Active Directory (AD) Integration by SSSD¶

By default the RHEL systems are integrated automatically into the AD by sssd.

Caching AD Information¶

sssd deals relatively inefficiently with the AD as it fully loads all referenced group and user objects. It can take minutes and > 40 MB of network traffic for a simple id $USER.

There are some workarounds and optimizations possible.

Our default settings are:

aaa::sssd_cache_timeout: 46800
aaa::sssd_cache_renewal_interval: 43200
aaa::ignore_group_members: false

which will reload the information in the cache after 12 hours, one hour before expiration, to always be able do serve the information locally after the initial lookup. The problem is that like this changes in the AD are only visible the next day. If that should go faster you may empty the local cache as root with

sss_cache -E

Alternatively as normal user you may just reset the information about yourself:

refresh_user

or for someone else:

refresh_user muster_t

On nodes where looking up members of a group is not necessary (getent group $GROUP), you may do

aaa::ignore_group_members: true

which will speed up the lookup of user information heavily at the price of not being able to lookup what members are in a specific group.

If AD changes should be reflected rather soonish, then change to

aaa::sssd_cache_timeout: 300

but please do not lower the renewal interval to such values as it causes quite some constant traffic and load to the AD and the node itself. The renewal value is not applied if it is bigger than the timeout. You may also explicitly disable it with

aaa::sssd_cache_renewal_interval: null

Connectors¶

It is possible to connect the authentication daemon sssd using a generic LDAP provider or a more specialized AD provider.

We suggest to use primarily the AD provider. It will show all AD users.

Only where eaccounts are used with network home for eaccounts and local homes for the other users, then there must the LDAP provider configured.

The AD provider (default on RHEL9+) is selected with

aaa::sssd_ad_provider: true

The LDAP provider is selected with

aaa::sssd_ad_provider: false

Disable AD Integration¶

You may opt out in Hiera with

aaa::enable_ad: false