We have a few RHEL7 boxes for developers, users are authenticated with SSSD against AD. Each developer has his/her own Linux machine, all Linuxes are managed by Puppet. Till now all users used BASH ("default_shell = /bin/bash"). Now we have a few users which want ZSH. Because we'd like to keep sssd.conf standard on all linuxes, we thought about use something like: allowed_shells = /bin/zsh,/bin/bash shell_fallback = /bin/bash So if certain linux box has ZSH installed, user will get it; else it will use BASH. We tried this config, and played with other shell-related config params - nothing work. Users receive /bin/sh instead of bash and zsh. Any ideas? TIA, Vitaly