| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768 |
- #
- # sssd.conf
- # Generated by 389 Directory Server - dsidm
- #
- # For more details see man sssd.conf and man sssd-ldap
- # Be sure to review the content of this file to ensure it is secure and correct
- # in your environment.
- [domain/ldap]
- # Uncomment this for more verbose logging.
- # debug_level=3
- # Cache hashes of user authentication for offline auth.
- cache_credentials = True
- id_provider = ldap
- auth_provider = ldap
- access_provider = ldap
- chpass_provider = ldap
- ldap_schema = rfc2307
- ldap_search_base = dc=omnia,dc=test
- ldap_uri = ldapi://%2fvar%2frun%2fslapd-ldap1.socket
- # If you have DNS SRV records, you can use the following instead. This derives
- # from your ldap_search_base.
- # ldap_uri = _srv_
- ldap_tls_reqcert = demand
- # To use cacert dir, place *.crt files in this path then run:
- # /usr/bin/openssl rehash /etc/openldap/certs
- # or (for older versions of openssl)
- # /usr/bin/c_rehash /etc/openldap/certs
- ldap_tls_cacertdir = /etc/openldap/certs
- # Path to the cacert
- # ldap_tls_cacert = /etc/openldap/certs/ca.crt
- # Only users who match this filter can login and authorise to this machine. Note
- # that users who do NOT match, will still have their uid/gid resolve, but they
- # can't login.
- ldap_access_filter = (memberOf=cn=server_admins,ou=groups,dc=omnia,dc=test)
- enumerate = false
- access_provider = ldap
- ldap_user_member_of = memberof
- ldap_user_gecos = cn
- ldap_user_uuid = nsUniqueId
- ldap_group_uuid = nsUniqueId
- # This is really important as it allows SSSD to respect nsAccountLock
- ldap_account_expire_policy = rhds
- ldap_access_order = filter, expire
- # Setup for ssh keys
- # Inside /etc/ssh/sshd_config add the lines:
- # AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
- # AuthorizedKeysCommandUser nobody
- # You can test with the command: sss_ssh_authorizedkeys <username>
- ldap_user_ssh_public_key = nsSshPublicKey
- # This prevents an issue where the Directory is recursively walked on group
- # and user look ups. It makes the client faster and more responsive in almost
- # every scenario.
- ignore_group_members = False
- [sssd]
- services = nss, pam, ssh, sudo
- config_file_version = 2
- domains = ldap
- [nss]
- homedir_substring = /home
|
