[SSSD-users] SSSD and accounts with UID = 0

Hi all, I'm trying to define in my AD administrative accounts for Linux boxes. To do that I initially thought to create nominative account with some suffix (ex: <username>_adm) and give them UID=0 to make them root accounts. As SSSD comes with filtering option to avoid some users or groups can connect on some given system using SSSD, I would have added these users to some groups and finally grant access to one admins group to a first bunch of systems, the secodn admins group to a second bunch of systems, etc... Reading doc and man pages about SSSD sometimes it seems to say that is possible to have users retrieved by SSSD when they have UID = 0, sometimes it says it is not possible. For example: man sssd.conf on Centos 7 (sssd 1.12.2 - 1.12.2-58.el7_1.17.x86_64) gives: pam_trusted_users (string) Specifies the comma-separated list of UID values or user names that are allowed to access the PAM responder. User names are resolved to UIDs at startup. Default: all (All users are allowed to access the PAM responder) * Please note that UID 0 is always allowed to access the PAM responder even in case it is* * not in the pam_trusted_users list.* As man pages says users with "UID 0 is always allowed..." I would expected this refers users retrieved by SSSD, so that SSSD accept to retrieve users with UID=0. Unfortunately even adding "min_id = 0" in my sssd.conf SSSD refuse to show uid=0 users. In SSSD logs I have ldapserach filter shown as follow: (&(cn=<username>)(objectclass=user)(cn=*)(&(uidNumber=*)*(!(uidNumber=0))*)) And somewhere I read this is by design that now SSSD refuses to allow users with UID=0. As all that is not too clear for me, where are we now, are users with UID=0 allowed or not? Cheers, mathias