gistfile1.txt

[root@gluten ~]# cat /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam
domains = cluster

[nss]
filter_users = root
filter_groups = root

[pam]

[domain/cluster]
# Identity from local LDAP
id_provider = ldap
ldap_uri = ldaps://ldapserver
ldap_search_base = dc=cm,dc=cluster
ldap_user_search_base = dc=cm,dc=cluster
ldap_group_search_base = ou=Group,dc=cm,dc=cluster
ldap_tls_cacert = /cm/local/apps/openldap/etc/certs/ca.pem
ldap_tls_cert = /cm/local/apps/openldap/etc/certs/ldap.pem
ldap_tls_key = /cm/local/apps/openldap/etc/certs/ldap.key
ldap_tls_reqcert = demand
ldap_id_use_start_tls = false

# Group membership - posixGroup uses memberUid
ldap_schema = rfc2307
ldap_group_member = memberUid

# Authentication via Kerberos to AD
auth_provider = krb5
#auth_provider = ldap
krb5_server = partners-dc1.partners.org, partners-dc2.partners.org
krb5_realm = PARTNERS.ORG
krb5_canonicalize = true

# Map local username to AD principal via sn attribute
ldap_user_principal = sn

# Cache credentials for offline auth
cache_credentials = true
krb5_store_password_if_offline = true

# Access control
enumerate = false
access_provider = permit