#
# This file is managed by salt - Configured by authentication formula
# Manual changes to this file will be lost!
#

[sssd]
debug_level = 0x030
config_file_version = 2
services = nss, pam, ssh
domains = AD, ad.LOCALDOMAIN.com

[nss]
debug_level = 0x030
# how long to cache enumerations
enum_cache_timeout = 3600
# how long to cache negative cache hits
entry_negative_timeout = 5400
# update entries in the background if they are older than 50% of entry_cache_timeout
entry_cache_nowait_percentage = 50

filter_users = root
filter_groups = pulse-rt

[pam]
debug_level = 0x070
offline_credentials_expiration = 1

[domain/AD]
debug_level = 0x070
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
enumerate = false

ldap_uri = _srv_
dns_discovery_domain = Vancouver._sites.ad.LOCALDOMAIN.com
ldap_search_base = dc=ad,dc=LOCALDOMAIN,dc=com
ldap_schema = rfc2307bis
ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_ssh_public_key = sshPublicKey
ldap_group_object_class = group
ldap_user_home_directory = unixHomeDirectory
override_shell =
ldap_user_principal = userPrincipalName
ldap_user_gecos = displayName
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true
ldap_referrals = false
ldap_tls_reqcert = never
ldap_pwd_policy = mit_kerberos
#ldap_search_timeout = 10
#ldap_network_timeout = 10
#ldap_connection_expire_timeout = 3600

krb5_server = ad.LOCALDOMAIN.com
krb5_realm = AD.LOCALDOMAIN.COM

# should we cache user credentials?
cache_credentials = true
# number of days after successful login that user account entry cached
account_cache_expiration = 1
# age of entry in seconds before SSSD requests updated information
entry_cache_timeout = 864000

[domain/ad.LOCALDOMAIN.com]
debug = 7
ad_domain = ad.LOCALDOMAIN.com
krb5_realm = AD.LOCALDOMAIN.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad