Chapter 5. Additional configuration for identity and authentication providers

Procedure

1. Open the /etc/sssd/sssd.conf file.

2. Use the re_expression option to define a custom regular expression.

   1. To define regular expressions globally for all domains, add re_expression to the [sssd] section of the sssd.conf file.

      You can use the following global expression to define the username in the format of <domain>\_<username>_ or <domain>@<user_name>:

      [sssd]
      [... file truncated ...]
      re_expression = (?P_<domain>_[\\]*?)\\?(?P_<name>_[\\]+$)

   2. To define the regular expressions individually for a particular domain, add re_expression to the corresponding domain section of the sssd.conf file.

      You can use the following global expression to define the username in the format of <domain>\_<username>_ or <domain>@<user_name> for the LDAP domain:

      [domain/LDAP]
      [... file truncated ...]
      re_expression = (?P_<domain>_[\\]*?)\\?(?P_<name>_[\\]+$)

Procedure

1. As root, open the /etc/sssd/sssd.conf file.

2. To define the expansion globally for all domains, add full_name_format to the [sssd] section of sssd.conf.

   [sssd]
   [... file truncated ...]
   full_name_format = %1$s@%2$s

   In this case the user name is displayed as user@domain.test.

3. To define the user name printing format for a particular domain, add full_name_format to the corresponding domain section of sssd.conf.

   • To configure the expansion for the Active Directory (AD) domain using %2$s\%1$s:

     [domain/ad.domain]
     [... file truncated ...]
     full_name_format = %2$s\%1$s

     In this case the user name is displayed as ad.domain\user.

   • To configure the expansion for the Active Directory (AD) domain using %3$s\%1$s:

     [domain/ad.domain]
     [... file truncated ...]
     full_name_format = %3$s\%1$s

     In this case the user name is displayed as AD\user if the flat domain name of the Active Directory domain is set to AD.

   Note

   SSSD can strip the domain component of the name in some name configurations, which can cause authentication errors. If you set full_name_format to a non-standard value, you will get a warning prompting you to change it to a standard format.

Procedure

1. Open the /etc/sssd/sssd.conf file.

2. In a domain section, add the cache_credentials = true setting:

   [domain/<domain_name>]
   cache_credentials = true

3. Optional, but recommended: Configure a time limit for how long SSSD allows offline authentication if the identity provider is unavailable:

   1. Configure the PAM service to work with SSSD.

   2. Use the offline_credentials_expiration option to specify the time limit.

      Note that the limit is set in days.

      For example, to specify that users are able to authenticate offline for 3 days since the last successful login, use:

      [pam]
      offline_credentials_expiration = 3

Procedure

1. Open the /etc/sssd/sssd.conf file.

2. Set the primary server value to _srv_.

   For an LDAP provider, the primary server is set using the ldap_uri option:

   [domain/<ldap_domain_name>]
   id_provider = ldap
   ldap_uri = _srv_

3. Enable service discovery in the password change provider by setting a service type:

   [domain/<ldap_domain_name>]
   id_provider = ldap
   ldap_uri = _srv_
   
   chpass_provider = ldap
   ldap_chpass_dns_service_name = ldap

4. Optional: By default, the service discovery uses the domain portion of the system host name as the domain name. To use a different DNS domain, specify the domain name by using the dns_discovery_domain option.
5. Optional: By default, the service discovery scans for the LDAP service type. To use a different service type, specify the type by using the ldap_dns_service_name option.
6. Optional: By default, SSSD attempts to look up an IPv4 address. If the attempt fails, SSSD attempts to look up an IPv6 address. To customize this behavior, use the lookup_family_order option.

7. For every service with which you want to use service discovery, add a DNS record to the DNS server:

   _<service_name>.<protocol>.<domain_name> <TTL> <priority> <weight> <port_number> <hostname>_

Procedure

1. Open the /etc/sssd/sssd.conf file.

2. Set the access_provider option to simple:

   [domain/<domain_name>]
   access_provider = simple

3. Define the access control rules for users.

   1. To allow access to users, use the simple_allow_users option.
   2. To deny access to users, use the simple_deny_users option.
   Important

   If you deny access to specific users, you automatically allow access to everyone else. Allowing access to specific users is considered safer than denying.

4. Define the access control rules for groups. Choose one of the following:

   1. To allow access to groups, use the simple_allow_groups option.

   2. To deny access to groups, use the simple_deny_groups option.

      Important

      If you deny access to specific groups, you automatically allow access to everyone else. Allowing access to specific groups is considered safer than denying.

      For example, you can grant access to alice, bob, and members of the engineers group, while denying access to all other users:

      [domain/<domain_name>]
      access_provider = simple
      simple_allow_users = alice, bob
      simple_allow_groups = engineers

      Important

      Keeping the deny list empty can lead to allowing access to everyone.

   Note

   If you are adding a trusted AD user to the simple_allow_users list, ensure that you use the fully qualified domain name (FQDN) format, for example, aduser@ad.example.com. As short names in different domains can be the same, this prevents issues with the access control configuration.

Procedure

1. Open the /etc/sssd/sssd.conf file.

2. In the [domain] section, specify the access control filter.

   • For an LDAP, use the ldap_access_filter option.

   • For an AD, use the ad_access_filter option. Additionally, you must disable the GPO-based access control by setting the ad_gpo_access_control option to disabled.

     For example, to allow access only to AD users who belong to the admins user group and have a unixHomeDirectory attribute set, use:

     [domain/<ad_domain_name>]
     access provider = ad
     [... file truncated ...]
     ad_access_filter = (&(memberOf=cn=admins,ou=groups,dc=example,dc=com)(unixHomeDirectory=*))
     ad_gpo_access_control = disabled

     SSSD can also check results by the authorizedService or host attribute in an entry. In fact, all options MDASH LDAP filter, authorizedService, and host MDASH can be evaluated, depending on the user entry and the configuration. The ldap_access_order parameter lists all access control methods to use, ordered as how they should be evaluated.

     [domain/example.com]
     access_provider = ldap
     ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com
     ldap_access_order = filter, host, authorized_service