs_map_object_class () ' LDAP. : nisMap (rfc2307, autofs_provider=ad), automountMap ldap_autofs_map_name () LDAP. : nisMapName (rfc2307, autofs_provider=ad), automountMapName ldap_autofs_entry_object_class () ' LDAP. . : nisObject (rfc2307, autofs_provider=ad), automount ldap_autofs_entry_key () LDAP. . : cn (rfc2307, autofs_provider=ad), automountKey ldap_autofs_entry_value () LDAP. . : nisMapEntry (rfc2307, autofs_provider=ad), automountInformation , , , ssd.conf - ' autofs , SSSD. LDAP, . , , . ldap_netgroup_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). ldap_user_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). ldap_group_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). Note "ldap_use_tokengroups", Active Directory -- , ' GID. , . ldap_sudo_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). ldap_autofs_search_base () DN, LDAP LDAP . : search_base[?scope?[filter][?search_base?scope?[filter]]*] , <> (), <> ( ) <> (). 4.5.1.2 http://tools.ietf.org/html/rfc4511 LDAP, http://www.ietf.org/rfc/rfc2254.txt <>. : ldap_search_base , , Active Directory . (Range Retrieval). , ' . , . . . - . : . , , , ' . , 31 . SSSD ' . , . ' . '. , ' ' . ' ' . , ' '. ' , , . ' ' , . ' ' , , , . 30 . ' , ' 30 . ' DNS , , . , SSSD . SSSD , ' , . . , sssd.conf(5). dns_resolver_server_timeout , SSSD DNS, ' . : 1000 dns_resolver_op_timeout , , SSSD DNS ( SRV), . : 3 dns_resolver_timeout SSSD . , DNS SRV . : 6 LDAP ' LDAP. "ldap_opt_timeout" , "dns_resolver_timeout", "dns_resolver_op_timeout", "dns_resolver_server_timeout". ' , DNS. . , . , . , <<_srv_>>, . . , , , , , , DNS . <> (man) sssd.conf(5). _tcp. . RFC 2782. SSSD Active Directory POSIX . : , uidNumber gidNumber . . , . , , , ' , . SSSD , , SSSD. , , , . . sss_cache(8), : o , . o SSSD o o SSSD , , , . Active Directory objectSID ' . objectSID , Active Directory (RID) ' . SSSD UID , <<>>. , Active Directory. SSSD , SSSD . , : SID murmurhash3 32- . . : . , ' ( , ). , POSIX Active Directory ( ) , . <<>>. ( "[domain/_]"): ldap_id_mapping = True ldap_schema = ad 10000 , 200000 , 2000000 2000200000. . ldap_idmap_range_min ( ) () POSIX, SID Active Directory. POSIX, '. : "min_id" , "min_id" , . , "min_id" "ldap_idmap_range_min" : 200000 ldap_idmap_range_max ( ) () POSIX, SID Active Directory. POSIX, ', , , '. : "max_id" , "max_id" , . , "max_id" "ldap_idmap_range_max" : 2000200000 ldap_idmap_range_size ( ) . , . : RID Active Directory. - RID, , . : Active Directory objectSid=S-1-5-21-2153326666-2176343378-3404031434-1107, <> , 1108, RID RID 1. (, 1108 = 1107 - 0 + 1). , ' , . : 200000 ldap_idmap_default_domain_sid () SID . , murmurhash . : not set ldap_idmap_default_domain () . : not set ldap_idmap_autorid_compat ( ) , "idmap_autorid" winbind. , , . : ( ). , winbind, , "ldap_idmap_default_domain_sid" . : False ldap_idmap_helper_table_size ( ) , ' UNIX SID. : ' SID UNIX , RID SID . ldap_idmap_helper_table_size 0, . : 10 SID SSSD (Well-Known) SID, SID . , ' SID Linux/UNIX, POSIX ' . SID , . (Well-Known) SID o (Null Authority) o (World Authority) o (Local Authority) o (Creator Authority) o ' o o NT (NT Authority) o (Built-in) (Well-Known) SID. SID , , SSSD SID . , (Well-Known) SID . , sssd.conf : <>, <>, <>, <>, <>, <>, <> <>. , SSSD , LDAP [domains]. [domain/LDAP] id_provider = ldap auth_provider = ldap ldap_uri = ldap://ldap.mydomain.org ldap_search_base = dc=mydomain,dc=org ldap_tls_reqcert = demand cache_credentials = true LDAP , SSSD ldap_access_order=lockout. [domain/LDAP] id_provider = ldap auth_provider = ldap access_provider = ldap ldap_access_order = lockout ldap_pwdlockout_dn = cn=ppolicy,ou=policies,dc=mydomain,dc=org ldap_uri = ldap://ldap.mydomain.org ldap_search_base = dc=mydomain,dc=org ldap_tls_reqcert = demand cache_credentials = true (man) ldap.conf(5) OpenLDAP 2.4. sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd- krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd- sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) AUTHORS SSSD -- https://pagure.io/SSSD/sssd/ SSSD 06/09/2026 SSSD-LDAP(5)