2.3 KiB
Active Directory (AD) Integration by SSSD
By default the RHEL systems are integrated automatically into the AD by sssd.
Caching AD Information
sssd deals relatively inefficiently with the AD as it fully loads all referenced group and user objects.
It can take minutes and > 40 MB of network traffic for a simple id $USER.
There are some workarounds and optimizations possible.
Our default settings are:
aaa::sssd_cache_timeout: 46800
aaa::sssd_cache_renewal_interval: 43200
aaa::ignore_group_members: false
which will reload the information in the cache after 12 hours, one hour before expiration, to always be able do serve the information locally after the initial lookup. The problem is that like this changes in the AD are only visible the next day. If that should go faster you may empty the local cache as root with
sss_cache -E
Alternatively as normal user you may just reset the information about yourself:
refresh_user
or for someone else:
refresh_user muster_t
On nodes where looking up members of a group is not necessary (getent group $GROUP), you may do
aaa::ignore_group_members: true
which will speed up the lookup of user information heavily at the price of not being able to lookup what members are in a specific group.
If AD changes should be reflected rather soonish, then change to
aaa::sssd_cache_timeout: 300
but please do not lower the renewal interwal to such values as it causes quite some constant traffic and load to the AD and the node itself. The renewal value is not applied if it is bigger than the timeout. You may also explicitely disable it with
aaa::sssd_cache_renewal_interval: null
Connectors
It is possible to connect the authentication daemon sssd using a generic LDAP provider or a more specialized AD provider.
We suggest to use primarily the AD provider.
It will show all AD users.
Only where [eaccounts] (../access/eaccounts) are used with network home for eaccounts and local homes for the other users, then there must the LDAP provider configured.
The AD provider (default on RHEL9+) is selected with
aaa::sssd_ad_provider: true
The LDAP provider is selected with
aaa::sssd_ad_provider: false
Disable AD Integration
You may opt out in Hiera with
aaa::enable_ad: false