forked from linux/documentation
75 lines
2.3 KiB
Markdown
75 lines
2.3 KiB
Markdown
# Active Directory (AD) Integration by SSSD
|
|
|
|
By default the RHEL systems are integrated automatically into the AD by `sssd`.
|
|
|
|
## Caching AD Information
|
|
|
|
`sssd` deals relatively inefficiently with the AD as it fully loads all referenced group and user objects.
|
|
It can take minutes and > 40 MB of network traffic for a simple `id $USER`.
|
|
|
|
There are some workarounds and optimizations possible.
|
|
|
|
Our default settings are:
|
|
```
|
|
aaa::sssd_cache_timeout: 46800
|
|
aaa::sssd_cache_renewal_interval: 43200
|
|
aaa::ignore_group_members: false
|
|
```
|
|
which will reload the information in the cache after 12 hours, one hour before expiration, to always be able do serve the information locally after the initial lookup. The problem is that like this changes in the AD are only visible the next day. If that should go faster you may empty the local cache as `root` with
|
|
```
|
|
sss_cache -E
|
|
```
|
|
Alternatively as normal user you may just reset the information about yourself:
|
|
```
|
|
refresh_user
|
|
```
|
|
or for someone else:
|
|
```
|
|
refresh_user muster_t
|
|
```
|
|
|
|
|
|
On nodes where looking up members of a group is not necessary (`getent group $GROUP`), you may do
|
|
```
|
|
aaa::ignore_group_members: true
|
|
```
|
|
which will speed up the lookup of user information heavily at the price of not being able to lookup what members are in a specific group.
|
|
|
|
If AD changes should be reflected rather soonish, then change to
|
|
```
|
|
aaa::sssd_cache_timeout: 300
|
|
```
|
|
but please do not lower the renewal interwal to such values as it causes quite some constant traffic and load to the AD and the node itself. The renewal value is not applied if it is bigger than the timeout. You may also explicitely disable it with
|
|
```
|
|
aaa::sssd_cache_renewal_interval: null
|
|
```
|
|
|
|
## Connectors
|
|
|
|
It is possible to connect the authentication daemon `sssd` using a generic `LDAP` provider or a more specialized `AD` provider.
|
|
|
|
We suggest to use primarily the `AD` provider.
|
|
It will show all AD users.
|
|
|
|
|
|
Only where [eaccounts] (../access/eaccounts) are used with network home for eaccounts and local homes for the other users, then there must the `LDAP` provider configured.
|
|
|
|
|
|
The `AD` provider (default on RHEL9+) is selected with
|
|
```
|
|
aaa::sssd_ad_provider: true
|
|
```
|
|
|
|
The `LDAP` provider is selected with
|
|
```
|
|
aaa::sssd_ad_provider: false
|
|
```
|
|
|
|
## Disable AD Integration
|
|
|
|
You may opt out in Hiera with
|
|
|
|
```
|
|
aaa::enable_ad: false
|
|
```
|