[nss]
debug_level=6
filter_groups = root
filter_users = root
reconnection_retries = 3

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
domains = ldap.internal.bit-host.io
services = nss, pam, ssh

[pam]
reconnection_retries = 3

[domain/ldap.internal.bit-host.io]
enumerate = True
shell_fallback = /bin/bash
cache_credentials = True
id_provider = ldap
chpass_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_uri = ldaps://authentik.internal.bit-host.io
override_homedir = /home/%u
default_shell = /bin/bash

ldap_schema = rfc2307bis
ldap_search_base = DC=ldap,DC=internal,DC=bit-host,DC=io
ldap_user_search_base = ou=users,DC=ldap,DC=internal,DC=bit-host,DC=io
ldap_group_search_base = DC=ldap,DC=internal,DC=bit-host,DC=io

ldap_user_ssh_public_key = sshPublicKey
ldap_user_primary_group = primaryGroupID
ldap_user_object_class = user
ldap_user_name = cn
ldap_group_object_class = group
ldap_group_name = cn

# Optionally, filter logins to only a specific group
ldap_access_order = filter
ldap_access_filter = memberOf=cn=Linux-User,ou=groups,DC=ldap,DC=internal,DC=bit-host,DC=io

ldap_default_bind_dn = cn=srv-sssd,ou=users,DC=ldap,DC=internal,DC=bit-host,DC=io
ldap_default_authtok = mH13TszHgLD46gsfHePmv3vPHfwF3OD82pZga7p3dSwv3NxcsLDQZGAKr4ui
