Hi, We're migrating from pam_ldap to sssd and so far everything works as expected: ldapsearch, getent passwd <user>, getent group <group>, tested offline caching, great product! users that are not part of certain allowed groups by having "filter passwd LDAP_FILTER" in /etc/nslcd.conf. Is there any similar functionality I could use with SSSD to prevent exposing whole ldap tree? Do filter_groups or/and filter_users work with ldap filters? Example of sanitized conf: [sssd] config_file_version = 2 sbus_timeout = 30 services = nss, pam, sudo, ssh domains = LOCAL, LDAP [nss] filter_users = adm,avahi,bin,daemon,dbus,haldaemon,halt,ldap,mail,named,news,nfsnobody,nobody,nscd,nslcd,ntp,operator,radiusd,root,rpc,rpcuser,saslauth,shutdown,smmsp,sshd,sync,tcpdump,vcsa filter_groups = adm,audio,bin,cdrom,cgred,daemon,dbus,dialout,dip,disk,floppy,fuse,kmem,ldap,lock,lp,mail,man,mem,nfsnobody,nobody,nscd,ntp,root,rpc,rpcuser,saslauth,smmsp,sshd,sys,tape,tcpdump,tty,users,utempter,utmp,vcsa,video [pam] debug_level = 3 reconnection_retries = 3 offline_credentials_expiration = 2 offline_failed_login_attempts = 3 offline_failed_login_delay = 5 pam_verbosity = 2 [domain/LOCAL] description = LOCAL Users domain id_provider = local enumerate = true min_id = 500 max_id = 999 [domain/LDAP] min_id = 499 debug_level = 3 cache_credentials = True entry_cache_timeout = 864000 auth_provider = ldap id_provider = ldap access_provider = ldap #chpass_provider = ldap sudo_provider = ldap # LDAP Search ldap_search_base = dc=example,dc=com ldap_user_search_base = ou=users,o=Example,dc=example,dc=com ldap_group_search_base = ou=groups,o=Example,dc=example,dc=com # LDAP Custom Schema ldap_group_member = hMemberDN ldap_user_member_of = description ldap_schema = rfc2307bis ldap_network_timeout = 3 ldap_id_use_start_tls = False ldap_tls_reqcert = never ldap_uri = ldaps://ldap2.example.com, ldaps://ldap1.example.com ldap_tls_cacertdir = /etc/openldap/cacerts ldap_default_authtok_type = obfuscated_password ldap_default_bind_dn = uid=****** ldap_default_authtok = ********* ldap_user_ssh_public_key = sshPublicKey # Password expiration #ldap_pwd_policy=shadow #ldap_account_expire_policy = shadow #ldap_account_expire_policy = ad #ldap_access_order = filter,expire ldap_access_order = filter ldap_access_filter = (&(objectClass=posixAccount)(uidNumber=*)(|(description=CN=prodgroup,OU=groups,O=Example,DC=example,DC=com)(description=CN=secgroup,OU=groups,O=Example,DC=Example,DC=com))) # SUDO ldap_sudo_search_base = ou=sudoers,o=Example,dc=example,dc=com ldap_sudo_full_refresh_interval = 86400 ldap_sudo_smart_refresh_interval = 3600 [sudo] [ssh] # debug_level=8 [root@nslcd /etc]$ id my_test_user id: my_test_user: No such user [root@nslcd /etc]$ echo $? 1 [root@nslcd /etc]$ egrep filter /etc/nslcd.conf filter passwd (&(objectClass=posixAccount)(uidNumber=*)(|(description=CN=prod,OU=groups,O=Example,DC=example,DC=com)(description=CN=sec,OU=groups,O=Example,DC=example,DC=com))) [root@sssd /etc]$ id my_test_user uid=*******13(my_test_user) gid=**** groups=*****(prod) [root@sssd /etc]$ echo $? 0 -- Best regards, George Vasiliu Security Admin Hostopia, a Deluxe Company E-Mail: gvasiliu(a)hostopia.com Tel: 416-883-6785, Cell: 647-924-7257 Key ID: 0x2D0D7895 Key Server: keys.gnupg.net