SSSD-FILES(5)

📦
version 2.10.1 · 10 versions
, in ubuntu questing

💖 SSSD-FILES(5) 💖

File Formats and Conventions ✨ (that's the manual section, bestie, iykyk)

🌸 NAME 🌸

sssd-files — the SSSD files provider 🫶

✨ DESCRIPTION ✨

Okay so this manual page is all about the files provider for sssd(8). If you want the full detailed syntax reference, go peek at the "FILE FORMAT" section of the sssd.conf(5) manual page. 📖

The files provider basically mirrors the content of the passwd(5) and group(5) files. Why, you ask? Because its whole purpose is to take the users and groups that traditionally were only reachable through NSS interfaces and make them available through the SSSD interfaces too — like sssd-ifp(5). glow up tbh 🌈

Another reason? It gives you efficient caching of local users and groups. Obsessed. 💅

Heads up: besides defining the domain explicitly, you can also configure the files provider implicitly using the 'enable_files_domain' option. Check sssd.conf(5) for the deets. 👀

SSSD never handles resolution of user/group "root". Also, resolution of UID/GID 0 is not handled by SSSD. Those requests get passed along to the next NSS module (usually files). Not our problem, next module's problem. 💀

And when SSSD is not running or not responding, nss_sss returns the UNAVAIL code, which makes the request get passed to the next module. Simple as that. 🦋

🎀 CONFIGURATION OPTIONS 🎀

So besides the options listed down below, generic SSSD domain options can be set where they apply. For the full rundown on configuring an SSSD domain, refer to the "DOMAIN SECTIONS" section of the sssd.conf(5) manual page. But — and this is the important part — the whole point of the files provider is to expose the exact same data as the UNIX files, just through the SSSD interfaces. So not all generic domain options are supported. Likewise, some global options — like overriding the shell in the "nss" section for all domains — have no effect on the files domain unless you explicitly specify them per-domain. Periodt. 💅

  • passwd_files (string) — a comma-separated list of one or multiple password filenames for the files provider to read and enumerate. inotify monitor watches get set on each file so changes are detected dynamically. 🕵️♀️
    • Default: /etc/passwd
  • group_files (string) — a comma-separated list of one or multiple group filenames for the files provider to read and enumerate. Again, inotify monitor watches get set on each file to detect changes dynamically. 🔍
    • Default: /etc/group
  • fallback_to_nss (boolean) — while it's updating the internal data, SSSD will return an error and let the client carry on with the next NSS module. This helps dodge delays when you're using the default system files /etc/passwd and /etc/group and your NSS configuration has 'sss' before 'files' for the 'passwd' and 'group' maps. 🏃♀️
    • If the files provider is configured to monitor other files, it lowkey makes sense to set this option to 'False' to avoid inconsistent behavior, because generally speaking there'd be no other NSS module around to use as a fallback. 🚫
    • Default: True

🌈 EXAMPLE 🌈

This example assumes SSSD is correctly configured and files is one of the domains in the [sssd] section. 💫

[domain/files]
id_provider = files

And to actually leverage caching of local users and groups by SSSD, the nss_sss module must be listed before the nss_files module in /etc/nsswitch.conf. Order matters, bestie. 👑

passwd:     sss files
group:      sss files

👑 SEE ALSO 👑

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-files(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

💜 AUTHORS 💜

The SSSD upstream — https://github.com/SSSD/sssd/ 🫶

okay that's the whole page, you ate that reading session fr fr 💅✨

this lil masterpiece came from SSSD, dated 05/23/2026 — mwah, go forth and cache those local users and groups 🎀🦋💖

📦 where this page comes from