20ec88944c
Default SSSD template for ccache file is /tmp/krb5cc_%U_XXXXXX, where XXXXXX is a suffix that will be interpreted by mkstemp(3) to create a unique file name, while the standard configuration of the libkrb5 library is `/tmp/krb5cc_%U`. To guarantee compatibility with the existing system, we force the use of the standard model in SSSD.
49 lines
1.0 KiB
Plaintext
49 lines
1.0 KiB
Plaintext
# SSSD configuration for Kerberos in Orange network
|
|
#
|
|
[sssd]
|
|
config_file_version = 2
|
|
domains = ad.francetelecom.fr
|
|
certificate_verification = no_ocsp
|
|
services = nss
|
|
|
|
|
|
[nss]
|
|
filter_users = root
|
|
filter_groups = root
|
|
|
|
|
|
[pam]
|
|
pam_verbosity = 2
|
|
pam_account_expired_message = Account expired, please contact help desk.
|
|
pam_account_locked_message = Account locked, please contact help desk
|
|
pam_public_domains = ad.francetelecom.fr
|
|
pam_cert_auth = false
|
|
p11_child_timeout = 60
|
|
offline_credentials_expiration = 0
|
|
|
|
|
|
[domain/ad.francetelecom.fr]
|
|
id_provider = files
|
|
min_id = 1000
|
|
max_id = 60000
|
|
#
|
|
auth_provider = krb5
|
|
krb5_realm = AD.FRANCETELECOM.FR
|
|
krb5_auth_timeout = 10
|
|
krb5_store_password_if_offline = true
|
|
krb5_lifetime = 24h
|
|
krb5_renewable_lifetime = 7d
|
|
krb5_renew_interval = 30m
|
|
krb5_use_kdcinfo = true
|
|
krb5_kdcinfo_lookahead = 5:2
|
|
krb5_ccachedir = /tmp
|
|
krb5_ccname_template = FILE:%d/krb5cc_%U
|
|
dns_discovery_domain = S-FT-FR-EBU._sites.ad.francetelecom.fr
|
|
#
|
|
chpass_provider = none
|
|
#
|
|
cache_credentials = true
|
|
use_fully_qualified_names = false
|
|
lookup_family_order = ipv4_only
|
|
|