SSSD-LDAP-ATTRIBUT(5)

✨ NAME ✨

okay so bestie, this is the manual for sssd-ldap-attributes(5) — literally "SSSD LDAP Provider: Mapping Attributes". 💅

🌸 DESCRIPTION 🌸

This page spills the tea on the mapping attributes for the SSSD LDAP provider, aka sssd-ldap(5). If you want the full details about SSSD LDAP provider configuration options, go read sssd-ldap(5) — it's the main character. ✨

👑 USER ATTRIBUTES 👑

Now let's get into it. Each one is a (string) config attribute, and I'll give you the deets and the default. No cap. 💖

ldap_user_object_class (string) — the object class of a user entry in LDAP. Default: posixAccount 🍓
ldap_user_name (string) — the LDAP attribute that maps to the user's login name. Default: uid (for rfc2307, rfc2307bis and IPA), sAMAccountName (for AD) 👑
ldap_user_uid_number (string) — the LDAP attribute that matches the user's id. Default: uidNumber 🔢
ldap_user_gid_number (string) — the LDAP attribute that matches the user's primary group id. Default: gidNumber 🫶
ldap_user_primary_group (string) — Active Directory primary group attribute for ID-mapping. Note: only set this manually if you're running the ldap provider with ID mapping. Default: unset (LDAP), primaryGroupID (AD) 💅
ldap_user_gecos (string) — the LDAP attribute that matches the user's gecos field. Default: gecos 🌸
ldap_user_home_directory (string) — the LDAP attribute that has the name of the user's home directory. Default: homeDirectory (LDAP and IPA), unixHomeDirectory (AD) 🏠
ldap_user_shell (string) — the LDAP attribute that has the path to the user's default shell. Default: loginShell 🐚
ldap_user_uuid (string) — the LDAP attribute that has the UUID/GUID of an LDAP user object. Default: not set in the general case, objectGUID for AD and ipaUniqueID for IPA 🆔
ldap_user_objectsid (string) — the LDAP attribute that has the objectSID of an LDAP user object. Usually only needed for ActiveDirectory servers. Default: objectSid for ActiveDirectory, not set for other servers. 🔥
ldap_user_modify_timestamp (string) — the LDAP attribute that has the timestamp of the last modification of the parent object. Default: modifyTimestamp ⏰
ldap_user_shadow_last_change (string) — when using ldap_pwd_policy=shadow, this is the name of the LDAP attribute that matches its shadow(5) counterpart (date of the last password change). Default: shadowLastChange 🌙
ldap_user_shadow_min (string) — when using ldap_pwd_policy=shadow, this is the name of the LDAP attribute that matches its shadow(5) counterpart (minimum password age). Default: shadowMin ⏳
ldap_user_shadow_max (string) — when using ldap_pwd_policy=shadow, this is the name of the LDAP attribute that matches its shadow(5) counterpart (maximum password age). Default: shadowMax ⌛
ldap_user_shadow_warning (string) — when using ldap_pwd_policy=shadow, this is the name of the LDAP attribute that matches its shadow(5) counterpart (password warning period). Default: shadowWarning ⚠️
ldap_user_shadow_inactive (string) — when using ldap_pwd_policy=shadow, this is the name of the LDAP attribute that matches its shadow(5) counterpart (password inactivity period). Default: shadowInactive 💤
ldap_user_shadow_expire (string) — when using ldap_pwd_policy=shadow or ldap_account_expire_policy=shadow, this is the name of the LDAP attribute that matches its shadow(5) counterpart (account expiration date). Default: shadowExpire 📅
ldap_user_krb_last_pwd_change (string) — when using ldap_pwd_policy=mit_kerberos, this is the name of the LDAP attribute storing the date and time of last password change in kerberos. Default: krbLastPwdChange 🔑
ldap_user_krb_password_expiration (string) — when using ldap_pwd_policy=mit_kerberos, this is the name of the LDAP attribute storing the date and time when the current password expires. Default: krbPasswordExpiration ⏲️
ldap_user_ad_account_expires (string) — when using ldap_account_expire_policy=ad, this is the name of the LDAP attribute storing the expiration time of the account. Default: accountExpires 📆
ldap_user_ad_user_account_control (string) — when using ldap_account_expire_policy=ad, this is the name of the LDAP attribute storing the user account control bit field. Default: userAccountControl 🎛️
ldap_ns_account_lock (string) — when using ldap_account_expire_policy=rhds or equivalent, this determines if access is allowed or not. Default: nsAccountLock 🔒
ldap_user_nds_login_disabled (string) — when using ldap_account_expire_policy=nds, this attribute determines if access is allowed or not. Default: loginDisabled 🚫
ldap_user_nds_login_expiration_time (string) — when using ldap_account_expire_policy=nds, this attribute determines until which date access is granted. Default: loginDisabled 📅 (yes, the default is loginDisabled, fr fr)
ldap_user_nds_login_allowed_time_map (string) — when using ldap_account_expire_policy=nds, this attribute determines the hours of a day in a week when access is granted. Default: loginAllowedTimeMap 🗓️
ldap_user_principal (string) — the LDAP attribute that has the user's Kerberos User Principal Name (UPN). Default: krbPrincipalName 🎫
ldap_user_extra_attrs (string) — a comma-separated list of LDAP attributes that SSSD would fetch along with the usual set of user attributes. 📝

The list can either have LDAP attribute names only, or colon-separated tuples of SSSD cache attribute name and LDAP attribute name. If only the LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas.

Please note that several attribute names are reserved by SSSD, notably the “name” attribute. SSSD would report an error if any of the reserved attribute names is used as an extra attribute name.

Examples:

ldap_user_extra_attrs = telephoneNumber

Save the “telephoneNumber” attribute from LDAP as “telephoneNumber” to the cache.

ldap_user_extra_attrs = phone:telephoneNumber

Save the “telephoneNumber” attribute from LDAP as “phone” to the cache.

Default: not set 💖

ldap_user_ssh_public_key (string) — the LDAP attribute that has the user's SSH public keys. Default: sshPublicKey 🔑
ldap_user_fullname (string) — the LDAP attribute that matches the user's full name. Default: cn 📛
ldap_user_member_of (string) — the LDAP attribute that lists the user's group memberships. Default: memberOf 👯
ldap_user_authorized_service (string) — if access_provider=ldap and ldap_access_order=authorized_service, SSSD will use the presence of the authorizedService attribute in the user's LDAP entry to determine access privilege. 🛡️

An explicit deny (!svc) is resolved first. Second, SSSD searches for explicit allow (svc) and finally for allow_all (*).

Please note that the ldap_access_order configuration option must include “authorized_service” in order for the ldap_user_authorized_service option to work.

Some distributions (such as Fedora-29+ or RHEL-8) always include the “systemd-user” PAM service as part of the login process. Therefore when using service-based access control, the “systemd-user” service might need to be added to the list of allowed services.

Default: authorizedService ✨

ldap_user_authorized_host (string) — if access_provider=ldap and ldap_access_order=host, SSSD will use the presence of the host attribute in the user's LDAP entry to determine access privilege. 🏠

An explicit deny (!host) is resolved first. Second, SSSD searches for explicit allow (host) and finally for allow_all (*).

Please note that the ldap_access_order configuration option must include “host” in order for the ldap_user_authorized_host option to work.

Default: host 💻

ldap_user_authorized_rhost (string) — if access_provider=ldap and ldap_access_order=rhost, SSSD will use the presence of the rhost attribute in the user's LDAP entry to determine access privilege. Similarly to the host verification process. 🌐

An explicit deny (!rhost) is resolved first. Second, SSSD searches for explicit allow (rhost) and finally for allow_all (*).

Please note that the ldap_access_order configuration option must include “rhost” in order for the ldap_user_authorized_rhost option to work.

Default: rhost 📡

ldap_user_certificate (string) — name of the LDAP attribute containing the X509 certificate of the user. Default: userCertificate;binary 📜
ldap_user_email (string) — name of the LDAP attribute containing the email address of the user. 📧

Note: If an email address of a user conflicts with an email address or fully qualified name of another user, then SSSD will not be able to serve those users properly. This option allows users to login by (1) username, and (2) e-mail address. If for some reason several users need to share the same email address then set this option to a nonexistent attribute name in order to disable user lookup/login by email.

Default: mail 💌

ldap_user_passkey (string) — name of the LDAP attribute containing the passkey mapping data of the user. Default: passkey (LDAP), ipaPassKey (IPA), altSecurityIdentities (AD) 🔑

🌸 GROUP ATTRIBUTES 🌸

okay bestie, this is the group part and it's giving very much "yes we have options for everything" energy. every single one, no skips 💅

ldap_group_object_class (string) — the object class of a group entry in LDAP, fr. Default: posixGroup
ldap_group_name (string) — the LDAP attribute that corresponds to the group name. 🎀 Heads up though: if you're in an environment with nested groups, this value must be an LDAP attribute which has a unique name for every single group. and yes, that requirement includes the non-POSIX groups chilling in the tree of nested groups. iykyk. Default: cn (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)
ldap_group_gid_number (string) — the LDAP attribute that corresponds to the group's id. Default: gidNumber
ldap_group_member (string) — the LDAP attribute that contains the names of the group's members. Default: memberuid (rfc2307) / member (rfc2307bis)
ldap_group_uuid (string) — the LDAP attribute that contains the UUID/GUID of an LDAP group object. ✨ Default: not set in the general case, objectGUID for AD and ipaUniqueID for IPA
ldap_group_objectsid (string) — the LDAP attribute that contains the objectSID of an LDAP group object. this one is usually only necessary for ActiveDirectory servers, bestie. Default: objectSid for ActiveDirectory, not set for other servers.
ldap_group_modify_timestamp (string) — the LDAP attribute that contains timestamp of the last modification of the parent object. Default: modifyTimestamp
ldap_group_type (string) — the LDAP attribute that contains an integer value indicating the type of the group and maybe other flags. rn this attribute is only used by the AD provider to figure out if a group is a domain local groups and has to be filtered out for trusted domains. 😤 Default: groupType in the AD provider, otherwise not set
ldap_group_external_member (string) — the LDAP attribute that references group members that are defined in an external domain. at the moment, only IPA's external members are supported, no cap. Default: ipaExternalMember in the IPA provider, otherwise unset.

🦋 NETGROUP ATTRIBUTES 🦋

netgroups, babe. we got them. and some of these have a lil IPA disclaimer so read carefully 💖

ldap_netgroup_object_class (string) — the object class of a netgroup entry in LDAP. In IPA provider, ipa_netgroup_object_class should be used instead. Default: nisNetgroup
ldap_netgroup_name (string) — the LDAP attribute that corresponds to the netgroup name. In IPA provider, ipa_netgroup_name should be used instead. Default: cn
ldap_netgroup_member (string) — the LDAP attribute that contains the names of the netgroup's members. In IPA provider, ipa_netgroup_member should be used instead. Default: memberNisNetgroup
ldap_netgroup_triple (string) — the LDAP attribute that contains the (host, user, domain) netgroup triples. 👑 This option is not available in IPA provider. Default: nisNetgroupTriple
ldap_netgroup_modify_timestamp (string) — the LDAP attribute that contains timestamp of the last modification of the parent object. This option is not available in IPA provider. Default: modifyTimestamp

🧚 HOST ATTRIBUTES 🧚

host entries in LDAP, let's gooo 🌈

ldap_host_object_class (string) — the object class of a host entry in LDAP. Default: ipService
ldap_host_name (string) — the LDAP attribute that corresponds to the host's name. Default: cn
ldap_host_fqdn (string) — the LDAP attribute that corresponds to the host's fully-qualified domain name. Default: fqdn
ldap_host_serverhostname (string) — the LDAP attribute that corresponds to the host's name. Default: serverHostname
ldap_host_member_of (string) — the LDAP attribute that lists the host's group memberships. Default: memberOf
ldap_host_ssh_public_key (string) — the LDAP attribute that contains the host's SSH public keys. 🔑 Default: sshPublicKey
ldap_host_uuid (string) — the LDAP attribute that contains the UUID/GUID of an LDAP host object. Default: not set

💅 SERVICE ATTRIBUTES 💅

service entries. iconic. periodt.

ldap_service_object_class (string) — the object class of a service entry in LDAP. Default: ipService
ldap_service_name (string) — the LDAP attribute that contains the name of service attributes and their aliases. Default: cn
ldap_service_port (string) — the LDAP attribute that contains the port managed by this service. Default: ipServicePort
ldap_service_proto (string) — the LDAP attribute that contains the protocols understood by this service. Default: ipServiceProtocol

👑 SUDO ATTRIBUTES 👑

sudo rules but make it LDAP. we have SO many of these and every one is staying, bestie, don't even worry 💜

ldap_sudorule_object_class (string) — the object class of a sudo rule entry in LDAP. Default: sudoRole
ldap_sudorule_name (string) — the LDAP attribute that corresponds to the sudo rule name. Default: cn
ldap_sudorule_command (string) — the LDAP attribute that corresponds to the command name. Default: sudoCommand
ldap_sudorule_host (string) — the LDAP attribute that corresponds to the host name (or host IP address, host IP network, or host netgroup) Default: sudoHost
ldap_sudorule_user (string) — the LDAP attribute that corresponds to the user name (or UID, group name or user's netgroup) Default: sudoUser
ldap_sudorule_option (string) — the LDAP attribute that corresponds to the sudo options. Default: sudoOption
ldap_sudorule_runasuser (string) — the LDAP attribute that corresponds to the user name that commands may be run as. Default: sudoRunAsUser
ldap_sudorule_runasgroup (string) — the LDAP attribute that corresponds to the group name or group GID that commands may be run as. Default: sudoRunAsGroup
ldap_sudorule_notbefore (string) — the LDAP attribute that corresponds to the start date/time for when the sudo rule is valid. ⏰ Default: sudoNotBefore
ldap_sudorule_notafter (string) — the LDAP attribute that corresponds to the expiration date/time, after which the sudo rule will no longer be valid. the way it just stops being valid… 😭 Default: sudoNotAfter
ldap_sudorule_order (string) — the LDAP attribute that corresponds to the ordering index of the rule. Default: sudoOrder

🍓 AUTOFS ATTRIBUTES 🍓

automount stuff! and notice how a bunch of the defaults have a whole conditional situation going on depending on rfc2307 / autofs_provider=ad — read the defaults carefully babe, they're not all the same 💀

ldap_autofs_map_object_class (string) — the object class of an automount map entry in LDAP. Default: nisMap (rfc2307, autofs_provider=ad), otherwise automountMap
ldap_autofs_map_name (string) — the name of an automount map entry in LDAP. Default: nisMapName (rfc2307, autofs_provider=ad), otherwise automountMapName
ldap_autofs_entry_object_class (string) — the object class of an automount entry in LDAP. the entry usually corresponds to a mount point. Default: nisObject (rfc2307, autofs_provider=ad), otherwise automount
ldap_autofs_entry_key (string) — the key of an automount entry in LDAP. the entry usually corresponds to a mount point. Default: cn (rfc2307, autofs_provider=ad), otherwise automountKey
ldap_autofs_entry_value (string) — the key of an automount entry in LDAP. the entry usually corresponds to a mount point. Default: nisMapEntry (rfc2307, autofs_provider=ad), otherwise automountInformation

✨ IP HOST ATTRIBUTES ✨

ldap_iphost_object_class (string) — the object class of an iphost entry in LDAP. Default: ipHost
ldap_iphost_name (string) — the LDAP attribute that contains the name of the IP host attributes and their aliases. Default: cn
ldap_iphost_number (string) — the LDAP attribute that contains the IP host address. Default: ipHostNumber

🌈 IP NETWORK ATTRIBUTES 🌈

ldap_ipnetwork_object_class (string) — the object class of an ipnetwork entry in LDAP. Default: ipNetwork
ldap_ipnetwork_name (string) — the LDAP attribute that contains the name of the IP network attributes and their aliases. Default: cn
ldap_ipnetwork_number (string) — the LDAP attribute that contains the IP network address. Default: ipNetworkNumber

🫶 SUBID ATTRIBUTES 🫶

subordinate ID ranges, bestie! keep an eye on the exact casing of these defaults, they're not all matching the option name 💖

ldap_subuid_object_class (string) — the object class of an subid entry in LDAP. Default: subordinateIdEntry
ldap_subuid_count (string) — Subordinate user ID count (range size) Default: subUidCount
ldap_subgid_count (string) — Subordinate group ID count (range size) Default: subGidCount
ldap_subuid_number (string) — Numerical subordinate user ID (range start value) Default: subUidNumber
ldap_subgid_number (string) — Numerical subordinate group ID (range start value) Default: subGidNumber
ldap_subid_range_owner (string) — Owner of an entry Default: subidRangeOwner

🔥 SEE ALSO 🔥

go read these too, they're all iconic in their own way, fr fr:

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8), sss_rpcidmapd(5), sssd-systemtap(5)

💖 AUTHORS 💖

The SSSD upstream — https://github.com/SSSD/sssd/

and that's the whole page, bestie!! 🎀 you ate that. this one's from the SSSD project, version stamp 07/08/2026, filed under SSSD-LDAP-ATTRIBUT(5) — go forth and map those attributes, main character 🌟💅

📦 where this page comes from

fedora 43: sssd-ldap 2.12.0-3.fc43 · GPL-3.0-or-later
fedora 44: sssd-ldap 2.13.1-2.fc44 · GPL-3.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms