Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 9. Querying domain information using SSSD

You can use sssctl to retrieve and analyze domain-related data from the System Security Services Daemon (SSSD). SSSD can list domains in Identity Management (IdM) as well as the domains in Active Directory that is connected to IdM by a cross-forest trust.

You can list available domains, check their status, and troubleshoot identity and authentication issues.

9.1. Listing domains using sssctl

You can use the sssctl domain-list command to debug problems with the domain topology.

Note

The status might not be available immediately. If the domain is not visible, repeat the command.

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  1. Optional: To display help for the sssctl command, enter: 

    [user@client1 ~]$ sssctl --help
....
    Copy to Clipboard
  2. To display a list of available domains, enter: 
[root@client1 ~]# sssctl domain-list
implicit_files
idm.example.com
ad.example.com
sub1.ad.example.com
Copy to Clipboard

The list includes domains in the cross-forest trust between Active Directory and Identity Management.

9.2. Verifying the domain status using sssctl

You can use the sssctl domain-status command to debug problems with the domain topology.

Note

The status might not be available immediately. If the domain is not visible, repeat the command.

Prerequisites

  • You must be logged in with administrator privileges.

Procedure

  1. Optional: To display help for the sssctl command, enter: 

    [user@client1 ~]$ sssctl --help
    Copy to Clipboard

  2. To display user data for a particular domain, replace <domain_name> with the actual domain name and enter: 

    [root@client1 ~]# sssctl domain-status <domain_name>
    Copy to Clipboard

    Example output for the domain idm.example.com

    Online status: Online

Active servers:
IPA: server.idm.example.com

Discovered IPA servers:
- server.idm.example.com
    Copy to Clipboard

    The domain idm.example.com is online and visible from the client where you applied the command.

If the domain is not available, the result is: 

[root@client1 ~]# sssctl domain-status <domain_name>
Unable to get online status
Copy to Clipboard
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat