SSSD-IPA(5) NAME sssd-ipa - IPA SSSD IPA sssd(8). " " sssd.conf(5). IPA -- , IPA. ( IPA - freeipa.org.) , IPA; , . IPA SSSD sssd-ldap(5) sssd-krb5(5) IPA. IPA , sssd-ldap sssd-krb5 providers, . , . IPA ldap krb5, . " ". , IPA (. "ipa_access_order"), HBAC ( ). HBAC - freeipa.org. sssd.conf "auth_provider=ipa" "access_provider=ipa", id_provider "ipa". IPA PAC, Kerberos PAC. PAC , IPA. SSSD " " sssd.conf(5). ipa_domain () IPA. . , . ipa_server, ipa_backup_server () IP- IPA, SSSD . " ". , . " ". ipa_hostname () . , hostname(5) , IPA. . dyndns_update ( ) . SSSD DNS, FreeIPA, IP- . GSS-TSIG. IP- LDAP- IPA, "dyndns_iface" . : (, RHEL 5) Kerberos /etc/krb5.conf : false dyndns_ttl ( ) TTL, DNS . dyndns_update <>, . TTL , . : 1200 () dyndns_iface () . , dyndns_update <>. , IP- DNS. , !, . . , !eth1, * SSSD , eth1. . man 7 glob. : IP- , LDAP IPA : dyndns_iface = em[12], !vnet1, vnet* dyndns_address () . , dyndns_update true. IP- IP-, DNS. CIDR. ! . , , ( ). : IP- . : dyndns_address = 10.0.0.0/16, !10.0.1.0/24 dyndns_auth () nsupdate GSS-TSIG DNS. , <>. : GSS-TSIG dyndns_auth_ptr () nsupdate GSS-TSIG PTR DNS. , <>. : , dyndns_auth dyndns_refresh_interval ( ) DNS , . , dyndns_update <>. : 0 () dyndns_update_ptr ( ) PTR DNS . , dyndns_update <>. <> IPA, IPA PTR . , dyndns_update_per_family PTR. . : false () dyndns_force_tcp ( ) nsupdate TCP DNS. : false ( nsupdate ) dyndns_server () DNS, DNS. . , DNS DNS. , DNS- IP-. URI. URI dns://servername/ dns+tls://1.2.3.4:853#servername/. DNS-over-TLS DNS. nsupdate DoT -- man nsupdate SSSD. , , , DNS-over-TLS. : none ( nsupdate ) dyndns_update_per_family ( ) DNS : IPv4, IPv4. IPv4 IPv6 . : true dyndns_dot_cacert () ( PEM) TLS- DoT. : none ( ) dyndns_dot_cert () () DoT . , PEM. TLS dyndns_dot_cert dyndns_dot_key. : none ( TLS-) dyndns_dot_key () DoT . , PEM. : none ( TLS-) ipa_access_order () . : expire: IPA. pwd_expire_policy_reject, pwd_expire_policy_warn, pwd_expire_policy_renew: , , , , , , SSH. , , : o pwd_expire_policy_reject -- , o pwd_expire_policy_warn -- - , o pwd_expire_policy_renew -- . , <>. ipa_deskprofile_search_base () . , . : base DN ipa_subid_ranges_search_base () . ldap_subid_ranges_search_base. ipa_hbac_search_base () . , HBAC. : base DN ipa_host_search_base () . ldap_host_search_base. ipa_selinux_search_base () . SELinux. "ldap_search_base". : ldap_search_base ipa_subdomains_search_base () . . "ldap_search_base". : cn=trusts,%basedn ipa_master_domain_search_base () . . "ldap_search_base". : cn=ad,cn=etc,%basedn ipa_views_search_base () . . "ldap_search_base". : cn=views,cn=accounts,%basedn krb5_realm () Kerberos. , "ipa_domain". Kerberos IPA -- base DN, LDAP. krb5_confd_path () , SSSD Kerberos. , <>. : ( krb5.include.d pubconf SSSD) ipa_deskprofile_refresh ( ) IPA. IPA, . : 5 () ipa_deskprofile_request_interval ( ) IPA, . : 60 () ipa_hbac_refresh ( ) HBAC IPA. IPA, . : 5 () ipa_hbac_selinux ( ) SELinux IPA. IPA, . : 5 () ipa_server_mode ( ) IPA (ipa-server-install). , SSSD IPA . IPA SSSD , SSSD IPA. : , SSSD IPA. o "ipa_server" , IPA. IPA, . o "full_name_format" , . : false ipa_automount_location () , IPA : <> , , - , autofs, sssd.conf, SSSD. SSSD , FreeIPA 4.1 . , . . ipa_view_class () . : nsContainer ipa_view_name () , . : cn ipa_override_object_class () . : ipaOverrideAnchor ipa_anchor_uuid () , . : ipaAnchorUUID ipa_user_override_object_class () . , , . , o ldap_user_name o ldap_user_uid_number o ldap_user_gid_number o ldap_user_gecos o ldap_user_home_directory o ldap_user_shell o ldap_user_ssh_public_key : ipaUserOverride ipa_group_override_object_class () . , , . , o ldap_group_name o ldap_group_gid_number : ipaGroupOverride . IPA : KRB5 o krb5_validate = true o krb5_use_fast = try o krb5_canonicalize = true LDAP -- o ldap_schema = ipa_v1 o ldap_force_upper_case_realm = true o ldap_sasl_mech = GSSAPI o ldap_sasl_minssf = 56 o ldap_account_expire_policy = ipa o ldap_use_tokengroups = true LDAP -- o ldap_user_member_of = memberOf o ldap_user_uuid = ipaUniqueID o ldap_user_ssh_public_key = ipaSshPubKey o ldap_user_auth_type = ipaUserAuthType LDAP -- o ldap_group_object_class = ipaUserGroup o ldap_group_object_class_alt = posixGroup o ldap_group_member = member o ldap_group_uuid = ipaUniqueID o ldap_group_objectsid = ipaNTSecurityIdentifier o ldap_group_external_member = ipaExternalMember , IPA , . sssd.conf <>, IPA , IPA. sssd.conf <>, <>, IPA . , , , , , IPA . , IPA , . . , . "subdomain_inherit" . [domain/ipa.domain.com/ad.domain.com] ad_server = dc.ad.domain.com sssd.conf(5). , SSSD: IPA IPA. , IPA IPA : o ad_server o ad_backup_server o ad_site o ipa_server o ipa_backup_server o ldap_search_base o ldap_user_search_base o ldap_group_search_base o use_fully_qualified_names <> <> . , IPA AD IPA : o ad_server o ad_site : , "ad_server". , IPA, IPA, "ad_server" "ad_site" , AD DC . , "kdcinfo", Kerberos. Kerberos sssd_krb5_locator_plugin(8). . ; . . . : (primary) (backup). , , , . , 31- -. SSSD . , () . . ; , . . , . , , . , . , , , ; 30 . , 30 . - , , DNS, , , , . , SSSD . SSSD , , -. . sssd.conf(5). dns_resolver_server_timeout ( ), SSSD DNS . : 1000 dns_resolver_op_timeout ( ), SSSD DNS (, SRV) . : 3 dns_resolver_timeout SSSD . , , SRV DNS . : 6 LDAP LDAP-. , - "ldap_opt_timeout" , "dns_resolver_timeout", , , , "dns_resolver_op_timeout", "dns_resolver_server_timeout". , , DNS. . , , . () , , "_srv_". . , , , , , DNS. "dns_discovery_domain" sssd.conf(5). _tcp. . . RFC 2782. , SSSD example.com -- [sssd]. , IPA. [domain/example.com] id_provider = ipa ipa_server = ipaserver.example.com ipa_hostname = myhost.example.com . sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd- krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd- sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) AUTHORS (<<>>) SSSD -- https://github.com/SSSD/sssd/ SSSD 06/09/2026 SSSD-IPA(5)