17.3. Authentication policies

Use authentication policies to configure the available online and local authentication methods.

Use the local_auth_policy option in the /etc/sssd/sssd.conf file to configure the available online and offline authentication methods. By default, the authentication is performed only with the methods that the server side of the service supports. You can tune the policy with the following values:

The following configuration example allows local users to authenticate locally using smart card authentication:

[domain/shadowutils]
id_provider = proxy
proxy_lib_name = files
auth_provider = none
local_auth_policy = only

The local_auth_policy option applies to the passkey and smart card authentication methods.