Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 6. SSSD client-side view

The sss_override utility helps you to create a local view of user data. This tool modifies POSIX attributes on a specific machine without altering the central identity provider, handling conflicts or local requirements effectively.

You can configure overrides for all id_provider values, except ipa.

If you are using the ipa provider, define ID views centrally in IPA. For more information, see Using an ID view to override a user attribute value on an IdM client.

For information about a potential negative impact on the SSSD performance, see Potential negative impact of ID views on SSSD performance.

6.1. Overriding the LDAP username attribute
Copy link

LDAP user names may conflict with local system policies or naming conventions. Use the sss_override command to map a remote LDAP user name to a distinct local alias, ensuring compatibility with the specific host.

Prerequisites

  • root access
  • Have sssd-tools package installed

Procedure

  1. Display the current information for the user: 

    # id <ldap_username>

    Replace <ldap_username> with the LDAP username of the user. For example: 

    # id sjones
     
    uid=1001(sjones) gid=6003 groups=6003,10(wheel)

  2. Add the local username: 

    # sss_override user-add <ldap_username> -n <local_username>

    Replace <ldap_username> with the LDAP username and replace <local_username> with the desired local username. For example: 

    # sss_override user-add sjones -n sarah

  3. After creating the first override using the sss_override user-add command, restart SSSD for the changes to take effect: 

    # systemctl restart sssd

Verification

  • Verify that the local username is added: 

    # id <local_username>

    For example: 

    # id sarah
     
    uid=1001(sjones) gid=6003(sjones) groups=6003(sjones),10(wheel)
     
    # sss_override user-show sjones
user@ldap.example.com:sarah::::::

  • Optional: Display the overrides for the user: 

    # sss_override user-show <ldap_username>
     
    user@ldap.example.com:_<local_username>_::::::

6.2. Overriding the LDAP UID attribute
Copy link

Conflicting numeric identifiers can cause file permission errors. You can override the unique identifier (UID) provided by LDAP with a specific local value using sss_override, ensuring the user matches local file ownership requirements.

Prerequisites

  • root access
  • Have sssd-tools package installed

Procedure

  1. Display the current UID of the user: 

    # id -u <ldap_username>

    Replace <ldap_username> with the LDAP username of the user. For example: 

    # id -u sarah
     
    1001

  2. Override the UID of the user’s account: 

    # sss_override user-add <ldap_username> -u <local_uid>

    Replace <ldap_username> with the LDAP username of the user and replace <local_uid> with the new UID number. For example: 

    # sss_override user-add sarah -u 6666

  3. Expire the in-memory cache: 

    # sss_cache --users

  4. After creating the first override using the sss_override user-add command, restart SSSD for the changes to take effect: 

    # systemctl restart sssd

Verification

  • Verify that the local UID has been applied: 

    # id -u <ldap_username>

  • Optional: Display the overrides for the user: 

    # sss_override user-show <ldap_username>
     
    user@ldap.example.com::_<local_uid>_:::::

6.3. Overriding the LDAP GID attribute
Copy link

You can change the group identifier (GID) for an LDAP user on the local system. This action ensures the user’s primary group matches specific local requirements, facilitating correct file access and group membership.

Prerequisites

  • root access
  • Installed sssd-tools

Procedure

  1. Display the current GID of the user: 

    # id -g <ldap_username>

    Replace <ldap_username> with the name of the user. For example: 

    # id -g sarah
     
    6003

  2. Override the GID of the user’s account: 

    # sss_override user-add <ldap_username> -g <local_gid>

    Replace <ldap_username> with the name of the user and replace <local_gid> with the local GID number. For example: 

    # sss_override user-add sarah -g 6666

  3. Expire the in-memory cache: 

    # sss_cache --users

  4. After creating the first override using the sss_override user-add command, restart SSSD for the changes to take effect: 

    # systemctl restart sssd

Verification

  • Verify that the local GID is applied: 

    # id -g <ldap_username>

  • Optional: Display the overrides for the user: 

    # sss_override user-show <ldap_username>
     
    user@ldap.example.com::: 6666::::

6.4. Overriding the LDAP home directory attribute
Copy link

Remote home directory paths often do not exist on every client machine. Overriding this attribute helps you to map users to a valid local path, ensuring they land in an existing directory upon login.

Prerequisites

  • root access
  • Installed sssd-tools

Procedure

  1. Display the current home directory of the user as stored locally: 

    # getent passwd <ldap_username>
     
    <ldap_username>:x:XXXX:XXXX::/home/<home_directory>:/bin/bash

    Replace <ldap_username> with the name of the user. The output shows the home directory value as seen locally, which might be different from the LDAP record. For example: 

    # getent passwd sarah
     
    sarah:x:1001:6003::sarah:/bin/bash

  2. Override the home directory of the user: 

    # sss_override user-add <ldap_username> -h <new_home_directory>

    Replace <ldap_username> with the name of the user and replace <new_home_directory> with the new home directory. For example: 

    # sss_override user-add sarah -h admin

  3. Restart SSSD for the changes to take effect: 

    # systemctl restart sssd

Verification

  • Verify that the new home directory is defined: 

    # getent passwd <ldap_username>
     
    <ldap_username>:x:XXXX:XXXX::/home/<new_home_directory>:/bin/bash

  • Optional: Display the overrides for the user: 

    # sss_override user-show <ldap_username>
     
    user@ldap.example.com:::::::<new_home_directory>::

6.5. Overriding the LDAP shell attribute
Copy link

The default shell assigned in LDAP may be restricted or unavailable on specific clients. You can override this attribute to assign a valid local shell, such as /bin/bash or /sbin/nologin, appropriate for the host’s specific purpose.

Prerequisites

  • root access
  • Installed sssd-tools

Procedure

  1. Display the current shell of the user as stored locally: 

    # getent passwd <ldap_username>
     
    <ldap_username>:x:XXXX:XXXX::/home/<home_directory>:_<currentshell>_

    Replace <ldap_username> with the name of the user.

  2. Override the shell of the user: 

    # sss_override user-add <ldap_username> -s <new_shell>

    Replace <ldap_username> with the name of the user and replace <new_shell> with the new shell.

  3. Restart SSSD for the changes to take effect: 

    # systemctl restart sssd

Verification

  • Verify that the new shell is defined: 

    # getent passwd <ldap_username>
     
    <ldap_username>:x:XXXX:XXXX::/home/<home_directory>:_<new_shell>_

  • Optional: Display the overrides for the user: 

    # sss_override user-show <ldap_username>
     
    user@ldap.example.com::::::_<new_shell>_:

    For example, to change the shell of the user sarah from /bin/bash to sbin/nologin:

    1. Display the current shell of the user sarah: 

      # getent passwd sarah
       
      sarah:x:1001:6003::sarah:/bin/bash

    2. Override the shell of the user sarah with new /sbin/nologin shell: 

      # sss_override user-add sarah -s /sbin/nologin

    3. Restart SSSD for the changes to take effect: 

      # systemctl restart sssd

    4. Verify that the new shell is defined and overrides for the user display correctly: 

      # getent passwd sarah
       
      sarah:x:1001:6003::sarah:/sbin/nologin
       
      # sss_override user-show sarah
       
      user@ldap.example.com::::::/sbin/nologin:

6.6. Listing overrides on a host
Copy link

You must audit local modifications to ensure configuration consistency. The sss_override tool provides search functions to list all currently active user and group overrides stored in the local cache.

Prerequisites

  • root access
  • Installed sssd-tools

Procedure

  • List all user overrides: 

    # sss_override user-find
     
    user1@ldap.example.com::8000::::/bin/zsh:
user2@ldap.example.com::8001::::/bin/bash:
...

  • List all group overrides: 

    # sss_override group-find
     
    group1@ldap.example.com::7000
group2@ldap.example.com::7001
...

6.7. Removing a local override
Copy link

Removing an override reverts the user or group attributes to the values provided by the central directory. Use deletion commands to clean up obsolete configurations or restore default identity data immediately.

Prerequisites

  • root access
  • Installed sssd-tools

Procedure

  • To remove the override for a user account, use: 

    # sss_override user-del <local_username>

    Replace <local_username> with the name of the user. The changes take effect immediately.

  • To remove an override for a group, use: 

    # sss_override group-del <group_name>

  • After removing the first override using the sss_override user-del or sss_override group-del command, restart SSSD for the changes to take effect: 

    # systemctl restart sssd

    When you remove overrides for a user or group, all overrides for this object are removed.

6.8. Exporting and importing local view
Copy link

Local overrides reside in the SSSD cache and risk deletion during cache clearing. Exporting these configurations to a backup file helps you to restore custom views quickly after system maintenance or migrations.

Prerequisites

  • root access
  • Installed sssd-tools

Procedure

  • To back up user and group view, use: 

    # sss_override user-export /var/lib/sss/backup/sssd_user_overrides.bak
# sss_override group-export /var/lib/sss/backup/sssd_group_overrides.bak

  • To restore user and group view, use: 

    # sss_override user-import /var/lib/sss/backup/sssd_user_overrides.bak
# sss_override group-import /var/lib/sss/backup/sssd_group_overrides.bak
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top