Chapter 2. Using Active Directory as an Identity Provider for SSSD
The System Security Services Daemon (SSSD) is a system service to access remote directories and authentication mechanisms. It connects a local system (an SSSD client) to an external back-end system (a domain). This provides the SSSD client with access to identity and authentication remote services using an SSSD provider. For example, these remote services include: an LDAP directory, an Identity Management (IdM) or Active Directory (AD) domain, or a Kerberos realm.
When used as an identity management service for AD integration, SSSD is an alternative to services such as NIS or Winbind. This chapter describes how SSSD works with AD. For more details on SSSD, see the System-Level Authentication Guide.
2.1. How the AD Provider Handles Trusted Domains
This section describes how SSSD handles trusted domains if you set
id_provider = ad in the /etc/sssd/sssd.conf file.
- SSSD only supports domains in a single Active Directory forest. If SSSD requires access to multiple domains from multiple forests, consider using IdM with trusts (preferred) or the
winbinddservice instead of SSSD. - By default, SSSD discovers all domains in the forest and, if a request for an object in a trusted domain arrives, SSSD tries to resolve it.If the trusted domains are not reachable or geographically distant, which makes them slow, you can set the
ad_enabled_domainsparameter in/etc/sssd/sssd.confto limit from which trusted domains SSSD resolves objects. - By default, you must use fully-qualified user names to resolve users from trusted domains.
