#Debug log level is set to maximum
# Logs are in /var/log/sssd
[sssd]
debug_level = 0x0400
domains = netid.washington.edu
services = nss, pam
config_file_version = 2

[nss]
debug_level = 0x0400
filter_groups = root
filter_users = root
reconnection_retries = 3
entry_cache_timeout = 300
entry_cache_nowait_percentage = 75

[domain/netid.washington.edu]
debug_level = 0x0400
# enumeration will affect performance
#  set true or false depending on the number of users in your LDI OU
enumerate = true
id_provider = ldap
# set min_id to avoid clash between 
#   lowest possible uid from uwnetid domain
#   and highest possible local account uid
min_id = 2001

# Disable for debugging...might enable for production:
cache_credentials = false
entry_cache_timeout = 300

ldap_uri = ldap://ldi.s.uw.edu
ldap_id_use_start_tls = true
ldap_tls_reqcert = demand
# These are the Redhat standard paths to cert and key directories
#  Modify if your paths or file names are different
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
ldap_tls_cert = /etc/pki/tls/certs/ldi-client.crt
ldap_tls_key = /etc/pki/tls/private/ldi-client.key
ldap_sasl_mech = EXTERNAL
# Change 'chem' to your own OU.
ldap_search_base = ou=chem,dc=ldi,dc=uw,dc=edu
ldap_user_search_base = ou=accounts,ou=chem,dc=ldi,dc=uw,dc=edu
ldap_group_search_base = ou=groups,ou=chem,dc=ldi,dc=uw,dc=edu

use_fully_qualified_names = false
fallback_homedir = /home/%u
shell_fallback = /bin/bash

auth_provider = krb5
# external krb5 configuration is not used, all configuration is here:
krb5_realm = NETID.WASHINGTON.EDU
krb5_server = netid.washington.edu

# If you prefer instead to use kerberos settings from /etc/krb5.conf
# then set:
# krb5_use_kdcinfo = false

# /etc/krb5.keytab is not used, unless you want to enable this:
# krb5_validate = true
