src/man/sssd.conf.5.xml - master - githubmirror/sssd

src/man/sssd.conf.5.xml
4 828 строк234 KB
Masahiro Matsuya
man: document pwfield per-domain usage in NSS section
04 авг 2026, 15:28
04 авг 2026, 15:28e3f869d
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE reference PUBLIC "-//OASIS//DTD DocBook V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"
[
<!ENTITY sssd_user_name SYSTEM "sssd_user_name.include">
<!ENTITY sssd_conf_dir SYSTEM "sssd_conf_dir.include">
<!ENTITY sssd_vendor_dir SYSTEM "sssd_vendor_dir.include">
]>
<reference>
<title>SSSD Manual pages</title>
<refentry>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/upstream.xml" />

    <refmeta>
        <refentrytitle>sssd.conf</refentrytitle>
        <manvolnum>5</manvolnum>
        <refmiscinfo class="manual">File Formats and Conventions</refmiscinfo>
    </refmeta>

    <refnamediv id='name'>
        <refname>sssd.conf</refname>
        <refpurpose>the configuration file for SSSD</refpurpose>
    </refnamediv>

    <refsect1 id='file-format'>
        <title>FILE FORMAT</title>

        <para>
            The file has an ini-style syntax and consists of sections and
            parameters. A section begins with the name of the section in
            square brackets and continues until the next section begins. An
            example of section with single and multi-valued parameters:
            <programlisting>
<replaceable>[section]</replaceable>
<replaceable>key</replaceable> = <replaceable>value</replaceable>
<replaceable>key2</replaceable> = <replaceable>value2,value3</replaceable>
            </programlisting>
        </para>

        <para>
            The data types used are string (no quotes needed), integer
            and boolean (with values of <quote>TRUE/FALSE</quote>).
            Boolean values are case-insensitive; for example, <quote>TRUE</quote>,
            <quote>True</quote> and <quote>true</quote> are all equivalent and
            valid; the same applies to <quote>FALSE</quote>.
        </para>

        <para>
            A comment line starts with a hash sign (<quote>#</quote>) or a
            semicolon (<quote>;</quote>).
            Inline comments are not supported.
        </para>

        <para>
            All sections can have an optional
            <replaceable>description</replaceable> parameter. Its function
            is only as a label for the section.
        </para>

        <para condition="without_non_root_user_support">
            <filename>sssd.conf</filename> must be a regular file that is owned,
            readable, and writeable only by 'root'.
        </para>
        <para condition="with_non_root_user_support">
            <filename>sssd.conf</filename> must be a regular file that is
            accessible only by the user used to run SSSD service or root.
        </para>
    </refsect1>

    <refsect1 id='config-snippets'>
        <title>CONFIGURATION SNIPPETS FROM INCLUDE DIRECTORY</title>

        <para>
            The configuration file <filename>sssd.conf</filename> will
            include configuration snippets using the include directory
            <filename>conf.d</filename>.
        </para>

        <para>
            Any file placed in <filename>conf.d</filename>
            that ends in <quote><filename>.conf</filename></quote>
            and does not begin with a dot (<quote>.</quote>) will
            be used together with <filename>sssd.conf</filename>
            to configure SSSD.
        </para>

        <para>
            The configuration snippets from <filename>conf.d</filename>
            have higher priority than <filename>sssd.conf</filename>
            and will override <filename>sssd.conf</filename> when
            conflicts occur. If several snippets are present in
            <filename>conf.d</filename>, then they are included in
            alphabetical order (based on locale).
            Files included later have higher priority. Numerical
            prefixes (<filename>01_snippet.conf</filename>,
            <filename>02_snippet.conf</filename> etc.) can help
            visualize the priority (higher number means higher
            priority).
        </para>

        <para>
            The snippet files require the same owner and permissions
            as <filename>sssd.conf</filename>.
        </para>
    </refsect1>

    <refsect1 id='vendor-dir' condition="have_vendordir">
        <title>VENDOR PROVIDED CONFIGURATION</title>

        <para>
          The vendor provided configuration file is installed in
          <filename>&sssd_vendor_dir;/sssd.conf</filename>, but this file must
          not be directly edited. It can be completely masked by creating the
          system specific configuration file
          <filename>&sssd_conf_dir;/sssd.conf</filename>, or partly overriden
          by creating config snippets in
          <filename>&sssd_conf_dir;/conf.d</filename> directory.
        </para>
        <refsect2 id='vendor-dir-conf-hierarchy'>
          <title>CONFIGURATION FILE HIERARCHY</title>
        <para>
          When sssd reads the configuration it first tries to open the system
          specific configuration file in
          <filename>&sssd_conf_dir;/sssd.conf</filename>. If it exists, it is
          loaded and snippets from <filename>&sssd_conf_dir;/conf.d</filename>
          are applied. The vendor provided configuration file
          <filename>&sssd_vendor_dir;/sssd.conf</filename> is completely ignored
          in this case.
        </para>
        <para>
          If the system specific configuration file
          <filename>&sssd_conf_dir;/sssd.conf</filename> does not exist, then
          the vendor configuration file
          <filename>&sssd_vendor_dir;/sssd.conf</filename> is loaded and
          snippets from <filename>&sssd_conf_dir;/conf.d</filename> are applied.
        </para>
      </refsect2>
    </refsect1>

    <refsect1 id='general-options'>
        <title>GENERAL OPTIONS</title>
        <para>
            Following options are usable in more than one configuration
            sections.
        </para>
        <refsect2 id='all-section-options'>
            <title>Options usable in all sections</title>
            <para>
            Note: Below options are ignored in <quote>[session_recording]</quote>
            section, see <quote>Session recording configuration options</quote>
            section for more details.
            </para>
            <para>
              <variablelist>
                <varlistentry>
                    <term>debug_level (integer)</term>
                    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/debug_levels.xml" />
                </varlistentry>
                <varlistentry>
                    <term>debug (integer)</term>
                    <listitem>
                        <para>
                            SSSD 1.14 and later also includes the
                            <replaceable>debug</replaceable> alias for
                            <replaceable>debug_level</replaceable> as a
                            convenience feature. If both are specified, the
                            value of <replaceable>debug_level</replaceable>
                            will be used.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>debug_timestamps (boolean)</term>
                    <listitem>
                        <para>
                            Add a timestamp to the debug messages.
                            If journald is enabled for SSSD debug logging this
                            option is ignored.
                        </para>
                        <para>
                            Default: true
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>debug_microseconds (boolean)</term>
                    <listitem>
                        <para>
                            Add microseconds to the timestamp in debug messages.
                            If journald is enabled for SSSD debug logging this
                            option is ignored.
                        </para>
                        <para>
                            Default: false
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>debug_backtrace_enabled (boolean)</term>
                    <listitem>
                        <para>
                            Enable debug backtrace.
                        </para>
                        <para>
                            In case SSSD is run with debug_level less than 9,
                            everything is logged to a ring buffer in memory and
                            flushed to a log file on any error up to
                            and including `min(0x0040, debug_level)`
                            (i.e. if debug_level is explicitly set to 0 or 1 then
                            only those error levels will trigger backtrace,
                            otherwise up to 2).
                        </para>
                        <para>
                            Feature is only supported for `logger == files` (i.e.
                            setting doesn't have effect for other logger types).
                        </para>
                        <para>
                            Default: true
                        </para>
                    </listitem>
                </varlistentry>
              </variablelist>
            </para>
        </refsect2>

        <refsect2 id='services-and-domains-section-options'>
            <title>Options usable in SERVICE and DOMAIN sections</title>
            <para>
              <variablelist>
                <varlistentry>
                    <term>timeout (integer)</term>
                    <listitem>
                        <para>
                            Timeout in seconds between heartbeats for this
                            service. This is used to ensure that the process
                            is alive and capable of answering requests. Note
                            that after three missed heartbeats the process
                            will terminate itself.
                        </para>
                        <para>
                            Default: 10
                        </para>
                    </listitem>
                </varlistentry>
              </variablelist>
            </para>
        </refsect2>
    </refsect1>

    <refsect1 id='special-sections'>
        <title>SPECIAL SECTIONS</title>

        <refsect2 id='services'>
            <title>The [sssd] section</title>
            <para>
                Individual pieces of SSSD functionality are provided by special
                SSSD services that are started and stopped together with SSSD.
                The services are managed by a special service frequently called
                <quote>monitor</quote>. The <quote>[sssd]</quote> section is used
                to configure the monitor as well as some other important options
                like the identity domains.
                <variablelist>
                    <title>Section parameters</title>
                    <varlistentry>
                        <term>services (string)</term>
                        <listitem>
                            <para>
                                Comma separated list of services that are
                                started when sssd itself starts.
                                <phrase condition="have_systemd">
                                    The services' list is optional on platforms
                                    where systemd is supported, as they will either
                                    be socket or D-Bus activated when needed.
                                </phrase>
                            </para>
                            <para>
                                Supported services: nss, pam, ifp
                                <phrase condition="with_sudo">, sudo</phrase>
                                <phrase condition="with_autofs">, autofs</phrase>
                                <phrase condition="with_ssh">, ssh</phrase>
                                <phrase condition="with_pac_responder">, pac</phrase>
                            </para>
                            <para>
                                <phrase condition="have_systemd">
                                    By default, all services are disabled and the administrator
                                    must enable the ones allowed to be used by executing:
                                    "systemctl enable sssd-@service@.socket".
                                </phrase>
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>domains (string)</term>
                        <listitem>
                            <para>
                                A domain is a database containing user
                                information. SSSD can use more domains
                                at the same time, but at least one
                                must be configured or SSSD won't start.
                                This parameter describes the list of domains
                                in the order you want them to be queried.
                                A domain name is recommended to contain only
                                alphanumeric ASCII characters, dashes, dots
                                and underscores. '/' character is forbidden.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>re_expression (string)</term>
                        <listitem>
                            <para>
                                Default regular expression that describes how to
                                parse the string containing user name and domain
                                into these components.
                            </para>
                            <para>
                                Each domain can have an individual regular
                                expression configured. For some ID providers
                                there are also default regular expressions. See
                                DOMAIN SECTIONS for more info on these regular
                                expressions.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>full_name_format (string)</term>
                        <listitem>
                            <para>
                                A <citerefentry>
                                    <refentrytitle>printf</refentrytitle>
                                    <manvolnum>3</manvolnum>
                                </citerefentry>-compatible format that describes how to
                                compose a fully qualified name from user name
                                and domain name components.
                            </para>
                            <para>
                                The following expansions are supported:
                                <variablelist>
                                    <varlistentry>
                                        <term>%1$s</term>
                                        <listitem><para>user name</para></listitem>
                                    </varlistentry>
                                    <varlistentry>
                                        <term>%2$s</term>
                                        <listitem>
                                            <para>
                                                domain name as specified in the
                                                SSSD config file.
                                            </para>
                                        </listitem>
                                    </varlistentry>
                                    <varlistentry>
                                        <term>%3$s</term>
                                        <listitem>
                                            <para>
                                                domain flat name. Mostly usable
                                                for Active Directory domains, both
                                                directly configured or discovered
                                                via IPA trusts.
                                            </para>
                                        </listitem>
                                    </varlistentry>
                                </variablelist>
                            </para>
                            <para>
                                Each domain can have an individual format string configured.
                                See DOMAIN SECTIONS for more info on this option.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>monitor_resolv_conf (boolean)</term>
                        <listitem>
                            <para>
                                Controls if SSSD should monitor the state of
                                resolv.conf to identify when it needs to
                                update its internal DNS resolver.
                            </para>
                            <para>
                                Default: true
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>try_inotify (boolean)</term>
                        <listitem>
                            <para condition="have_inotify">
                                By default, SSSD will attempt to use inotify
                                to monitor configuration files changes and
                                will fall back to polling every five seconds
                                if inotify cannot be used.
                            </para>
                            <para condition="have_inotify">
                                There are some limited situations where it is
                                preferred that we should skip even trying to
                                use inotify. In these rare cases, this option
                                should be set to 'false'
                            </para>
                            <para condition="have_inotify">
                                Default: true on platforms where inotify is
                                supported. False on other platforms.
                            </para>
                            <para>
                                Note: this option will have no effect on
                                platforms where inotify is unavailable. On
                                these platforms, polling will always be used.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>krb5_rcache_dir (string)</term>
                        <listitem>
                            <para>
                                Directory on the filesystem where SSSD should
                                store Kerberos replay cache files.
                            </para>
                            <para>
                                This option accepts a special value
                                __LIBKRB5_DEFAULTS__ that will instruct SSSD
                                to let libkrb5 decide the appropriate
                                location for the replay cache.
                            </para>
                            <para>
                                Default: Distribution-specific and specified
                                at build-time. (__LIBKRB5_DEFAULTS__ if not
                                configured)
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>default_domain_suffix (string)</term>
                        <listitem>
                            <para>
                                Please note that this option is deprecated and
                                domain_resolution_order should be used.
                            </para>
                            <para>
                                This string will be used as a default domain
                                name for all names without a domain name
                                component. The main use case is environments
                                where the primary domain is intended for managing host
                                policies and all users are located in a trusted domain.
                                The option allows those users
                                to log in just with their user name without
                                giving a domain name as well.
                            </para>
                            <para>
                                Please note that if this option is set all
                                users from the primary domain have to use their
                                fully qualified name, e.g. user@domain.name,
                                to log in. Setting this option changes default
                                of use_fully_qualified_names to True. It is not
                                allowed to use this option together with
                                use_fully_qualified_names set to False.
                            </para>
                            <para>
                                Default: not set
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>override_space (string)</term>
                        <listitem>
                            <para>
                                This parameter will replace spaces (space bar)
                                with the given character for user and group names.
                                e.g. (_). User name &quot;john doe&quot; will
                                be &quot;john_doe&quot; This feature was added to
                                help compatibility with shell scripts that have
                                difficulty handling spaces, due to the
                                default field separator in the shell.
                            </para>
                            <para>
                                Please note it is a configuration error to use
                                a replacement character that might be used in
                                user or group names. If a name contains the
                                replacement character SSSD tries to return the
                                unmodified name but in general the result of a
                                lookup is undefined.
                            </para>
                            <para>
                                Default: not set (spaces will not be replaced)
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>certificate_verification (string)</term>
                        <listitem>
                            <para>
                                With this parameter the certificate verification
                                can be tuned with a comma separated list of
                                options. Supported options are:
                                <variablelist>
                                <varlistentry>
                                    <term>no_ocsp</term>
                                    <listitem>
                                        <para>Disables Online Certificate Status
                                        Protocol (OCSP) checks. This might be
                                        needed if the OCSP servers defined in
                                        the certificate are not reachable from
                                        the client.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>soft_ocsp</term>
                                    <listitem>
                                        <para> If a connection
                                        cannot be established to an OCSP
                                        responder the OCSP check is skipped.
                                        This option should be used to allow
                                        authentication when the system is
                                        offline and the OCSP responder cannot be
                                        reached.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>ocsp_dgst</term>
                                    <listitem>
                                        <para>Digest (hash) function used to
                                        create the certificate ID for the OCSP
                                        request. Allowed values are:
                                        <itemizedlist>
                                          <listitem><para>sha1</para></listitem>
                                          <listitem><para>sha256</para></listitem>
                                          <listitem><para>sha384</para></listitem>
                                          <listitem><para>sha512</para></listitem>
                                        </itemizedlist></para>
                                        <para>
                                            Default: sha1 (to allow compatibility with
                                            RFC5019-compliant responder)
                                        </para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>no_verification</term>
                                    <listitem>
                                        <para>Disables verification completely.
                                        This option should only be used for
                                        testing.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>partial_chain</term>
                                    <listitem>
                                        <para>Allow verification to succeed even
                                        if a <replaceable>complete</replaceable>
                                        chain cannot be built to a self-signed
                                        trust-anchor, provided it is possible to
                                        construct a chain to a trusted certificate
                                        that might not be self-signed.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>ocsp_default_responder=URL</term>
                                    <listitem>
                                        <para>Sets the OCSP default responder
                                        which should be used instead of the one
                                        mentioned in the certificate. URL must
                                        be replaced with the URL of the OCSP
                                        default responder e.g.
                                        http://example.com:80/ocsp.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>
                                    ocsp_default_responder_signing_cert=NAME</term>
                                    <listitem>
                                        <para>This option is
                                        currently ignored. All needed
                                        certificates must be available in the
                                        PEM file given by
                                        pam_cert_db_path.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>crl_file=/PATH/TO/CRL/FILE</term>
                                    <listitem>
                                        <para>Use the
                                        Certificate Revocation List (CRL) from
                                        the given file during the verification
                                        of the certificate. The CRL must be
                                        given in PEM format, see
                                            <citerefentry>
                                                <refentrytitle>crl</refentrytitle>
                                                <manvolnum>1ssl</manvolnum>
                                            </citerefentry>
                                        for details.</para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>soft_crl</term>
                                    <listitem>
                                        <para>
                                        If a Certificate Revocation List (CRL)
                                        is expired ignore the expiration time
                                        of the CRL and check the related
                                        certificates with the expired CRL. This
                                        option should be used to allow
                                        authentication when the system is
                                        offline and the CRL cannot be renewed.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                </variablelist>
                            </para>
                            <para>
                                Unknown options are reported but ignored.
                            </para>
                            <para>
                                Default: not set, i.e. do not restrict
                                certificate verification
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry condition="have_libnl">
                        <term>disable_netlink (boolean)</term>
                        <listitem>
                            <para>
                                SSSD hooks into the netlink interface to
                                monitor changes to routes, addresses, links
                                and trigger certain actions.
                            </para>
                            <para>
                                The SSSD state changes caused by netlink
                                events may be undesirable and can be disabled
                                by setting this option to 'true'
                            </para>
                            <para>
                                Default: false (netlink changes are detected)
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>domain_resolution_order (string)</term>
                        <listitem>
                            <para>
                                Comma separated list of domains and subdomains
                                representing the lookup order that will be
                                followed.
                                The list doesn't have to include all possible
                                domains as the missing domains will be looked
                                up based on the order they're presented in the
                                <quote>domains</quote> configuration option.
                                The subdomains which are not listed as part of
                                <quote>lookup_order</quote> will be looked up
                                in a random order for each parent domain.
                            </para>
                            <para>
                                Please, note that when this option is set the
                                output format of all commands is always
                                fully-qualified even when using short names
                                for input.
                                In case the administrator wants the output not
                                fully-qualified, the full_name_format option
                                can be used as shown below:
                                <quote>full_name_format=%1$s</quote>
                                However, keep in mind that during login, login
                                applications often canonicalize the username by
                                calling
                                <citerefentry>
                                    <refentrytitle>getpwnam</refentrytitle>
                                    <manvolnum>3</manvolnum>
                                </citerefentry>
                                which, if a shortname is returned for a
                                qualified input (while trying to reach a user
                                which exists in multiple domains) might
                                re-route the login attempt into the domain
                                which uses shortnames, making this workaround
                                totally not recommended in cases where
                                usernames may overlap between domains.
                            </para>
                            <para>
                                Default: Not set
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>implicit_pac_responder (boolean)</term>
                        <listitem>
                            <para>
                                The PAC responder is enabled automatically for
                                the IPA and AD provider to evaluate and check
                                the PAC. If it has to be disabled
                                set this option to 'false'.
                            </para>
                            <para>
                                Default: true
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>core_dumpable (boolean)</term>
                        <listitem>
                            <para>
                                This option can be used for general system
                                hardening: setting it to 'false' forbids core
                                dumps for all SSSD processes to avoid
                                leaking plain text passwords. See man page
                                prctl:PR_SET_DUMPABLE on Linux or
                                procctl:PROC_TRACE_CTL on FreeBSD for details.
                            </para>
                            <para>
                                Take a note that this setting has no effect
                                for 'ldap_child', 'krb5_child' and 'sssd_pam'
                                as those privileged binaries can have a copy
                                of a host keytab data in a memory and their
                                behavior in this regards is governed by
                                /proc/sys/fs/suid_dumpable system setting.
                            </para>
                            <para>
                                Default: true
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry condition="build_passkey">
                        <term>passkey_verification (string)</term>
                        <listitem>
                            <para>
                                With this parameter the passkey verification
                                can be tuned with a comma separated list of
                                options. Supported options are:
                                <variablelist>
                                <varlistentry>
                                    <term>user_verification (boolean)</term>
                                    <listitem>
                                        <para> Enable or disable the user
                                        verification (i.e. PIN, fingerprint)
                                        during authentication. If enabled, the
                                        PIN will always be requested.
                                        </para>
                                        <para>
                                        The default is that the key settings
                                        decide what to do. In the IPA or
                                        kerberos pre-authentication case,
                                        this value will be overwritten by the
                                        server.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                </variablelist>
                            </para>
                        </listitem>
                    </varlistentry>
                </variablelist>
            </para>
        </refsect2>

    </refsect1>

    <refsect1 id='services-sections'>
        <title>SERVICES SECTIONS</title>
        <para>
            Settings that can be used to configure different services
            are described in this section. They should reside in the
            [<replaceable>$NAME</replaceable>] section, for example,
            for NSS service, the section would be <quote>[nss]</quote>
        </para>

        <refsect2 id='general'>
            <title>General service configuration options</title>
            <para>
                These options can be used to configure any service.
            </para>
            <variablelist>
                <varlistentry>
                    <term>fd_limit (integer)</term>
                    <listitem>
                        <para>
                            This option specifies the maximum number of file
                            descriptors that may be opened at one time by this
                            SSSD process. Note this value will be capped by
                            the init system at the startup of SSSD, see e.g.
                            man systemd.exec for details.
                        </para>
                        <para>
                            Default: 8192 (or limits.conf "hard" limit)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>client_idle_timeout (integer)</term>
                    <listitem>
                        <para>
                            This option specifies the number of seconds that
                            a client of an SSSD process can hold onto a file
                            descriptor without communicating on it. This value
                            is limited in order to avoid resource exhaustion
                            on the system. The timeout can't be shorter than
                            10 seconds. If a lower value is configured, it
                            will be adjusted to 10 seconds.
                        </para>
                        <para>
                            Default: 60, KCM: 300
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>responder_idle_timeout (integer)</term>
                    <listitem>
                        <para>
                            This option specifies the number of seconds that
                            an SSSD responder process can be up without being
                            used. This value is limited in order to avoid
                            resource exhaustion on the system.
                            The minimum acceptable value for this option is 60
                            seconds.
                            Setting this option to 0 (zero) means that no
                            timeout will be set up to the responder.

                            This option only has effect when SSSD is built with
                            systemd support and when services are either socket
                            or D-Bus activated.
                        </para>
                        <para>
                            Default: 300
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>cache_first (boolean)</term>
                    <listitem>
                        <para>
                            This option specifies whether the responder should
                            query all caches before querying the Data Providers.
                        </para>
                        <para>
                            Default: true
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>

        <refsect2 id='NSS'>
            <title>NSS configuration options</title>
            <para>
                These options can be used to configure the
                Name Service Switch (NSS) service and should be
                specified under the <quote>[nss]</quote> section.
            </para>
            <variablelist>
                <varlistentry>
                    <term>enum_cache_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss cache enumerations
                            (requests for info about all users)
                        </para>
                        <para>
                            Default: 120
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>entry_cache_nowait_percentage (integer)</term>
                    <listitem>
                        <para>
                            The entry cache can be set to automatically update
                            entries in the background if they are requested
                            beyond a percentage of the entry_cache_timeout
                            value for the domain.
                        </para>
                        <para>
                            For example, if the domain's entry_cache_timeout
                            is set to 30s and entry_cache_nowait_percentage is
                            set to 50 (percent), entries that come in after 15
                            seconds past the last cache update will be
                            returned immediately, but the SSSD will go and
                            update the cache on its own, so that future
                            requests will not need to block waiting for a
                            cache update.
                        </para>
                        <para>
                            Valid values for this option are 0-99 and
                            represent a percentage of the entry_cache_timeout
                            for each domain. For performance reasons, this
                            percentage will never reduce the nowait timeout to
                            less than 10 seconds.
                            (0 disables this feature)
                        </para>
                        <para>
                            Default: 50
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>entry_negative_timeout (integer)</term>
                    <listitem>
                        <para>
                            Specifies for how many seconds nss_sss should cache
                            negative cache hits (that is, queries for
                            invalid database entries, like nonexistent ones)
                            before asking the back end again.
                        </para>
                        <para>
                            Default: 15
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>filter_users, filter_groups (string)</term>
                    <listitem>
                        <para>
                            Exclude certain users or groups from being fetched
                            from the sss NSS database. This is particularly
                            useful for system accounts. This option can also
                            be set per-domain or include fully-qualified names
                            to filter only users from the particular domain or
                            by a user principal name (UPN).
                        </para>
                        <para>
                            NOTE: The filter_groups option doesn't affect
                            inheritance of nested group members, since
                            filtering happens after they are propagated for
                            returning via NSS. E.g. a group having a member
                            group filtered out will still have the member
                            users of the latter listed.
                        </para>
                        <para>
                            Default: root
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>filter_users_in_groups (boolean)</term>
                    <listitem>
                        <para>
                            If you want filtered user still be group members
                            set this option to false.
                        </para>
                        <para>
                            Default: true
                        </para>
                    </listitem>
                </varlistentry>
                <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />
                <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/homedir_substring.xml" />
                <varlistentry>
                    <term>fallback_homedir (string)</term>
                    <listitem>
                        <para>
                            Set a default template for a user's home directory
                            if one is not specified explicitly by the domain's
                            data provider.
                        </para>
                        <para>
                            The available values for this option are the same
                            as for override_homedir.
                        </para>
                        <para>
                            example:
                            <programlisting>
fallback_homedir = /home/%u
                            </programlisting>
                        </para>
                        <para>
                            Default: not set (no substitution for unset home
                            directories)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>override_shell (string)</term>
                    <listitem>
                        <para>
                            Override the login shell for all users. This
                            option supersedes any other shell options if
                            it takes effect and can be set either in the
                            [nss] section or per-domain.
                        </para>
                        <para>
                            Default: not set (SSSD will use the value
                            retrieved from LDAP)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>allowed_shells (string)</term>
                    <listitem>
                        <para>
                            Restrict user shell to one of the listed values. The order of evaluation is:
                        </para>
                        <para>
                            1. If the shell is present in
                            <quote>/etc/shells</quote>, it is used.
                        </para>
                        <para>
                            2. If the shell is in the allowed_shells list but
                            not in <quote>/etc/shells</quote>, use the
                            value of the shell_fallback parameter.
                        </para>
                        <para>
                            3. If the shell is not in the allowed_shells list and
                            not in <quote>/etc/shells</quote>, a nologin shell
                            is used.
                        </para>
                        <para>
                            The wildcard (*) can be used to allow any shell.
                        </para>
                        <para>
                            The (*) is useful if you want to use
                            shell_fallback in case that user's shell is not
                            in <quote>/etc/shells</quote> and maintaining list
                            of all allowed shells in allowed_shells would be
                            to much overhead.
                        </para>
                        <para>
                            An empty string for shell is passed as-is to libc.
                        </para>
                        <para>
                            The <quote>/etc/shells</quote> is only read on SSSD start up, which means that
                            a restart of the SSSD is required in case a new shell is installed.
                        </para>
                        <para>
                            Default: Not set. The user shell is automatically used.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>vetoed_shells (string)</term>
                    <listitem>
                        <para>
                            Replace any instance of these shells with the shell_fallback
                        </para>
                        <para>
                            Default: Not set
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>shell_fallback (string)</term>
                    <listitem>
                        <para>
                            The default shell to use if an allowed shell is not
                            installed on the machine.
                        </para>
                        <para>
                            Default: /bin/sh
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>default_shell (string)</term>
                    <listitem>
                        <para>
                            The default shell to use if the provider does
                            not return one during lookup. This option can
                            be specified globally in the [nss] section
                            or per-domain.
                        </para>
                        <para>
                            Default: not set (Return NULL if no shell is
                            specified and rely on libc to substitute something
                            sensible when necessary, usually /bin/sh)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>get_domains_timeout (int)</term>
                    <listitem>
                        <para>
                            Specifies time in seconds for which the list of
                            subdomains will be considered valid.
                        </para>
                        <para>
                            Default: 60
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>memcache_timeout (integer)</term>
                    <listitem>
                        <para>
                            Specifies time in seconds for which records
                            in the in-memory cache will be valid. Setting this
                            option to zero will disable the in-memory cache.
                        </para>
                        <para>
                            Default: 300
                        </para>
                        <para>
                            WARNING: Disabling the in-memory cache will
                            have significant negative impact on SSSD's
                            performance and should only be used for
                            testing.
                        </para>
                        <para>
                            NOTE: If the environment variable
                            SSS_NSS_USE_MEMCACHE is set to "NO", client
                            applications will not use the fast in-memory
                            cache.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>memcache_size_passwd (integer)</term>
                    <listitem>
                        <para>
                            Size (in megabytes) of the data table allocated inside
                            fast in-memory cache for passwd requests.
                            Setting the size to 0 will disable the passwd
                            in-memory cache.
                        </para>
                        <para>
                            Default: 8
                        </para>
                        <para>
                            WARNING: Disabled or too small in-memory cache can
                            have significant negative impact on SSSD's
                            performance.
                        </para>
                        <para>
                            NOTE: If the environment variable
                            SSS_NSS_USE_MEMCACHE is set to "NO", client
                            applications will not use the fast in-memory
                            cache.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>memcache_size_group (integer)</term>
                    <listitem>
                        <para>
                            Size (in megabytes) of the data table allocated inside
                            fast in-memory cache for group requests.
                            Setting the size to 0 will disable the group
                            in-memory cache.
                        </para>
                        <para>
                            Default: 6
                        </para>
                        <para>
                            WARNING: Disabled or too small in-memory cache can
                            have significant negative impact on SSSD's
                            performance.
                        </para>
                        <para>
                            NOTE: If the environment variable
                            SSS_NSS_USE_MEMCACHE is set to "NO", client
                            applications will not use the fast in-memory
                            cache.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>memcache_size_initgroups (integer)</term>
                    <listitem>
                        <para>
                            Size (in megabytes) of the data table allocated inside
                            fast in-memory cache for initgroups requests.
                            Setting the size to 0 will disable the initgroups
                            in-memory cache.
                        </para>
                        <para>
                            Default: 10
                        </para>
                        <para>
                            WARNING: Disabled or too small in-memory cache can
                            have significant negative impact on SSSD's
                            performance.
                        </para>
                        <para>
                            NOTE: If the environment variable
                            SSS_NSS_USE_MEMCACHE is set to "NO", client
                            applications will not use the fast in-memory
                            cache.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>memcache_size_sid (integer)</term>
                    <listitem>
                        <para>
                            Size (in megabytes) of the data table allocated inside
                            fast in-memory cache for SID related requests.
                            Only SID-by-ID and ID-by-SID requests are currently
                            cached in fast in-memory cache.
                            Setting the size to 0 will disable the SID
                            in-memory cache.
                        </para>
                        <para>
                            Default: 6
                        </para>
                        <para>
                            WARNING: Disabled or too small in-memory cache can
                            have significant negative impact on SSSD's
                            performance.
                        </para>
                        <para>
                            NOTE: If the environment variable
                            SSS_NSS_USE_MEMCACHE is set to "NO", client
                            applications will not use the fast in-memory
                            cache.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>user_attributes (string)</term>
                    <listitem>
                        <para>
                            Some of the additional NSS responder requests can
                            return more attributes than just the POSIX ones
                            defined by the NSS interface. The list of attributes
                            is controlled by this option. It is handled the same
                            way as the <quote>user_attributes</quote> option of
                            the InfoPipe responder (see
                            <citerefentry>
                                <refentrytitle>sssd-ifp</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>
                            for details) but with no default values.
                        </para>
                        <para>
                            To make configuration more easy the NSS responder
                            will check the InfoPipe option if it is not set for
                            the NSS responder.
                        </para>
                        <para>
                            Default: not set, fallback to InfoPipe option
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pwfield (string)</term>
                    <listitem>
                        <para>
                            The value that NSS operations that return
                            users or groups will return for the
                            <quote>password</quote> field.
                        </para>
                        <para>
                            This option can also be set per-domain, which
                            overwrites the value in the <quote>[nss]</quote>
                            section for that domain. This is particularly useful
                            when using a proxy domain with
                            <option>proxy_lib_name=files</option> and a
                            <option>proxy_pam_target</option> other than
                            <quote>sssd-shadowutils</quote>. In that case, SSSD
                            returns <quote>*</quote> for the password field by
                            default, which causes <command>pam_unix</command> to
                            treat all accounts as locked. Setting
                            <option>pwfield = x</option> in the domain section
                            restores the expected behavior.
                        </para>
                        <para>
                            Default: <quote>*</quote>
                        </para>
                        <para>
                            Default (per-domain): <quote>not set</quote> (remote
                            domains), <quote>x</quote> (proxy domain with
                            nss_files and sssd-shadowutils target)
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>
        <refsect2 id='PAM'>
            <title>PAM configuration options</title>
            <para>
                These options can be used to configure the
                Pluggable Authentication Module (PAM) service and should be
                specified under the <quote>[pam]</quote> section.
            </para>
            <variablelist>
                <varlistentry>
                    <term>offline_credentials_expiration (integer)</term>
                    <listitem>
                        <para>
                            If the authentication provider is offline, how
                            long should we allow cached logins (in days since
                            the last successful online login).
                        </para>
                        <para>
                            Default: 0 (No limit)
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>offline_failed_login_attempts (integer)</term>
                    <listitem>
                        <para>
                            If the authentication provider is offline, how
                            many failed login attempts are allowed.
                        </para>
                        <para>
                            Default: 0 (No limit)
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>offline_failed_login_delay (integer)</term>
                    <listitem>
                        <para>
                            The time in minutes which has to pass after
                            offline_failed_login_attempts has been reached
                            before a new login attempt is possible.
                        </para>
                        <para>
                            If set to 0 the user cannot authenticate offline if
                            offline_failed_login_attempts has been reached. Only
                            a successful online authentication can enable
                            offline authentication again.
                        </para>
                        <para>
                            Default: 5
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>pam_verbosity (integer)</term>
                    <listitem>
                        <para>
                            Controls what kind of messages are shown to the user
                            during authentication. The higher the number to more
                            messages are displayed.
                        </para>
                        <para>
                             Currently sssd supports the following values:
                        </para>
                        <para>
                             <emphasis>0</emphasis>: do not show any message
                        </para>
                        <para>
                             <emphasis>1</emphasis>: show only important
                             messages
                        </para>
                        <para>
                             <emphasis>2</emphasis>: show informational messages
                        </para>
                        <para>
                             <emphasis>3</emphasis>: show all messages and debug
                             information
                        </para>
                        <para>
                            Default: 1
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>pam_response_filter (string)</term>
                    <listitem>
                        <para>
                            A comma separated list of strings which allows to
                            remove (filter) data sent by the PAM responder to
                            pam_sss PAM module. There are different kind of
                            responses sent to pam_sss e.g. messages displayed to
                            the user or environment variables which should be
                            set by pam_sss.
                        </para>
                        <para>
                            While messages already can be controlled with the
                            help of the pam_verbosity option this option allows
                            to filter out other kind of responses as well.
                        </para>
                        <para>
                            Currently the following filters are supported:
                            <variablelist>
                                <varlistentry><term>ENV</term>
                                    <listitem><para>Do not send any environment
                                    variables to any service.</para></listitem>
                                </varlistentry>
                                <varlistentry><term>ENV:var_name</term>
                                    <listitem><para>Do not send environment
                                    variable var_name to any
                                    service.</para></listitem>
                                </varlistentry>
                                <varlistentry><term>ENV:var_name:service</term>
                                    <listitem><para>Do not send environment
                                    variable var_name to
                                    service.</para></listitem>
                                </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            The list of strings can either be the list of
                            filters which would set this list of filters and
                            overwrite the defaults. Or each element of the list
                            can be prefixed by a '+' or '-' character which
                            would add the filter to the existing default or
                            remove it from the defaults, respectively. Please
                            note that either all list elements must have a '+'
                            or '-' prefix or none. It is considered as an error
                            to mix both styles.
                        </para>
                        <para>
                            Default: ENV:KRB5CCNAME:sudo, ENV:KRB5CCNAME:sudo-i
                        </para>
                        <para>
                            Example: -ENV:KRB5CCNAME:sudo-i will remove the
                            filter from the default list
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                  <term>pam_id_timeout (integer)</term>
                  <listitem>
                    <para>
                      For any PAM request while SSSD is online, the SSSD will
                      attempt to immediately update the cached identity
                      information for the user in order to ensure that
                      authentication takes place with the latest information.
                    </para>
                    <para>
                      A complete PAM conversation may perform multiple PAM
                      requests, such as account management and session
                      opening. This option controls (on a
                      per-client-application basis) how long (in seconds) we
                      can cache the identity information to avoid excessive
                      round-trips to the identity provider.
                    </para>
                    <para>
                      Default: 5
                    </para>
                  </listitem>
                </varlistentry>

                <varlistentry>
                  <term>pam_pwd_expiration_warning (integer)</term>
                  <listitem>
                    <para>
                      Display a warning N days before the password expires.
                    </para>
                    <para>
                      Please note that the backend server has to provide
                      information about the expiration time of the password.
                      If this information is missing, sssd cannot display a
                      warning.
                    </para>
                    <para>
                      If zero is set, then this filter is not applied,
                      i.e. if the expiration warning was received from
                      backend server, it will automatically be displayed.
                    </para>
                    <para>
                      This setting can be overridden by setting
                      <emphasis>pwd_expiration_warning</emphasis>
                      for a particular domain.
                    </para>
                    <para>
                      Default: 0
                    </para>
                  </listitem>
                </varlistentry>
                <varlistentry>
                    <term>get_domains_timeout (int)</term>
                    <listitem>
                        <para>
                            Specifies time in seconds for which the list of
                            subdomains will be considered valid.
                        </para>
                        <para>
                            Default: 60
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_trusted_users (string)</term>
                    <listitem>
                        <para>
                            Specifies the comma-separated list of UID
                            values or user names that are allowed to run
                            PAM conversations against trusted domains.
                            Users not included in this list can only access
                            domains marked as public with
                            <quote>pam_public_domains</quote>.
                            User names are resolved to UIDs at
                            startup.
                        </para>
                        <para>
                            Default: All users are considered trusted
                            by default
                        </para>
                        <para>
                            Please note that UID 0 is always allowed to access
                            the PAM responder even in case it is not in the
                            pam_trusted_users list.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_public_domains (string)</term>
                    <listitem>
                        <para>
                            Specifies the comma-separated list of domain names
                            that are accessible even to untrusted users.
                        </para>
                        <para>
                            Two special values for pam_public_domains option
                            are defined:
                        </para>
                        <para>
                            all (Untrusted users are allowed to access
                            all domains in PAM responder.)
                        </para>
                        <para>
                            none (Untrusted users are not allowed to access
                            any domains PAM in responder.)
                        </para>
                        <para>
                            Default: none
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_account_expired_message (string)</term>
                    <listitem>
                        <para>
                           Allows a custom expiration message to be set,
                           replacing the default 'Permission denied'
                           message.
                        </para>
                        <para>
                            Note: Please be aware that message is only
                            printed for the SSH service unless pam_verbosity
                            is set to 3 (show all messages and debug
                            information).
                        </para>
                        <para>
                            example:
                            <programlisting>
pam_account_expired_message = Account expired, please contact help desk.
                            </programlisting>
                        </para>
                        <para>
                            Default: none
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_account_locked_message (string)</term>
                    <listitem>
                        <para>
                           Allows a custom lockout message to be set,
                           replacing the default 'Permission denied'
                           message.
                        </para>
                        <para>
                            example:
                            <programlisting>
pam_account_locked_message = Account locked, please contact help desk.
                            </programlisting>
                        </para>
                        <para>
                            Default: none
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry condition="build_passkey">
                    <term>pam_passkey_auth (boolean)</term>
                    <listitem>
                        <para>
                            Enable passkey device based authentication.
                        </para>
                        <para>
                            Default: True
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry condition="build_passkey">
                    <term>passkey_debug_libfido2 (boolean)</term>
                    <listitem>
                        <para>
                            Enable libfido2 library debug messages.
                        </para>
                        <para>
                            Default: False
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_cert_auth (boolean)</term>
                    <listitem>
                        <para>
                            Enable certificate based Smartcard authentication.
                            Since this requires additional communication with
                            the Smartcard which will delay the authentication
                            process this option is disabled by default.
                        </para>
                        <para>
                            Default: False
                        </para>
                        <para>
                            Note: In case OpenSC is used for Smartcard access
                            SSSD supports the filesystem caching in OpenSC when
                            enabled in opensc.conf. The cached files are located
                            in a common <quote>opensc</quote> directory in SSSD's state directory.
                            The behaviour can be changed in opensc.conf
                        </para>
                        <para>
                            Example opensc.conf (*):
                            <programlisting>
app /usr/libexec/sssd/p11_child {
        framework pkcs15 {
                use_file_caching = no;
        }
}
app /usr/libexec/sssd/krb5_child {
        framework pkcs15 {
                use_file_caching = no;
        }
}
                            </programlisting>
                        </para>
                        <para>
                            (*) The actual <quote>libexec</quote> directory for p11_child and krb5_child depends on the distribution.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_cert_db_path (string)</term>
                    <listitem>
                        <para>
                            The path to the certificate database.
                        </para>
                        <para>
                            Default:
                            <itemizedlist>
                                <listitem><para>/etc/sssd/pki/sssd_auth_ca_db.pem
                                                (path to a file with trusted CA
                                                certificates in PEM format)
                                          </para>
                                </listitem>
                            </itemizedlist>
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_cert_verification (string)</term>
                    <listitem>
                        <para>
                            With this parameter the PAM certificate verification
                            can be tuned with a comma separated list of
                            options that override the
                            <quote>certificate_verification</quote> value in
                            <quote>[sssd]</quote> section.
                            Supported options are the same of
                            <quote>certificate_verification</quote>.
                        </para>
                        <para>
                            example:
                            <programlisting>
pam_cert_verification = partial_chain
                            </programlisting>
                        </para>
                        <para>
                            Default: not set, i.e. use default
                            <quote>certificate_verification</quote> option defined
                            in <quote>[sssd]</quote> section.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>p11_child_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds will pam_sss wait for
                            p11_child to finish.
                        </para>
                        <para>
                            Default: 10
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry condition="build_passkey">
                    <term>passkey_child_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds will the PAM responder
                            wait for passkey_child to finish.
                        </para>
                        <para>
                            Default: 15
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_app_services (string)</term>
                    <listitem>
                        <para>
                            Which PAM services are permitted to contact
                            domains of type <quote>application</quote>
                        </para>
                        <para>
                            Default: Not set
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_p11_allowed_services (string)</term>
                    <listitem>
                        <para>
                            A comma-separated list of PAM service names for
                            which it will be allowed to use Smartcards.
                        </para>
                        <para>
                            It is possible to add another PAM service name to
                            the default set by using
                            <quote>+service_name</quote> or to explicitly
                            remove a PAM service name from the default set by
                            using <quote>-service_name</quote>. For example,
                            in order to replace a default PAM service name for
                            authentication with Smartcards
                            (e.g. <quote>login</quote>) with a custom PAM
                            service name (e.g. <quote>my_pam_service</quote>),
                            you would use the following configuration:
                            <programlisting>
pam_p11_allowed_services = +my_pam_service, -login
                            </programlisting>
                        </para>
                        <para>
                            Default: the default set of PAM service names
                            includes:
                            <itemizedlist>
                                <listitem>
                                    <para>
                                        login
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        su
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        su-l
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        gdm-smartcard
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        gdm-password
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        gdm-switchable-auth
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        kdm
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        plasmalogin
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        sudo
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        sudo-i
                                    </para>
                                </listitem>
                                <listitem>
                                    <para>
                                        gnome-screensaver
                                    </para>
                                </listitem>
                            </itemizedlist>
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>p11_wait_for_card_timeout (integer)</term>
                    <listitem>
                        <para>
                            If Smartcard authentication is required how many
                            extra seconds in addition to p11_child_timeout
                            should the PAM responder wait until a Smartcard is
                            inserted.
                        </para>
                        <para>
                            Default: 60
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>p11_uri (string)</term>
                    <listitem>
                        <para>
                            PKCS#11 URI (see RFC-7512 for details) which can be
                            used to restrict the selection of devices used for
                            Smartcard authentication. By default SSSD's
                            p11_child will search for a PKCS#11 slot (reader)
                            where the 'removable' flags is set and read the
                            certificates from the inserted token from the first
                            slot found. If multiple readers are connected
                            p11_uri can be used to tell p11_child to use a
                            specific reader.
                        </para>
                        <para>
                            Example:
                            <programlisting>
p11_uri = pkcs11:slot-description=My%20Smartcard%20Reader
                            </programlisting>
                            or
                            <programlisting>
p11_uri = pkcs11:library-description=OpenSC%20smartcard%20framework;slot-id=2
                            </programlisting>
                            To find suitable URI please check the debug output
                            of p11_child. As an alternative the GnuTLS utility
                            'p11tool' with e.g. the '--list-all' will show
                            PKCS#11 URIs as well.
                        </para>
                        <para>
                            Default: none
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_initgroups_scheme (string)</term>
                    <listitem>
                        <para>
                            The PAM responder can force an online lookup to get
                            the current group memberships of the user trying to
                            log in. This option controls when this should be
                            done and the following values are allowed:
                            <variablelist>
                            <varlistentry><term>always</term>
                                <listitem><para>Always do an online lookup,
                                please note that pam_id_timeout still
                                applies</para></listitem>
                            </varlistentry>
                            <varlistentry><term>no_session</term>
                                <listitem><para>Only do an online
                                lookup if there is no active session of the
                                user, i.e. if the user is currently not logged
                                in</para></listitem>
                            </varlistentry>
                            <varlistentry><term>never</term>
                                <listitem><para>Never force an online lookup,
                                use the data from the cache as long as they are
                                not expired</para></listitem>
                            </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            Default: no_session
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_gssapi_services (string)</term>
                    <listitem>
                        <para>
                            Comma separated list of PAM services that are
                            allowed to try GSSAPI authentication using
                            pam_sss_gss.so module.
                        </para>
                        <para>
                            To disable GSSAPI authentication, set this option
                            to <quote>-</quote> (dash).
                        </para>
                        <para>
                            Note: This option can also be set per-domain which
                            overwrites the value in [pam] section. It can also
                            be set for trusted domain which overwrites the value
                            in the domain section.
                        </para>
                        <para>
                            Example:
                            <programlisting>
pam_gssapi_services = sudo, sudo-i
                            </programlisting>
                        </para>
                        <para>
                            Default: - (GSSAPI authentication is disabled)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_gssapi_check_upn (boolean)</term>
                    <listitem>
                        <para>
                            If True, SSSD will require that the Kerberos user
                            principal that successfully authenticated through
                            GSSAPI can be associated with the user who is being
                            authenticated. Authentication will fail if the check
                            fails.
                        </para>
                        <para>
                            If False, every user that is able to obtained
                            required service ticket will be authenticated.
                        </para>
                        <para>
                            Note: This option can also be set per-domain which
                            overwrites the value in [pam] section. It can also
                            be set for trusted domain which overwrites the value
                            in the domain section.
                        </para>
                        <para>
                            Default: True
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pam_gssapi_indicators_map (string)</term>
                    <listitem>
                        <para>
                           Comma separated list of authentication indicators required
                           to be present in a Kerberos ticket to access a PAM service
                           that is allowed to try GSSAPI authentication using
                           pam_sss_gss.so module.
                        </para>
                        <para>
                           Each element of the list can be either an authentication indicator
                           name or a pair <quote>service:indicator</quote>. Indicators not
                           prefixed with the PAM service name will be required to access any
                           PAM service configured to be used with
                           <option>pam_gssapi_services</option>. A resulting list of indicators
                           per PAM service is then checked against indicators in the Kerberos
                           ticket during authentication by pam_sss_gss.so. Any indicator from the
                           ticket that matches the resulting list of indicators for the PAM service
                           would grant access. If none of the indicators in the list match, access
                           will be denied. If the resulting list of indicators for the PAM service
                           is empty, the check will not prevent the access.
                        </para>
                        <para>
                           To disable GSSAPI authentication indicator check, set this option
                           to <quote>-</quote> (dash). To disable the check for a specific PAM
                           service, add <quote>service:-</quote>.
                        </para>
                        <para>
                           Note: This option can also be set per-domain which
                           overwrites the value in [pam] section. It can also
                           be set for trusted domain which overwrites the value
                           in the domain section.
                        </para>
                        <para>
                            Following authentication indicators are supported by IPA Kerberos deployments:
                            <itemizedlist>
                                <listitem>
                                    <para>pkinit -- pre-authentication using X.509 certificates -- whether stored in files or on smart cards.</para>
                                </listitem>
                                <listitem>
                                    <para>hardened -- SPAKE pre-authentication or any pre-authentication wrapped in a FAST channel.</para>
                                </listitem>
                                <listitem>
                                    <para>radius -- pre-authentication with the help of a RADIUS server.</para>
                                </listitem>
                                <listitem>
                                    <para>otp -- pre-authentication using integrated two-factor authentication (2FA or one-time password, OTP) in IPA.</para>
                                </listitem>
                                <listitem>
                                    <para>idp -- pre-authentication using external identity provider.</para>
                                </listitem>
                            </itemizedlist>
                        </para>
                        <para>
                            Example: to require access to SUDO services only
                            for users which obtained their Kerberos tickets
                            with a X.509 certificate pre-authentication
                            (PKINIT), set
                                <programlisting>
pam_gssapi_indicators_map = sudo:pkinit, sudo-i:pkinit
                            </programlisting>
                        </para>
                        <para>
                            Default: not set (use of authentication indicators is not required)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry condition="with_samba">
                    <term>pam_gssapi_indicators_apply (string)</term>
                    <listitem>
                        <para>
                            Comma separated list of triples to assign
                            additional information from the Kerberos ticket,
                            e.g. a SID from the PAC, to authentication
                            indicators.
                        </para>
                        <para>
                            Currently supported is:
                            <itemizedlist>
                                <listitem>
                                    <para>SID:S-1-5-[domain]-[RID]:[authentication indicator]</para>
                                </listitem>
                            </itemizedlist>
                        </para>
                        <para>
                            Example: To assign a SID, which is e.g. set by
                            Active Directory's Authentication Mechanism
                            Assurance (AMA) if the AD user used a Smartcard
                            for authentication, to the 'pkinit'
                            authentication indicator use:
                            <programlisting>
pam_gssapi_indicators_apply = SID:S-1-5-12345-23456-34567-4321:pkinit
                            </programlisting>
                        </para>
                        <para>
                            Default: not set
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry condition="build_json_pam">
                    <term>pam_json_services (string)</term>
                    <listitem>
                        <para>
                            Comma separated list of PAM services which can
                            handle the JSON protocol for selecting
                            authentication mechanisms
                        </para>
                        <para>
                            To disable JSON protocol, set this option
                            to <quote>-</quote> (dash).
                        </para>
                        <para>
                            Example:
                            <programlisting>
pam_json_services = gdm-switchable-auth
                            </programlisting>
                        </para>
                        <para>
                            Default: - (JSON protocol is disabled)
                        </para>
                        <para>
                           Note: 2-Factor Authentication (2FA) is not
                           supported. If 2FA is required, do not
                           activate the JSON protocol.
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>

        <refsect2 id='SUDO' condition="with_sudo">
            <title>SUDO configuration options</title>
            <para>
                These options can be used to configure the sudo service
                and should be specified under the <quote>[sudo]</quote> section.
            </para>
            <para>
                The detailed instructions for configuration of
                <citerefentry>
                    <refentrytitle>sudo</refentrytitle>
                    <manvolnum>8</manvolnum>
                </citerefentry> to work with
                <citerefentry>
                    <refentrytitle>sssd</refentrytitle>
                    <manvolnum>8</manvolnum>
                </citerefentry> are in the manual page
                <citerefentry>
                    <refentrytitle>sssd-sudo</refentrytitle>
                    <manvolnum>5</manvolnum>
                </citerefentry>.
            </para>
            <variablelist>
                <varlistentry>
                    <term>sudo_timed (boolean)</term>
                    <listitem>
                        <para>
                            Whether or not to evaluate the sudoNotBefore
                            and sudoNotAfter attributes that implement
                            time-dependent sudoers entries.
                        </para>
                        <para>
                            Default: false
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
            <variablelist>
                <varlistentry>
                    <term>sudo_threshold (integer)</term>
                    <listitem>
                        <para>
                            Maximum number of expired rules that can be
                            refreshed at once. If number of expired rules
                            is below threshold, those rules are refreshed
                            with <quote>rules refresh</quote> mechanism. If
                            the threshold is exceeded a
                            <quote>full refresh</quote> of sudo rules is
                            triggered instead. This threshold number also
                            applies to IPA sudo command and command group
                            searches.
                        </para>
                        <para>
                            Default: 50
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>

        <refsect2 id='AUTOFS' condition="with_autofs">
            <title>AUTOFS configuration options</title>
            <para>
                These options can be used to configure the autofs service
                and should be specified under the <quote>[autofs]</quote>
                section.
            </para>
            <variablelist>
                <varlistentry>
                    <term>autofs_negative_timeout (integer)</term>
                    <listitem>
                        <para>
                            Specifies for how many seconds should the
                            autofs responder negative cache hits
                            (that is, queries for invalid map entries,
                            like nonexistent ones) before asking the back
                            end again.
                        </para>
                        <para>
                            Default: 15
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
            <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/autofs_restart.xml" />
        </refsect2>

        <refsect2 id='SSH' condition="with_ssh">
            <title>SSH configuration options</title>
            <para>
                These options can be used to configure the SSH service
                and should be specified under the <quote>[ssh]</quote>
                section.
            </para>
            <variablelist>
                <varlistentry>
                    <term>ssh_use_certificate_keys (boolean)</term>
                    <listitem>
                        <para>
                            If set to true the
                            <command>sss_ssh_authorizedkeys</command> will
                            return ssh keys derived from the public key of X.509
                            certificates stored in the user entry as well. See
                            <citerefentry>
                                <refentrytitle>sss_ssh_authorizedkeys</refentrytitle>
                                <manvolnum>1</manvolnum>
                            </citerefentry> for details.
                        </para>
                        <para>
                            Default: true
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>ssh_use_certificate_matching_rules (string)</term>
                    <listitem>
                        <para>
                            By default the ssh responder will use all available
                            certificate matching rules to filter the
                            certificates so that ssh keys are only derived from
                            the matching ones. With this option the used rules
                            can be restricted with a comma separated list of
                            mapping and matching rule names. All other rules
                            will be ignored.
                        </para>
                        <para>
                            There are two special key words 'all_rules' and
                            'no_rules' which will enable all or no rules,
                            respectively. The latter means that no certificates
                            will be filtered out and ssh keys will be generated
                            from all valid certificates.
                        </para>
                        <para>
                            If no rules are configured using 'all_rules' will
                            enable a default rule which enables all
                            certificates suitable for client authentication.
                            This is the same behavior as for the PAM responder
                            if certificate authentication is enabled.
                        </para>
                        <para>
                            A non-existing rule name is considered an error.
                            If as a result no rule is selected all certificates
                            will be ignored.
                        </para>
                        <para>
                            Default: not set, equivalent to 'all_rules',
                            all found rules or the default rule are used
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>ca_db (string)</term>
                    <listitem>
                        <para>
                            Path to a storage of trusted CA certificates. The
                            option is used to validate user certificates before
                            deriving public ssh keys from them.
                        </para>
                        <para>
                            Default:
                            <itemizedlist>
                                <listitem><para>/etc/sssd/pki/sssd_auth_ca_db.pem
                                                (path to a file with trusted CA
                                                certificates in PEM format)
                                          </para>
                                </listitem>
                            </itemizedlist>
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>

        <refsect2 id='PAC_RESPONDER' condition="with_pac_responder">
            <title>PAC responder configuration options</title>
            <para>
                The PAC responder works together with the authorization data
                plugin for MIT Kerberos sssd_pac_plugin.so and a sub-domain
                provider. The plugin sends the PAC data during a GSSAPI
                authentication to the PAC responder. The sub-domain provider
                collects domain SID and ID ranges of the domain the client is
                joined to and of remote trusted domains from the local domain
                controller. If the PAC is decoded and evaluated some of the
                following operations are done:
                <itemizedlist>
                    <listitem><para>If the remote user does not exist in the
                    cache, it is created. The UID is determined with the help
                    of the SID, trusted domains will have UPGs and the GID
                    will have the same value as the UID. The home directory is
                    set based on the subdomain_homedir parameter. The shell will
                    be empty by default, i.e. the system defaults are used, but
                    can be overwritten with the default_shell parameter.</para>
                    </listitem>
                    <listitem><para>If there are SIDs of groups from domains
                    sssd knows about, the user will be added to those groups.
                    </para></listitem>
                </itemizedlist>
            </para>
            <para>
                These options can be used to configure the PAC responder
                and should be specified under the <quote>[pac]</quote> section.
            </para>
            <variablelist>
                <varlistentry>
                    <term>allowed_uids (string)</term>
                    <listitem>
                        <para>
                            Specifies the comma-separated list of UID values or
                            user names that are allowed to access the PAC
                            responder. User names are resolved to UIDs at
                            startup.
                        </para>
                        <para condition="with_non_root_user_support">
                            Default: 0, &sssd_user_name; (only root and SSSD
                            service users are allowed to access the PAC responder)
                        </para>
                        <para condition="without_non_root_user_support">
                            Default: 0 (only the root user is allowed to access
                            the PAC responder)
                        </para>
                        <para condition="with_non_root_user_support">
                            Please note that defaults will be overwritten with this
                            option. If you still want to allow the root and/or
                            '&sssd_user_name;' user to access the PAC responder,
                            which would be the typical case, you have to add those
                            to the list of allowed UIDs explicitly.
                        </para>
                        <para condition="without_non_root_user_support">
                            Please note that although the UID 0 is used as the
                            default it will be overwritten with this option. If
                            you still want to allow the root user to access the
                            PAC responder, which would be the typical case, you
                            have to add 0 to the list of allowed UIDs as well.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pac_lifetime (integer)</term>
                    <listitem>
                        <para>
                            Lifetime of the PAC entry in seconds. As long as the
                            PAC is valid the PAC data can be used to determine
                            the group memberships of a user.
                        </para>
                        <para>
                            Default: 300
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>pac_check (string)</term>
                    <listitem>
                        <para>
                            Apply additional checks on the PAC of the Kerberos
                            ticket which is available in Active Directory and
                            FreeIPA domains, if configured. Please note that
			    Kerberos ticket validation must be enabled to be
                            able to check the PAC, i.e. the krb5_validate option
                            must be set to 'True' which is the default for the
                            IPA and AD provider. If krb5_validate is set to
                            'False' the PAC checks will be skipped.
			</para>
			<para>
                            Please note that the checks listed below only apply
                            to PACs issued by Active Directory or recent
                            versions of FreeIPA. PACs issued e.g. by a plain
                            MIT Kerberos KDC will not contain the needed PAC
                            data buffers to run the checks.
			</para>
                        <para>
			    The following options can be used alone or in a
			    comma-separated list:
                            <variablelist>
                            <varlistentry>
                                <term>no_check</term>
                                <listitem>
                                    <para>The PAC must not be present and even
                                    if it is present no additional checks will be
                                    done.</para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>pac_present</term>
                                <listitem>
                                    <para>The PAC must be present in the
                                    service ticket which SSSD will request with
                                    the help of the user's TGT. If the PAC is
                                    not available the authentication will fail.
                                    </para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>check_upn</term>
                                <listitem>
                                    <para>If the PAC is present check if the
                                    user principal name (UPN) information is
                                    consistent.</para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>check_upn_allow_missing</term>
                                <listitem>
                                    <para>This option should be used together
                                    with 'check_upn' and handles the case where
                                    a UPN is set on the server-side but is not
                                    read by SSSD. The typical example is a
                                    FreeIPA domain where 'ldap_user_principal'
                                    is set to a not existing attribute name.
                                    This was typically done to work-around
                                    issues in the handling of enterprise
                                    principals. But this is fixed since quite
                                    some time and FreeIPA can handle enterprise
                                    principals just fine and there is no need
                                    anymore to set 'ldap_user_principal'.</para>
                                    <para>Currently this option is set by
                                    default to avoid regressions in such
                                    environments. A log message will be added
                                    to the system log and SSSD's debug log in
                                    case a UPN is found in the PAC but not in
                                    SSSD's cache. To avoid this log message it
                                    would be best to evaluate if the
                                    'ldap_user_principal' option can be removed.
                                    If this is not possible, removing
                                    'check_upn' will skip the test and avoid the
                                    log message.</para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>upn_dns_info_present</term>
                                <listitem>
                                    <para>The PAC must contain the UPN-DNS-INFO
                                    buffer, implies 'check_upn'.</para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>check_upn_dns_info_ex</term>
                                <listitem>
                                    <para>If the PAC is present and the
                                    extension to the UPN-DNS-INFO buffer is
                                    available check if the information in the
                                    extension is consistent.</para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>upn_dns_info_ex_present</term>
                                <listitem>
                                    <para>The PAC must contain the extension of
                                    the UPN-DNS-INFO buffer, implies
                                    'check_upn_dns_info_ex',
                                    'upn_dns_info_present' and 'check_upn'.
                                    </para>
                                </listitem>
                            </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            Default: no_check (AD and IPA provider
                            'check_upn, check_upn_allow_missing, check_upn_dns_info_ex')
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>

        <refsect2 id='SESSION_RECORDING'>
            <title>Session recording configuration options</title>
            <para>
                Session recording works in conjunction with
                <citerefentry>
                    <refentrytitle>tlog-rec-session</refentrytitle>
                    <manvolnum>8</manvolnum>
                </citerefentry>, a part of tlog package, to log what users see
                and type when they log in on a text terminal.
                See also
                <citerefentry>
                    <refentrytitle>sssd-session-recording</refentrytitle>
                    <manvolnum>5</manvolnum>
                </citerefentry>.
            </para>
            <para>
                These options can be used to configure session recording
                and should be specified under the
                <quote>[session_recording]</quote> section.
            </para>
            <para>
            Note: Unlike other sections, the <quote>[session_recording]</quote>
            section ignores <replaceable>debug*</replaceable> options and suitable
            <replaceable>debug*</replaceable> options must be set in
            <quote>[pam]</quote>, <quote>[nss]</quote> and
            <quote>[domain/<replaceable>NAME</replaceable>]</quote> sections.
            </para>
            <variablelist>
                <varlistentry>
                    <term>scope (string)</term>
                    <listitem>
                        <para>
                            One of the following strings specifying the scope
                            of session recording:
                            <variablelist>
                                <varlistentry>
                                    <term>"none"</term>
                                    <listitem>
                                        <para>
                                            No users are recorded.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>"some"</term>
                                    <listitem>
                                        <para>
                                            Users/groups specified by
                                            <replaceable>users</replaceable>
                                            and
                                            <replaceable>groups</replaceable>
                                            options are recorded.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>"all"</term>
                                    <listitem>
                                        <para>
                                            All users are recorded.
                                        </para>
                                    </listitem>
                                </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            Default: "none"
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>users (string)</term>
                    <listitem>
                        <para>
                            A comma-separated list of users which should have
                            session recording enabled. Matches user names as
                            returned by NSS. I.e. after the possible space
                            replacement, case changes, etc.
                        </para>
                        <para>
                            Default: Empty. Matches no users.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>groups (string)</term>
                    <listitem>
                        <para>
                            A comma-separated list of groups, members of which
                            should have session recording enabled. Matches
                            group names as returned by NSS. I.e. after the
                            possible space replacement, case changes, etc.
                        </para>
                        <para>
                            NOTE: using this option (having it set to
                            anything) has a considerable performance cost,
                            because each uncached request for a user requires
                            retrieving and matching the groups the user is
                            member of.
                        </para>
                        <para>
                            Default: Empty. Matches no groups.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>exclude_users (string)</term>
                    <listitem>
                        <para>
                            A comma-separated list of users to be excluded from
                            recording, only applicable with 'scope=all'.
                        </para>
                        <para>
                            Default: Empty. No users excluded.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>exclude_groups (string)</term>
                    <listitem>
                        <para>
                            A comma-separated list of groups, members of which
                            should be excluded from recording. Only applicable
                            with 'scope=all'.
                        </para>
                        <para>
                            NOTE: using this option (having it set to
                            anything) has a considerable performance cost,
                            because each uncached request for a user requires
                            retrieving and matching the groups the user is
                            member of.
                        </para>
                        <para>
                            Default: Empty. No groups excluded.
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </refsect2>

    </refsect1>

    <refsect1 id='domain-sections'>
        <title>DOMAIN SECTIONS</title>
        <para>
            These configuration options can be present in a domain
            configuration section, that is, in a section called
            <quote>[domain/<replaceable>NAME</replaceable>]</quote>
            <variablelist>
                <varlistentry>
                    <term>enabled (boolean)</term>
                    <listitem>
                        <para>
                            Explicitly enable or disable the domain. If
                            <quote>true</quote>, the domain is always
                            <quote>enabled</quote>. If <quote>false</quote>,
                            the domain is always <quote>disabled</quote>. If
                            this option is not set, the domain is enabled only
                            if it is listed in the domains option in the
                            <quote>[sssd]</quote> section.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>domain_type (string)</term>
                    <listitem>
                        <para>
                            Specifies whether the domain is meant to be used
                            by POSIX-aware clients such as the Name Service Switch
                            or by applications that do not need POSIX data to be
                            present or generated. Only objects from POSIX domains
                            are available to the operating system interfaces and
                            utilities.
                        </para>
                        <para>
                            Allowed values for this option are <quote>posix</quote>
                            and <quote>application</quote>.
                        </para>
                        <para>
                            POSIX domains are reachable by all services. Application
                            domains are only reachable from the InfoPipe responder (see
                            <citerefentry>
                                <refentrytitle>sssd-ifp</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>) and the PAM responder.
                        </para>
                        <para>
                            NOTE: The application domains are currently well tested with
                            <quote>id_provider=ldap</quote> only.
                        </para>
                        <para>
                            For an easy way to configure a non-POSIX domains, please
                            see the <quote>Application domains</quote> section.
                        </para>
                        <para>
                            Default: posix
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>min_id,max_id (integer)</term>
                    <listitem>
                        <para>
                            UID and GID limits for the domain. If a domain
                            contains an entry that is outside these limits, it
                            is ignored.
                        </para>
                        <para>
                            For users, this affects the primary GID limit. The
                            user will not be returned to NSS if either the
                            UID or the primary GID is outside the range. For
                            non-primary group memberships, those that are in
                            range will be reported as expected.
                        </para>
                        <para>
                            These ID limits affect even saving entries to
                            cache, not only returning them by name or ID.
                        </para>
                        <para>
                            Default: 1 for min_id, 0 (no limit) for max_id
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>enumerate (boolean)</term>
                    <listitem>
                        <para>
                            Determines if a domain can be enumerated,
                            that is, whether the domain can list all the
                            users and group it contains. Note that it is
                            not required to enable enumeration in order
                            for secondary groups to be displayed. This
                            parameter can have one of the following values:
                        </para>
                        <para>
                            TRUE = Users and groups are enumerated
                        </para>
                        <para>
                            FALSE = No enumerations for this domain
                        </para>
                        <para>
                            Default: FALSE
                        </para>
                        <para>
                            Enumerating a domain requires SSSD to download
                            and store ALL user and group entries from the
                            remote server.
                        </para>
                        <para condition="without_ext_enumeration">
                            Feature is only supported for domains with
                            id_provider = ldap or id_provider = proxy.
                        </para>
                        <para>
                            Note: Enabling enumeration has a severe
                            performance impact on SSSD while enumeration
                            is running. It may take up to several minutes
                            after SSSD startup to fully complete enumerations.
                            During this time, individual requests for
                            information will go directly to LDAP, though it
                            may be slow, due to the heavy enumeration
                            processing. Saving a large number of entries
                            to cache after the enumeration completes might
                            also be CPU intensive as the memberships have
                            to be recomputed. This can lead to the
                            <quote>sssd_be</quote> process becoming unresponsive
                            or even restarted by the internal watchdog.
                        </para>
                        <para>
                            While the first enumeration is running, requests
                            for the complete user or group lists may return
                            no results until it completes.
                        </para>
                        <para>
                            Further, enabling enumeration may increase the time
                            necessary to detect network disconnection, as
                            longer timeouts are required to ensure that
                            enumeration lookups are completed successfully.
                            For more information, refer to the man pages for
                            the specific id_provider in use.
                        </para>
                        <para>
                            For the reasons cited above, enabling enumeration
                            is not recommended, especially in large
                            environments.
                        </para>
                        <para>
                            Note: the proxy provider is tested with open source
                            modules like 'libnss_files' and 'libnss_ldap'.
                            3rd party modules must follow the documented
                            behavior of nss modules to be used in this configuration.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss consider
                            entries valid before asking the backend again
                        </para>
                        <para>
                            The cache expiration timestamps are stored
                            as attributes of individual objects in the
                            cache. Therefore, changing the cache timeout only
                            has effect for newly added or expired entries.
                            You should run the
                            <citerefentry>
                                <refentrytitle>sss_cache</refentrytitle>
                                <manvolnum>8</manvolnum>
                            </citerefentry>
                            tool in order to force refresh of entries that
                            have already been cached.
                        </para>
                        <para>
                            Default: 5400
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_user_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss consider
                            user entries valid before asking the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_group_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss consider
                            group entries valid before asking the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_netgroup_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss consider
                            netgroup entries valid before asking the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_service_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss consider
                            service entries valid before asking the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_resolver_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should nss_sss consider
                            hosts and networks entries valid before asking
                            the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry condition="with_sudo">
                    <term>entry_cache_sudo_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should sudo consider
                            rules valid before asking the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry condition="with_autofs">
                    <term>entry_cache_autofs_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds should the autofs service
                            consider automounter maps valid before asking
                            the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry condition="with_ssh">
                    <term>entry_cache_ssh_host_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds to keep a host ssh key after
                            refresh. IE how long to cache the host key
                            for.
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>entry_cache_computer_timeout (integer)</term>
                    <listitem>
                        <para>
                            How many seconds to keep the local computer
                            entry before asking the backend again
                        </para>
                        <para>
                            Default: entry_cache_timeout
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>offline_timeout (integer)</term>
                    <listitem>
                        <para>
                            When SSSD switches to offline mode the amount of
                            time before it tries to go back online will
                            increase based upon the time spent disconnected.
                            By default SSSD uses incremental behaviour to
                            calculate delay in between retries.
                            So, the wait time for a given retry will be longer
                            than the wait time for the previous ones.
                            After each unsuccessful attempt to go online,
                            the new interval is recalculated by the following:
                        </para>
                        <para>
                             new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0...offline_timeout_random_offset]
                        </para>
                        <para>
                            The offline_timeout default value is 60.
                            The offline_timeout_max default value is 3600.
                            The offline_timeout_random_offset default value is 30.
                            The end result is the number of seconds before next retry.
                        </para>
                        <para>
                            Note that the maximum length of each interval
                            is defined by offline_timeout_max (apart from the random part).
                        </para>
                        <para>
                            Default: 60
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>offline_timeout_max (integer)</term>
                    <listitem>
                        <para>
                            Controls by how much the time between attempts to go
                            online can be incremented following unsuccessful
                            attempts to go online.
                        </para>
                        <para>
                            A value of 0 disables the incrementing behaviour.
                        </para>
                        <para>
                            The value of this parameter should be set in correlation
                            to offline_timeout parameter value.
                        </para>
                        <para>
                            With offline_timeout set to 60 (default value) there is no point
                            in setting offline_timeout_max to less than 120 as it will
                            saturate instantly. General rule here should be to set
                            offline_timeout_max to at least 4 times offline_timeout.
                        </para>
                        <para>
                            Although a value between 0 and offline_timeout may be
                            specified, it has the effect of overriding the
                            offline_timeout value so is of little use.
                        </para>
                        <para>
                            Default: 3600
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>offline_timeout_random_offset (integer)</term>
                    <listitem>
                        <para>
                            When SSSD is in offline mode it keeps probing
                            backend servers in specified time intervals:
                        </para>
                        <para>
                            new_delay = Minimum(old_delay * 2, offline_timeout_max) + random[0...offline_timeout_random_offset]
                        </para>
                        <para>
                            This parameter controls the value of the random offset
                            used for the above equation. Final random_offset value
                            will be random number in range:
                        </para>
                        <para>
                            [0 - offline_timeout_random_offset]
                        </para>
                        <para>
                            A value of 0 disables the random offset addition.
                        </para>
                        <para>
                            Default: 30
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>refresh_expired_interval (integer)</term>
                    <listitem>
                        <para>
                            Specifies how many seconds SSSD has to wait before
                            triggering a background refresh task which will
                            refresh all expired or nearly expired records.
                        </para>
                        <para>
                            The background refresh will process users,
                            groups and netgroups in the cache. For users
                            who have performed the initgroups (get group
                            membership for user, typically ran at login)
                            operation in the past, both the user entry
                            and the group membership are updated.
                        </para>
                        <para>
                            This option is automatically inherited for all
                            trusted domains.
                        </para>
                        <para>
                            You can consider setting this value to
                            3/4 * entry_cache_timeout.
                        </para>
                        <para>
                            Cache entry will be refreshed by background task
                            when 2/3 of cache timeout has already passed.
                            If there are existing cached entries, the background
                            task will refer to their original cache timeout
                            values instead of current configuration value.
                            This may lead to a situation in which background refresh
                            task appears to not be working. This is done
                            by design to improve offline mode operation and
                            reuse of existing valid cache entries.
                            To make this change instant the user may want to
                            manually invalidate existing cache.
                        </para>
                        <para>
                            Default: 0 (disabled)
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>cache_credentials (boolean)</term>
                    <listitem>
                        <para>
                            Determines if user credentials are also cached
                            in the local LDB cache. The cached credentials
                            refer to passwords, which includes the first (long
                            term) factor of two-factor authentication, not
                            other authentication mechanisms. Passkey and
                            Smartcard authentications are expected to work
                            offline as long as a successful online
                            authentication is recorded in the cache without
                            additional configuration.
                        </para>
                        <para>
                            Take a note that while credentials are stored as
                            a salted SHA512 hash, this still potentially poses
                            some security risk in case an attacker manages to
                            get access to a cache file (normally requires
                            privileged access) and to break a password using
                            brute force attack.
                        </para>
                        <para>
                            Default: FALSE
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>cache_credentials_minimal_first_factor_length (int)</term>
                    <listitem>
                        <para>
                            If 2-Factor-Authentication (2FA) is used and
                            credentials should be saved this value determines
                            the minimal length the first authentication factor
                            (long term password) must have to be saved as SHA512
                            hash into the cache.
                        </para>
                        <para>
                            This should avoid that the short PINs of a PIN based
                            2FA scheme are saved in the cache which would make
                            them easy targets for brute-force attacks.
                        </para>
                        <para>
                            Default: 8
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>account_cache_expiration (integer)</term>
                    <listitem>
                        <para>
                            Number of days entries are left in cache after
                            last successful login before being removed during
                            a cleanup of the cache. 0 means keep forever.
                            The value of this parameter must be greater than or
                            equal to offline_credentials_expiration.
                        </para>
                        <para>
                            Default: 0 (unlimited)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                  <term>pwd_expiration_warning (integer)</term>
                  <listitem>
                    <para>
                      Display a warning N days before the password expires.
                    </para>
                    <para>
                        If zero is set, then this filter is not applied,
                        i.e. if the expiration warning was received from
                        backend server, it will automatically be displayed.
                    </para>
                    <para>
                      Please note that the backend server has to provide
                      information about the expiration time of the password.
                      If this information is missing, sssd cannot display a
                      warning. Also an auth provider has to be configured for
                      the backend.
                    </para>
                    <para>
                      Default: 7 (Kerberos), 0 (LDAP)
                    </para>
                  </listitem>
                </varlistentry>

                <varlistentry>
                    <term>id_provider (string)</term>
                    <listitem>
                        <para>
                            The identification provider used for the domain.
                            Supported ID providers are:
                        </para>
                        <para>
                            <quote>proxy</quote>: Support a legacy NSS provider.
                        </para>
                        <para>
                            <quote>ldap</quote>:  LDAP provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring LDAP.
                        </para>
                        <para>
                            <quote>ipa</quote>: FreeIPA and Red Hat
                            Identity Management provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring FreeIPA.
                        </para>
                        <para>
                            <quote>ad</quote>: Active Directory provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring Active Directory.
                        </para>
                        <para condition="with_idp_provider">
                            <quote>idp</quote>: Provider for OAuth 2.0/OIDC
                            based Identity Providers (IdP). See
                            <citerefentry>
                                <refentrytitle>sssd-idp</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information.
                        </para>
                        <para>
                            Default: Not set (This is a mandatory setting that
                            must be explicitly defined for each configured
                            domain).
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>use_fully_qualified_names (boolean)</term>
                    <listitem>
                        <para>
                            Use the full name and domain (as formatted by
                            the domain's full_name_format) as the user's login
                            name reported to NSS.
                        </para>
                        <para>
                            If set to TRUE, all requests to this domain
                            must use fully qualified names. For example,
                            if used in EXAMPLE domain that contains a "test"
                            user, <command>getent passwd test</command>
                            wouldn't find the user while <command>getent
                            passwd test@EXAMPLE</command> would.
                        </para>
                        <para>
                            NOTE: This option has no effect on netgroup
                            lookups due to their tendency to include nested
                            netgroups without qualified names. For netgroups,
                            all domains will be searched when an unqualified
                            name is requested.
                        </para>
                        <para>
                            Default: FALSE (TRUE for trusted
                            domain/sub-domains or if default_domain_suffix
                            is used)
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>ignore_group_members (boolean)</term>
                    <listitem>
                        <para>
                            Do not return group members for group lookups.
                        </para>
                        <para>
                            If set to TRUE, the group membership attribute
                            is not requested from the ldap server, and
                            group members are not returned when processing
                            group lookup calls, such as
                            <citerefentry>
                                <refentrytitle>getgrnam</refentrytitle>
                                <manvolnum>3</manvolnum>
                            </citerefentry>
                            or
                            <citerefentry>
                                <refentrytitle>getgrgid</refentrytitle>
                                <manvolnum>3</manvolnum>
                            </citerefentry>.
                            As an effect, <quote>getent group
                            $groupname</quote> would return the requested
                            group as if it was empty.
                        </para>
                        <para>
                            Enabling this option can also make access
                            provider checks for group membership
                            significantly faster, especially for groups
                            containing many members.
                        </para>
                        <para>
                            This option can be also set per subdomain or
                            inherited via
                            <emphasis>subdomain_inherit</emphasis>.
                        </para>
                        <para>
                            Default: FALSE
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>auth_provider (string)</term>
                    <listitem>
                        <para>
                            The authentication provider used for the domain.
                            Supported auth providers are:
                        </para>
                        <para>
                            <quote>ldap</quote> for native LDAP authentication. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring LDAP.
                        </para>
                        <para>
                            <quote>krb5</quote> for Kerberos authentication. See
                            <citerefentry>
                                <refentrytitle>sssd-krb5</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring Kerberos.
                        </para>
                        <para>
                            <quote>ipa</quote>: FreeIPA and Red Hat
                            Identity Management provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring FreeIPA.
                        </para>
                        <para>
                            <quote>ad</quote>: Active Directory provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring Active Directory.
                        </para>
                        <para condition="with_idp_provider">
                            <quote>idp</quote>: Provider for OAuth 2.0/OIDC
                            based authentication. See
                            <citerefentry>
                                <refentrytitle>sssd-idp</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information.
                        </para>
                        <para>
                            <quote>proxy</quote> for relaying authentication to some other PAM target.
                        </para>
                        <para>
                            <quote>none</quote> disables authentication explicitly.
                        </para>
                        <para>
                            Default: <quote>id_provider</quote> is used if it
                            is set and can handle authentication requests.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>access_provider (string)</term>
                    <listitem>
                        <para>
                            The access control provider used for the domain.
                            There are two built-in access providers (in
                            addition to any included in installed backends)
                            Internal special providers are:
                        </para>
                        <para>
                            <quote>permit</quote> always allow access.
                        </para>
                        <para>
                            <quote>deny</quote> always deny access.
                        </para>
                        <para>
                            <quote>ldap</quote> for native LDAP authentication. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring LDAP.
                        </para>
                        <para>
                            <quote>ipa</quote>: FreeIPA and Red Hat
                            Identity Management provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring FreeIPA.
                        </para>
                        <para>
                            <quote>ad</quote>: Active Directory provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring Active Directory.
                        </para>
                        <para>
                            <quote>simple</quote> access control based on access
                            or deny lists. See <citerefentry>
                            <refentrytitle>sssd-simple</refentrytitle>
                            <manvolnum>5</manvolnum></citerefentry> for more
                            information on configuring the simple access module.
                        </para>
                        <para>
                            <quote>krb5</quote>: .k5login based access control.
                            See <citerefentry>
                            <refentrytitle>sssd-krb5</refentrytitle>
                            <manvolnum>5</manvolnum></citerefentry> for more
                            information on configuring Kerberos.
                        </para>
                        <para>
                            <quote>proxy</quote> for relaying access control to another PAM module.
                        </para>
                        <para>
                            Default: <quote>permit</quote>
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>chpass_provider (string)</term>
                    <listitem>
                        <para>
                            The provider which should handle change password
                            operations for the domain.
                            Supported change password providers are:
                        </para>
                        <para>
                            <quote>ldap</quote> to change a password stored
                            in a LDAP server. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring LDAP.
                        </para>
                        <para>
                            <quote>krb5</quote>  to change the Kerberos
                            password. See
                            <citerefentry>
                                <refentrytitle>sssd-krb5</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring Kerberos.
                        </para>
                        <para>
                            <quote>ipa</quote>: FreeIPA and Red Hat
                            Identity Management provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring FreeIPA.
                        </para>
                        <para>
                            <quote>ad</quote>: Active Directory provider. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on
                            configuring Active Directory.
                        </para>
                        <para>
                            <quote>proxy</quote> for relaying password changes
                            to some other PAM target.
                        </para>
                        <para>
                            <quote>none</quote> disallows password changes explicitly.
                        </para>
                        <para>
                            Default: <quote>auth_provider</quote> is used if it
                            is set and can handle change password requests.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry condition="with_sudo">
                    <term>sudo_provider (string)</term>
                    <listitem>
                        <para>
                            The SUDO provider used for the domain.
                            Supported SUDO providers are:
                        </para>
                        <para>
                            <quote>ldap</quote> for rules stored in LDAP. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring
                            LDAP.
                        </para>
                        <para>
                            <quote>ipa</quote> the same as <quote>ldap</quote>
                            but with IPA default settings.
                        </para>
                        <para>
                            <quote>ad</quote> the same as <quote>ldap</quote>
                            but with AD default settings.
                        </para>
                        <para>
                            <quote>none</quote> disables SUDO explicitly.
                        </para>
                        <para>
                            Default: The value of <quote>id_provider</quote> is
                            used if it is set and can handle sudo requests.
                        </para>
                        <para>
                            The detailed instructions for configuration of
                            sudo_provider are in the manual page
                            <citerefentry>
                                <refentrytitle>sssd-sudo</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>.
                             There are many configuration options that can be
                             used to adjust the behavior. Please refer to
                             "ldap_sudo_*" in
                             <citerefentry>
                                 <refentrytitle>sssd-ldap</refentrytitle>
                                 <manvolnum>5</manvolnum>
                             </citerefentry>.
                        </para>
                        <para>
                            <emphasis>NOTE:</emphasis> Sudo rules are
                            periodically downloaded in the background unless
                            the sudo provider is explicitly disabled. Set
                            <emphasis>sudo_provider = None</emphasis> to
                            disable all sudo-related activity in SSSD if you do
                            not want to use sudo with SSSD at all.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>selinux_provider (string)</term>
                    <listitem>
                        <para>
                            The provider which should handle loading of selinux
                            settings. Note that this provider will be called right
                            after access provider ends.
                            Supported selinux providers are:
                        </para>
                        <para>
                            <quote>ipa</quote> to load selinux settings
                            from an IPA server. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring IPA.
                        </para>
                        <para>
                            <quote>none</quote> disallows fetching selinux settings explicitly.
                        </para>
                        <para>
                            Default: <quote>id_provider</quote> is used if it
                            is set and can handle selinux loading requests.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>subdomains_provider (string)</term>
                    <listitem>
                        <para>
                            The provider which should handle fetching of
                            subdomains. This value should be always the same as
                            id_provider.
                            Supported subdomain providers are:
                        </para>
                        <para>
                            <quote>ipa</quote> to load a list of subdomains
                            from an IPA server. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring
                            IPA.
                        </para>
                        <para>
                            <quote>ad</quote> to load a list of subdomains
                            from an Active Directory server. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring
                            the AD provider.
                        </para>
                        <para>
                            <quote>none</quote> disallows fetching subdomains
                            explicitly.
                        </para>
                        <para>
                            Default: The value of <quote>id_provider</quote> is
                            used if it is set and can handle subdomain requests.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>session_provider (string)</term>
                    <listitem>
                        <para>
                            The provider which configures and manages user session
                            related tasks. The only user session task currently
                            provided is the integration with Fleet Commander, which
                            works only with IPA.
                            Supported session providers are:
                        </para>
                        <para>
                            <quote>ipa</quote> to allow performing user session
                            related tasks.
                        </para>
                        <para>
                            <quote>none</quote> does not perform any kind of user
                            session related tasks.
                        </para>
                        <para>
                            Default: <quote>none</quote>.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry condition="with_autofs">
                    <term>autofs_provider (string)</term>
                    <listitem>
                        <para>
                            The autofs provider used for the domain.
                            Supported autofs providers are:
                        </para>
                        <para>
                            <quote>ldap</quote> to load maps stored in LDAP. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring LDAP.
                        </para>
                        <para>
                            <quote>ipa</quote> to load maps stored in an IPA
                            server. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring IPA.
                        </para>
                        <para>
                            <quote>ad</quote> to load maps stored in an AD
                            server. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring
                            the AD provider.
                        </para>
                        <para>
                            <quote>none</quote> disables autofs explicitly.
                        </para>
                        <para>
                            Default: The value of <quote>id_provider</quote> is used if it
                            is set and can handle autofs requests.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>hostid_provider (string)</term>
                    <listitem>
                        <para>
                            The provider used for retrieving host identity information.
                            Supported hostid providers are:
                        </para>
                        <para>
                            <quote>ipa</quote> to load host identity stored in an IPA
                            server. See
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring IPA.
                        </para>
                        <para>
                            <quote>none</quote> disables hostid explicitly.
                        </para>
                        <para>
                            Default: The value of <quote>id_provider</quote> is used if it
                            is set and can handle hostid requests.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>resolver_provider (string)</term>
                    <listitem>
                        <para>
                            The provider which should handle hosts and networks
                            lookups. Supported resolver providers are:
                        </para>
                        <para>
                            <quote>proxy</quote> to forward lookups to another
                            NSS library. See <quote>proxy_resolver_lib_name</quote>
                        </para>
                        <para>
                            <quote>ldap</quote> to fetch hosts and networks stored in LDAP. See
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring LDAP.
                        </para>
                        <para>
                            <quote>ad</quote> to fetch hosts and networks stored in AD. See
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information on configuring
                            the AD provider.
                        </para>
                        <para>
                            <quote>none</quote> disallows fetching hosts and networks explicitly.
                        </para>
                        <para>
                            Default: The value of <quote>id_provider</quote> is used if it
                            is set and can handle resolver requests.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>re_expression (string)</term>
                    <listitem>
                        <para>
                            Regular expression for this domain that describes
                            how to parse the string containing user name and
                            domain into these components.
                            The "domain" can match either the SSSD
                            configuration domain name, or, in the case
                            of IPA trust subdomains and Active Directory
                            domains, the flat (NetBIOS) name of the domain.
                        </para>
                        <para>
                            Default: <quote>^((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]*)|(?P&lt;name&gt;[^@]+))$</quote>

                            which allows two different styles for user names:
                            <itemizedlist>
                                <listitem>
                                    <para>username</para>
                                </listitem>
                                <listitem>
                                    <para>username@domain.name</para>
                                </listitem>
                           </itemizedlist>
                        </para>
                        <para>
                            Default for the AD and IPA provider:
                            <quote>^(((?P&lt;domain&gt;[^\\]+)\\(?P&lt;name&gt;.+))|((?P&lt;name&gt;.+)@(?P&lt;domain&gt;[^@]+))|((?P&lt;name&gt;[^@\\]+)))$</quote>

                            which allows three different styles for user names:
                            <itemizedlist>
                                <listitem>
                                    <para>username</para>
                                </listitem>
                                <listitem>
                                    <para>username@domain.name</para>
                                </listitem>
                                <listitem>
                                    <para>domain\username</para>
                                </listitem>
                            </itemizedlist>
                            While the first two correspond to the general
                            default the third one is introduced to allow easy
                            integration of users from Windows domains.
                        </para>
                        <para>
                            The default re_expression uses the <quote>@</quote>
                            character as a separator between the name and the
                            domain. As a result of this setting the default
                            does not accept the <quote>@</quote> character in
                            short names (as it is allowed in Windows group
                            names). If a user wishes to use short names with
                            <quote>@</quote> they must create their own
                            re_expression.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>full_name_format (string)</term>
                    <listitem>
                        <para>
                            A <citerefentry>
                                <refentrytitle>printf</refentrytitle>
                                <manvolnum>3</manvolnum>
                            </citerefentry>-compatible format that describes how to
                            compose a fully qualified name from user name
                            and domain name components.
                        </para>
                        <para>
                            The following expansions are supported:
                            <variablelist>
                                <varlistentry>
                                    <term>%1$s</term>
                                    <listitem><para>user name</para></listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>%2$s</term>
                                    <listitem>
                                        <para>
                                            domain name as specified in the
                                            SSSD config file.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>%3$s</term>
                                    <listitem>
                                        <para>
                                            domain flat name. Mostly usable
                                            for Active Directory domains, both
                                            directly configured or discovered
                                            via IPA trusts.
                                        </para>
                                    </listitem>
                                </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            Default: <quote>%1$s@%2$s</quote>.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>lookup_family_order (string)</term>
                    <listitem>
                        <para>
                            Provides the ability to select preferred address family
                            to use when performing DNS lookups.
                        </para>
                        <para>
                            Supported values:
                        </para>
                        <para>
                            ipv4_first: Try looking up IPv4 address, if that fails, try IPv6
                        </para>
                        <para>
                            ipv4_only: Only attempt to resolve hostnames to IPv4 addresses.
                        </para>
                        <para>
                            ipv6_first: Try looking up IPv6 address, if that fails, try IPv4
                        </para>
                        <para>
                            ipv6_only: Only attempt to resolve hostnames to IPv6 addresses.
                        </para>
                        <para>
                            Default: ipv4_first
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>dns_resolver_server_timeout (integer)</term>
                    <listitem>
                        <para>
                            Defines the amount of time (in milliseconds)
                            SSSD would try to talk to DNS server before
                            trying next DNS server.
                        </para>
                        <para>
                            The AD provider will use this option for the
                            CLDAP ping timeouts as well.
                        </para>
                        <para>
                            Please see the section <quote>FAILOVER</quote>
                            in
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>,
                            <citerefentry>
                                <refentrytitle>sssd-krb5</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>,
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                           </citerefentry> or
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information about the
                            service resolution.
                        </para>
                        <para>
                            Default: 1000
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>dns_resolver_op_timeout (integer)</term>
                    <listitem>
                        <para>
                            Defines the amount of time (in seconds) to
                            wait to resolve single DNS query
                            (e.g. resolution of a hostname or an SRV record)
                            before trying the next hostname or DNS discovery.
                        </para>
                        <para>
                            Please see the section <quote>FAILOVER</quote>
                            in
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>,
                            <citerefentry>
                                <refentrytitle>sssd-krb5</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>,
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> or
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information about the
                            service resolution.
                        </para>
                        <para>
                            Default: 3
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>dns_resolver_timeout (integer)</term>
                    <listitem>
                        <para>
                            Defines the amount of time (in seconds) to
                            wait for a reply from the internal fail over
                            service before assuming that the service is
                            unreachable. If this timeout is reached, the
                            domain will continue to operate in offline mode.
                        </para>
                        <para>
                            Please see the section <quote>FAILOVER</quote>
                            in
                            <citerefentry>
                                <refentrytitle>sssd-ldap</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>,
                            <citerefentry>
                                <refentrytitle>sssd-krb5</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry>,
                            <citerefentry>
                                <refentrytitle>sssd-ipa</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> or
                            <citerefentry>
                                <refentrytitle>sssd-ad</refentrytitle>
                                <manvolnum>5</manvolnum>
                            </citerefentry> for more information about the
                            service resolution.
                        </para>
                        <para>
                            Default: 6
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>dns_resolver_use_search_list (boolean)</term>
                    <listitem>
                        <para>
                            Normally, the DNS resolver searches the domain
                            list defined in the "search" directive from the
                            resolv.conf file. This can lead to delays in
                            environments with improperly configured DNS.
                        </para>
                        <para>
                            If fully qualified domain names (or _srv_) are used
                            in the SSSD configuration, setting this option
                            to FALSE can prevent unnecessary DNS lookups in such
                            environments.
                        </para>
                        <para>
                            Default: TRUE
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>dns_discovery_domain (string)</term>
                    <listitem>
                        <para>
                            If service discovery is used in the back end, specifies
                            the domain part of the service discovery DNS query.
                        </para>
                        <para>
                            Default: Use the domain part of machine's hostname
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>failover_primary_timeout (integer)</term>
                    <listitem>
                        <para>
                            When no primary server is available, SSSD
                            fails over to a backup server. This option
                            defines the number of seconds SSSD
                            waits before attempting to reconnect to the primary
                            server.
                        </para>
                        <para>
                            Note: The minimum value is 31.
                        </para>
                        <para>
                            Default: 31
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>override_gid (integer)</term>
                    <listitem>
                        <para>
                            Override the primary GID value for all users in the
                            domain with specified value.
                        </para>
                        <para>
                            Default: not set (Use the primary GID value retrieved
                            from the identity provider)
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>case_sensitive (string)</term>
                    <listitem>
                        <para>
                            Treat user and group names as case sensitive.
                            Possible option values are:
                        <variablelist>
                            <varlistentry>
                                <term>True</term>
                                <listitem>
                                    <para>
                                        Case sensitive. This value is invalid
                                        for AD provider.
                                    </para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>False</term>
                                <listitem>
                                    <para>Case insensitive.</para>
                                </listitem>
                            </varlistentry>
                            <varlistentry>
                                <term>Preserving</term>
                                <listitem>
                                    <para>
                                        Same as False (case insensitive), but
                                        does not lowercase names in the result
                                        of NSS operations. Note that name
                                        aliases (and in case of services also
                                        protocol names) are still lowercased in
                                        the output.
                                    </para>
                                    <para>
                                        If you want to set this value for
                                        trusted domain with IPA provider, you
                                        need to set it on both the client and
                                        SSSD on the server.
                                    </para>
                                </listitem>
                            </varlistentry>
                        </variablelist>
                        </para>
                        <para>
                            This option can be also set per subdomain or
                            inherited via
                            <emphasis>subdomain_inherit</emphasis>.
                        </para>
                        <para>
                            Default: True (False for AD provider)
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>avoid_by_id_lookups (boolean)</term>
                    <listitem>
                        <para>
                            If this option is set to 'true' SSSD will try to
                            avoid sending lookups by ID to the backend and
                            will switch to a lookup by name if a cached
                            object with a matching ID can be found.
                        </para>
                        <para>
                            This option can e.g. be used in cases where
                            searches by ID are expensive on the server side
                            because of missing indexes or are not even
                            possible, e.g. due to non-reversible POSIX
                            id-mapping.
                        </para>
                        <para>
                            Default: False (True for IdP provider)
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>subdomain_inherit (string)</term>
                    <listitem>
                        <para>
                            Specifies a list of configuration parameters that
                            should be inherited by a subdomain. Please note
                            that only selected parameters can be inherited.
                            Currently the following options can be inherited:
                        </para>
                        <para>
                            ldap_search_timeout
                        </para>
                        <para>
                            ldap_network_timeout
                        </para>
                        <para>
                            ldap_opt_timeout
                        </para>
                        <para>
                            ldap_offline_timeout
                        </para>
                        <para>
                            ldap_purge_cache_timeout
                        </para>
                        <para>
                            ldap_purge_cache_offset
                        </para>
                        <para>
                            ldap_krb5_keytab (the value of krb5_keytab will be
                            used if ldap_krb5_keytab is not set explicitly)
                        </para>
                        <para>
                            ldap_krb5_ticket_lifetime
                        </para>
                        <para>
                            ldap_connection_expire_timeout
                        </para>
                        <para>
                            ldap_connection_expire_offset
                        </para>
                        <para>
                            ldap_connection_idle_timeout
                        </para>
                        <para>
                            ldap_use_tokengroups
                        </para>
                        <para>
                            ldap_user_principal
                        </para>
                        <para>
                            ignore_group_members
                        </para>
                        <para>
                            auto_private_groups
                        </para>
                        <para>
                            case_sensitive
                        </para>
                        <para>
                            Example:
                            <programlisting>
subdomain_inherit = ldap_purge_cache_timeout
                            </programlisting>
                        </para>
                        <para>
                            Default: none
                        </para>
                        <para>
                            Note: This option only works with the IPA and
                            AD provider.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>subdomain_homedir (string)</term>
                    <listitem>
                        <para>
                            Use this homedir as default value for all subdomains
                            within this domain in IPA AD trust.
                            See <emphasis>override_homedir</emphasis>
                            for info about possible values. In addition to those, the
                            expansion below can only be used with
                            <emphasis>subdomain_homedir</emphasis>.
                            <variablelist>
                                <varlistentry>
                                    <term>%F</term>
                                    <listitem><para>flat (NetBIOS) name of a subdomain.</para></listitem>
                                </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            The value can be overridden by
                            <emphasis>override_homedir</emphasis> option.
                        </para>
                        <para>
                            Default: <filename>/home/%d/%u</filename>
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>realmd_tags (string)</term>
                    <listitem>
                        <para>
                            Various tags stored by the realmd configuration service
                            for this domain.
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>cached_auth_timeout (int)</term>
                    <listitem>
                        <para>
                            Specifies the number of seconds since the last successful
                            online authentication during which SSSD will authenticate
                            users via cached credentials, even while online.
                            If the cached authentication fails, SSSD immediately
                            falls back to online authentication.
                        </para>
                        <para>
                            This option's value is inherited by all trusted
                            domains. At the moment it is not possible to set
                            a different value per trusted domain.
                        </para>
                        <para>
                            Special value 0 implies that this feature is
                            disabled.
                        </para>
                        <para>
                            Please note that if <quote>cached_auth_timeout</quote>
                            is longer than <quote>pam_id_timeout</quote> then the
                            back end could be called to handle
                            <quote>initgroups.</quote>
                        </para>
                        <para>
                            Default: 0
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>local_auth_policy (string)</term>
                    <listitem>
                        <para>
                            Local authentication methods policy. Some backends
                            (i.e. LDAP, proxy provider) only support a password
                            based authentication, while others can handle PKINIT
                            based Smartcard authentication (AD, IPA),
                            two-factor authentication (IPA), or other methods
                            against a central instance. By default in such cases
                            authentication is only performed with the methods
                            supported by the backend. With this option additional
                            methods can be enabled which are evaluated and checked
                            locally.
                        </para>
                        <para>
                            There are three possible values for this option:
                            match, only, enable. <quote>match</quote> is
                            used to match offline and online states for Kerberos
                            methods. <quote>only</quote> ignores the online methods
                            and only offer the local ones. enable allows explicitly
                            defining the methods for local authentication. As an
                            example, <quote>enable:passkey</quote>, only enables
                            passkey for local authentication. Multiple enable values
                            should be comma-separated, such as
                            <quote>enable:passkey, enable:smartcard</quote>
                        </para>

                        <para>
                            The following table shows which authentication
                            methods, if configured properly, are currently enabled
                             or disabled for each backend, with the default
                             local_auth_policy: <quote>match</quote>
                        </para>
                        <informaltable frame='all'>
                        <tgroup cols='3'>
                        <colspec colname='c1' align='center'/>
                        <colspec colname='c2' align='center'/>
                        <colspec colname='c3' align='center'/>

                        <thead>
                        <row><entry namest='c1' nameend='c3' align='center'>
                            local_auth_policy = match (default)</entry></row>
                        <row><entry></entry><entry>Passkey</entry>
                            <entry>Smartcard</entry></row>
                        </thead>
                        <tbody>
                        <row><entry>IPA</entry><entry>enabled</entry>
                            <entry><para>enabled</para>
                            </entry></row>
                        <row><entry>AD</entry><entry>disabled</entry>
                            <entry><para>enabled</para></entry>
                            </row>
                        <row><entry>LDAP</entry><entry>disabled</entry>
                            <entry><para>disabled</para></entry>
                            </row>
                        </tbody></tgroup></informaltable>
                        <para>
                            Please note that if local Smartcard authentication
                            is enabled and a Smartcard is present, Smartcard
                            authentication will be preferred over the
                            authentication methods supported by the backend.
                            I.e. there will be a PIN prompt instead of e.g. a
                            password prompt.
                        </para>
                        <para>
                            The following configuration example allows local users
                            to authenticate locally using any enabled method
                            (i.e. smartcard, passkey).
<programlisting>
[domain/shadowutils]
id_provider = proxy
proxy_lib_name = files
auth_provider = none
local_auth_policy = only
</programlisting>
                        </para>
                        <para>
                            Default: match
                        </para>
                    </listitem>
                </varlistentry>
                <varlistentry>
                    <term>auto_private_groups (string)</term>
                    <listitem>
                        <para>
                            This option takes any of three available values:
                            <variablelist>
                                <varlistentry>
                                    <term>true</term>
                                    <listitem>
                                        <para>
                                            Create user's private group unconditionally from user's UID number.
                                            The GID number is ignored in this case.
                                        </para>
                                        <para>
                                            NOTE: Because the GID number and the user private group
                                            are inferred from the UID number, it is not supported
                                            to have multiple entries with the same UID or GID number
                                            with this option. In other words, enabling this option
                                            enforces uniqueness across the ID space.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>false</term>
                                    <listitem>
                                        <para>
                                            Always use the user's primary GID number. The GID number must refer
                                            to a group object in the LDAP database.
                                        </para>
                                    </listitem>
                                </varlistentry>
                                <varlistentry>
                                    <term>hybrid</term>
                                    <listitem>
                                        <para>
                                            A primary group is autogenerated
                                            for user entries whose UID
                                            and GID numbers have the same
                                            value and at the same time the
                                            GID number does not correspond
                                            to a real group object in LDAP.
                                            If the values are the same, but
                                            the primary GID in the user entry
                                            is also used by a group object,
                                            the primary GID of the user resolves
                                            to that group object.
                                        </para>
                                        <para>
                                            If the UID and GID of a user
                                            are different, then the GID
                                            must correspond to a group
                                            entry, otherwise the GID is
                                            simply not resolvable.
                                        </para>
                                        <para>
                                            This feature is useful for
                                            environments that wish to stop
                                            maintaining a separate group
                                            objects for the user private
                                            groups, but also wish to retain
                                            the existing user private groups.
                                        </para>
                                    </listitem>
                                </varlistentry>
                            </variablelist>
                        </para>
                        <para>
                            For the LDAP based id providers (LDAP, IPA and
                            AD) the default for the configured domain is
                            typically False because the sources have the
                            concept of a primary group.
                            <phrase condition="with_idp_provider">The IdP id
                            provider is using True because IdPs typically do
                            not have primary groups.</phrase>
                        </para>
                        <para>
                            For subdomains, the default value is False for
                            subdomains that use assigned POSIX IDs and True
                            for subdomains that use automatic ID-mapping.
                        </para>
                        <para>
                            The value of auto_private_groups can either be set per subdomains
                            in a subsection, for example:
<programlisting>
[domain/forest.domain/sub.domain]
auto_private_groups = false
</programlisting>
                            or globally for all subdomains in the main domain section
                            using the subdomain_inherit option:
<programlisting>
[domain/forest.domain]
subdomain_inherit = auto_private_groups
auto_private_groups = false
</programlisting>
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
        </para>

        <para>
            Options valid for proxy domains.

            <variablelist>
                <varlistentry>
                    <term>proxy_pam_target (string)</term>
                    <listitem>
                        <para>
                            The proxy target PAM proxies to.
                        </para>
                        <para>
                            Default: not set by default, you have to take an
                            existing pam configuration or create a new one and
                            add the service name here. As an alternative you
                            can enable local authentication with the
                            local_auth_policy option.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>proxy_lib_name (string)</term>
                    <listitem>
                        <para>
                            The name of the NSS library to use in proxy
                            domains. The NSS functions searched for in the
                            library are in the form of
                            _nss_$(libName)_$(function), for example
                            _nss_files_getpwent.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>proxy_resolver_lib_name (string)</term>
                    <listitem>
                        <para>
                            The name of the NSS library to use for hosts and
                            networks lookups in proxy domains. The NSS
                            functions searched for in the
                            library are in the form of
                            _nss_$(libName)_$(function), for example
                            _nss_dns_gethostbyname2_r.
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>proxy_fast_alias (boolean)</term>
                    <listitem>
                        <para>
                            When a user or group is looked up by name in
                            the proxy provider, a second lookup by ID is
                            performed to "canonicalize" the name in case
                            the requested name was an alias. Setting this
                            option to true would cause the SSSD to perform
                            the ID lookup from cache for performance reasons.
                        </para>
                        <para>
                            Default: false
                        </para>
                    </listitem>
                </varlistentry>

                <varlistentry>
                    <term>proxy_max_children (integer)</term>
                    <listitem>
                        <para>
                            This option specifies the number of pre-forked
                            proxy children. It is useful for high-load SSSD
                            environments where sssd may run out of available
                            child slots, which would cause some issues due to
                            the requests being queued.
                        </para>
                        <para>
                            Default: 10
                        </para>
                    </listitem>
                </varlistentry>

            </variablelist>
        </para>

        <refsect2 id='app_domains'>
            <title>Application domains</title>
            <para>
                SSSD, with its D-Bus interface (see
                <citerefentry>
                    <refentrytitle>sssd-ifp</refentrytitle>
                    <manvolnum>5</manvolnum>
                </citerefentry>) is appealing to applications
                as a gateway to an LDAP directory where users and groups
                are stored. However, contrary to the traditional SSSD
                deployment where all users and groups either have POSIX
                attributes or those attributes can be inferred from the
                Windows SIDs, in many cases the users and groups in the
                application support scenario have no POSIX attributes.
                Instead of setting a
                <quote>[domain/<replaceable>NAME</replaceable>]</quote>
                section, the administrator can set up an
                <quote>[application/<replaceable>NAME</replaceable>]</quote>
                section that internally represents a domain with type
                <quote>application</quote> optionally inherits settings
                from a tradition SSSD domain.
            </para>
            <para>
                Please note that the application domain must still be
                explicitly enabled in the <quote>domains</quote> parameter
                so that the lookup order between the application domain
                and its POSIX sibling domain is set correctly.
            </para>
            <variablelist>
                <title>Application domain parameters</title>
                <varlistentry>
                    <term>inherit_from (string)</term>
                    <listitem>
                        <para>
                            The SSSD POSIX-type domain the application
                            domain inherits all settings from. The
                            application domain can moreover add its own
                            settings to the application settings that augment
                            or override the <quote>sibling</quote>
                            domain settings.
                        </para>
                        <para>
                            Default: Not set
                        </para>
                    </listitem>
                </varlistentry>
            </variablelist>
            <para>
                The following example illustrates the use of an application
                domain. In this setup, the POSIX domain is connected to an LDAP
                server and is used by the OS through the NSS responder. In addition,
                the application domain also requests the telephoneNumber attribute,
                stores it as the phone attribute in the cache and makes the phone
                attribute reachable through the D-Bus interface.
            </para>
<programlisting>
[sssd]
domains = appdom, posixdom

[ifp]
user_attributes = +phone

[domain/posixdom]
id_provider = ldap
ldap_uri = ldap://ldap.example.com
ldap_search_base = dc=example,dc=com

[application/appdom]
inherit_from = posixdom
ldap_user_extra_attrs = phone:telephoneNumber
</programlisting>
        </refsect2>

    </refsect1>

    <refsect1 id='trusted-domains'>
        <title>TRUSTED DOMAIN SECTION</title>
        <para>
            Some options used in the domain section can also be used in the
            trusted domain section, that is, in a section called
            <quote>[domain/<replaceable>DOMAIN_NAME</replaceable>/<replaceable>TRUSTED_DOMAIN_NAME</replaceable>]</quote>.
            Where DOMAIN_NAME is the actual joined-to base domain. Please refer
            to examples below for explanation.
            Currently supported options in the trusted domain section are:
        </para>
            <para>ldap_search_base,</para>
            <para>ldap_user_search_base,</para>
            <para>ldap_group_search_base,</para>
            <para>ldap_netgroup_search_base,</para>
            <para>ldap_service_search_base,</para>
            <para>ldap_sasl_mech,</para>
            <para>ad_server,</para>
            <para>ad_backup_server,</para>
            <para>ad_site,</para>
            <para>use_fully_qualified_names</para>
            <para>pam_gssapi_services</para>
            <para>pam_gssapi_check_upn</para>
        <para>
            For more details about these options see their individual description
            in the manual page.
        </para>
    </refsect1>

    <refsect1 id='certmap'>
        <title>CERTIFICATE MAPPING SECTION</title>
        <para>
            To allow authentication with Smartcards and certificates SSSD must
            be able to map certificates to users. This can be done by adding the
            full certificate to the LDAP object of the user or to a local
            override. While using the full certificate is required to use the
            Smartcard authentication feature of SSH (see
                <citerefentry>
                    <refentrytitle>sss_ssh_authorizedkeys</refentrytitle>
                    <manvolnum>8</manvolnum>
                </citerefentry>
            for details) it might be cumbersome or not even possible to do this
            for the general case where local services use PAM for
            authentication.
        </para>
        <para>
            To make the mapping more flexible mapping and matching rules were
            added to SSSD (see
                <citerefentry>
                    <refentrytitle>sss-certmap</refentrytitle>
                    <manvolnum>5</manvolnum>
                </citerefentry>
            for details).
        </para>
        <para>
            A mapping and matching rule can be added to the SSSD configuration
            in a section on its own with a name like
            <quote>[certmap/<replaceable>DOMAIN_NAME</replaceable>/<replaceable>RULE_NAME</replaceable>]</quote>.
            In this section the following options are allowed:
        </para>
        <variablelist>
            <varlistentry>
                <term>matchrule (string)</term>
                <listitem>
                    <para>
                        Only certificates from the Smartcard which matches this
                        rule will be processed, all others are ignored.
                    </para>
                    <para>
                        Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only
                        certificates which have the Extended Key Usage
                        <quote>clientAuth</quote>
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>maprule (string)</term>
                <listitem>
                    <para>
                        Defines how the user is found for a given certificate.
                    </para>
                    <para>
                        Default:
                        <itemizedlist>
                            <listitem>
                                <para>LDAP:(userCertificate;binary={cert!bin})
                                for LDAP based providers like
                                <quote>ldap</quote>, <quote>AD</quote> or
                                <quote>ipa</quote>.</para>
                            </listitem>
                            <listitem>
                                <para>If maprule is not set and provider is
                                <quote>proxy</quote>,
                                the RULE_NAME name is assumed to be the name of
                                the matching user.</para>
                            </listitem>
                        </itemizedlist>
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>domains (string)</term>
                <listitem>
                    <para>
                        Comma separated list of domain names the rule should be
                        applied. By default a rule is only valid in the domain
                        configured in sssd.conf. If the provider supports
                        subdomains this option can be used to add the rule to
                        subdomains as well.
                    </para>
                    <para>
                        Default: the configured domain in sssd.conf
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>priority (integer)</term>
                <listitem>
                    <para>
                        Unsigned integer value defining the priority of the
                        rule. The higher the number the lower the priority.
                        <quote>0</quote> stands for the highest priority while
                        <quote>4294967295</quote> is the lowest.
                    </para>
                    <para>
                        Default: the lowest priority
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
    </refsect1>

    <refsect1 id='prompting_configuration'>
        <title>PROMPTING CONFIGURATION SECTION</title>
        <para>
            If a special file
            (<filename>/var/lib/sss/pubconf/pam_preauth_available</filename>)
            exists SSSD's PAM module pam_sss will ask SSSD to figure out which
            authentication methods are available for the user trying to log in.
            Based on the results pam_sss will prompt the user for appropriate
            credentials.
        </para>
        <para>
            With the growing number of authentication methods and the
            possibility that there are multiple ones for a single user the
            heuristic used by pam_sss to select the prompting might not be
            suitable for all use cases. The following options should provide a
            better flexibility here.
        </para>
        <para>
            Each supported authentication method has its own configuration
            subsection under <quote>[prompting/...]</quote>. Currently there
            are:
        <variablelist>
            <varlistentry>
                <term>[prompting/password]</term>
                <listitem>
                    <para>to configure password prompting, allowed options are:
                    <variablelist><varlistentry><term>password_prompt</term>
                        <listitem><para>to change the string of the password
                        prompt</para></listitem></varlistentry></variablelist>
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
        <variablelist>
            <varlistentry>
                <term>[prompting/2fa]</term>
                <listitem>
                    <para>to configure two-factor authentication prompting,
                    allowed options are:
                    <variablelist><varlistentry><term>first_prompt</term>
                        <listitem><para>to change the string of the prompt for
                        the first factor </para></listitem>
                        </varlistentry>
                        <varlistentry><term>second_prompt</term>
                        <listitem><para>to change the string of the prompt for
                        the second factor </para></listitem>
                        </varlistentry>
                        <varlistentry><term>single_prompt</term>
                        <listitem><para>boolean value, if True there will be
                        only a single prompt using the value of first_prompt
                        where it is expected that both factors are entered as a
                        single string. Please note that both factors have to be
                        entered here, even if the second factor is
                        optional.</para></listitem>
                        </varlistentry>
                    </variablelist>
                    If the second factor is optional and it should be possible
                    to log in either only with the password or with both factors
                    two-step prompting has to be used.
                    </para>
                    <para>
                    Some clients, such as SSH with
                    'PasswordAuthentication yes', generate their own prompts
                    and do not use prompts provided by SSSD or other PAM
                    modules. Additionally, for SSH with
                    PasswordAuthentication, if two-factor authentication is
                    available, SSSD expects that the
                    credentials entered by the user at the SSH password prompt
                    will always be the two factors in a single string, even if
                    two-factor authentication is optional.
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
                <variablelist>
            <varlistentry condition="build_passkey">
                <term>[prompting/passkey]</term>
                <listitem>
                    <para>to configure passkey authentication prompting,
                    allowed options are:
                    <variablelist>
                    <varlistentry>
                        <term>interactive</term>
                        <listitem>
                            <para>boolean value, if True prompt a message and wait
                                  before testing the presence of a passkey device.
                                  Recommended if your device doesn’t have a
                                  tactile trigger.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>interactive_prompt</term>
                        <listitem>
                            <para>to change the message of the interactive prompt.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>touch</term>
                        <listitem>
                            <para>boolean value, if True prompt a message to
                                  remind the user to touch the device.
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>touch_prompt</term>
                        <listitem>
                            <para>to change the message of the touch prompt.
                            </para>
                        </listitem>
                        </varlistentry>
                    </variablelist>
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
        <variablelist>
            <varlistentry condition="with_idp_provider">
                <term>[prompting/oauth2]</term>
                <listitem>
                    <para>to configure OAuth2 authentication prompting,
                    allowed options are:
                    <variablelist>
                    <varlistentry>
                        <term>interactive</term>
                        <listitem>
                            <para>boolean value, if True prompt a message after
                                  asking the user to authenticate, and wait
                                  before requesting the access token.
                            </para>
                            <para>If False, make sure to set the
                                  <quote>idp_request_timeout</quote>
                                  sufficiently high, to give the user time to
                                  authenticate.
                            </para>
                            <para>Default: true
                            </para>
                        </listitem>
                    </varlistentry>
                    <varlistentry>
                        <term>interactive_prompt</term>
                        <listitem>
                            <para>to change the message of the interactive prompt.
                            </para>
                        </listitem>
                    </varlistentry>
                    </variablelist>
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
        </para>
        <para>
            It is possible to add a subsection for specific PAM services,
            e.g. <quote>[prompting/password/sshd]</quote> to individual change
            the prompting for this service.
        </para>
    </refsect1>

    <refsect1 id='example'>
        <title>EXAMPLES</title>
        <para>
            1. The following example shows a typical SSSD config. It does
            not describe configuration of the domains themselves - refer to
            documentation on configuring domains for more details.
<programlisting>
[sssd]
domains = LDAP
services = nss, pam

[nss]
filter_groups = root
filter_users = root

[pam]

[domain/LDAP]
id_provider = ldap
ldap_uri = ldap://ldap.example.com
ldap_search_base = dc=example,dc=com

auth_provider = krb5
krb5_server = kerberos.example.com
krb5_realm = EXAMPLE.COM
cache_credentials = true

min_id = 10000
max_id = 20000
enumerate = False
</programlisting>
        </para>
        <para>
            2. The following example shows configuration of IPA AD trust where
            the AD forest consists of two domains in a parent-child structure.
            Suppose IPA domain (ipa.com) has trust with AD domain(ad.com).
            ad.com has child domain (child.ad.com). To enable shortnames in
            the child domain the following configuration should be used.
<programlisting>
[domain/ipa.com/child.ad.com]
use_fully_qualified_names = false
</programlisting>
        </para>
        <para>
            3. The following example shows the configuration of a certificate
            mapping rule. It is valid for the configured domain
            <quote>my.domain</quote> and additionally for the subdomains
            <quote>your.domain</quote> and uses the full certificate in the
            search filter.
<programlisting>
[certmap/my.domain/rule_name]
matchrule = &lt;ISSUER&gt;^CN=My-CA,DC=MY,DC=DOMAIN$
maprule = (userCertificate;binary={cert!bin})
domains = my.domain, your.domain
priority = 10
</programlisting>
        </para>
    </refsect1>

	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/seealso.xml" />

</refentry>
</reference>