d89eea147d
Using the "change password" feature of pam_sss modules always lead to a bad situation where AD password and Gassi password are not synchronyzed anymore. To avoid this, we disable the feature in SSSD configuration. The network password can still be changed using the command `kpasswd` provided by package `krb5-user`.
42 lines
950 B
Plaintext
42 lines
950 B
Plaintext
# SSSD configuration for Kerberos in Orange network
|
|
#
|
|
[sssd]
|
|
config_file_version = 2
|
|
domains = ad.francetelecom.fr
|
|
certificate_verification = no_ocsp
|
|
services = nss
|
|
debug_level = 9
|
|
|
|
[nss]
|
|
filter_users = root
|
|
filter_groups = root
|
|
debug_level = 9
|
|
|
|
[pam]
|
|
pam_verbosity = 3
|
|
pam_account_expired_message = Account expired, please contact help desk.
|
|
pam_account_locked_message = Account locked, please contact help desk
|
|
pam_public_domains = ad.francetelecom.fr
|
|
pam_cert_auth = false
|
|
p11_child_timeout = 60
|
|
offline_credentials_expiration = 0
|
|
debug_level = 9
|
|
|
|
[domain/ad.francetelecom.fr]
|
|
min_id = 1000
|
|
id_provider = files
|
|
auth_provider = krb5
|
|
chpass_provider = none
|
|
cache_credentials = true
|
|
use_fully_qualified_names = false
|
|
krb5_realm = AD.FRANCETELECOM.FR
|
|
krb5_auth_timeout = 10
|
|
krb5_store_password_if_offline = true
|
|
krb5_lifetime = 24h
|
|
krb5_renewable_lifetime = 7d
|
|
krb5_renew_interval = 30m
|
|
# see /etc/krb5.conf
|
|
krb5_use_kdcinfo = false
|
|
debug_level = 9
|
|
|