---
name: "sssd-ldap-attributes"
section: "5"
platform: "linux"
package: "sssd"
version: "2.13.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/sssd-ldap-attributes"
---

# sssd-ldap-attributes(5)

SSSD LDAP Provider: Mapping Attributes

## NAME

sssd-ldap-attributes - SSSD LDAP Provider: Mapping Attributes

## DESCRIPTION

This manual page describes the mapping attributes of SSSD LDAP provider [**sssd-ldap**(5)](/sssd-ldap/5.md). Refer to the [**sssd-ldap**(5)](/sssd-ldap/5.md) manual page for full details about SSSD LDAP provider configuration options.

## USER ATTRIBUTES

ldap\_user\_object\_class (string)

The object class of a user entry in LDAP.

Default: posixAccount

ldap\_user\_name (string)

The LDAP attribute that corresponds to the user's login name.

Default: uid (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)

ldap\_user\_uid\_number (string)

The LDAP attribute that corresponds to the user's id.

Default: uidNumber

ldap\_user\_gid\_number (string)

The LDAP attribute that corresponds to the user's primary group id.

Default: gidNumber

ldap\_user\_primary\_group (string)

Active Directory primary group attribute for ID-mapping. Note that this attribute should only be set manually if you are running the “ldap” provider with ID mapping.

Default: unset (LDAP), primaryGroupID (AD)

ldap\_user\_gecos (string)

The LDAP attribute that corresponds to the user's gecos field.

Default: gecos

ldap\_user\_home\_directory (string)

The LDAP attribute that contains the name of the user's home directory.

Default: homeDirectory (LDAP and IPA), unixHomeDirectory (AD)

ldap\_user\_shell (string)

The LDAP attribute that contains the path to the user's default shell.

Default: loginShell

ldap\_user\_uuid (string)

The LDAP attribute that contains the UUID/GUID of an LDAP user object.

Default: not set in the general case, objectGUID for AD and ipaUniqueID for IPA

ldap\_user\_objectsid (string)

The LDAP attribute that contains the objectSID of an LDAP user object. This is usually only necessary for ActiveDirectory servers.

Default: objectSid for ActiveDirectory, not set for other servers.

ldap\_user\_modify\_timestamp (string)

The LDAP attribute that contains timestamp of the last modification of the parent object.

Default: modifyTimestamp

ldap\_user\_shadow\_last\_change (string)

When using ldap\_pwd\_policy=shadow, this parameter contains the name of an LDAP attribute corresponding to its [**shadow**(5)](/shadow/5.md) counterpart (date of the last password change).

Default: shadowLastChange

ldap\_user\_shadow\_min (string)

When using ldap\_pwd\_policy=shadow, this parameter contains the name of an LDAP attribute corresponding to its [**shadow**(5)](/shadow/5.md) counterpart (minimum password age).

Default: shadowMin

ldap\_user\_shadow\_max (string)

When using ldap\_pwd\_policy=shadow, this parameter contains the name of an LDAP attribute corresponding to its [**shadow**(5)](/shadow/5.md) counterpart (maximum password age).

Default: shadowMax

ldap\_user\_shadow\_warning (string)

When using ldap\_pwd\_policy=shadow, this parameter contains the name of an LDAP attribute corresponding to its [**shadow**(5)](/shadow/5.md) counterpart (password warning period).

Default: shadowWarning

ldap\_user\_shadow\_inactive (string)

When using ldap\_pwd\_policy=shadow, this parameter contains the name of an LDAP attribute corresponding to its [**shadow**(5)](/shadow/5.md) counterpart (password inactivity period).

Default: shadowInactive

ldap\_user\_shadow\_expire (string)

When using ldap\_pwd\_policy=shadow or ldap\_account\_expire\_policy=shadow, this parameter contains the name of an LDAP attribute corresponding to its [**shadow**(5)](/shadow/5.md) counterpart (account expiration date).

Default: shadowExpire

ldap\_user\_krb\_last\_pwd\_change (string)

When using ldap\_pwd\_policy=mit\_kerberos, this parameter contains the name of an LDAP attribute storing the date and time of last password change in kerberos.

Default: krbLastPwdChange

ldap\_user\_krb\_password\_expiration (string)

When using ldap\_pwd\_policy=mit\_kerberos, this parameter contains the name of an LDAP attribute storing the date and time when current password expires.

Default: krbPasswordExpiration

ldap\_user\_ad\_account\_expires (string)

When using ldap\_account\_expire\_policy=ad, this parameter contains the name of an LDAP attribute storing the expiration time of the account.

Default: accountExpires

ldap\_user\_ad\_user\_account\_control (string)

When using ldap\_account\_expire\_policy=ad, this parameter contains the name of an LDAP attribute storing the user account control bit field.

Default: userAccountControl

ldap\_ns\_account\_lock (string)

When using ldap\_account\_expire\_policy=rhds or equivalent, this parameter determines if access is allowed or not.

Default: nsAccountLock

ldap\_user\_nds\_login\_disabled (string)

When using ldap\_account\_expire\_policy=nds, this attribute determines if access is allowed or not.

Default: loginDisabled

ldap\_user\_nds\_login\_expiration\_time (string)

When using ldap\_account\_expire\_policy=nds, this attribute determines until which date access is granted.

Default: loginDisabled

ldap\_user\_nds\_login\_allowed\_time\_map (string)

When using ldap\_account\_expire\_policy=nds, this attribute determines the hours of a day in a week when access is granted.

Default: loginAllowedTimeMap

ldap\_user\_principal (string)

The LDAP attribute that contains the user's Kerberos User Principal Name (UPN).

Default: krbPrincipalName

ldap\_user\_extra\_attrs (string)

Comma-separated list of LDAP attributes that SSSD would fetch along with the usual set of user attributes.

The list can either contain LDAP attribute names only, or colon-separated tuples of SSSD cache attribute name and LDAP attribute name. In case only LDAP attribute name is specified, the attribute is saved to the cache verbatim. Using a custom SSSD attribute name might be required by environments that configure several SSSD domains with different LDAP schemas.

Please note that several attribute names are reserved by SSSD, notably the “name” attribute. SSSD would report an error if any of the reserved attribute names is used as an extra attribute name.

Examples:

ldap\_user\_extra\_attrs = telephoneNumber

Save the “telephoneNumber” attribute from LDAP as “telephoneNumber” to the cache.

ldap\_user\_extra\_attrs = phone:telephoneNumber

Save the “telephoneNumber” attribute from LDAP as “phone” to the cache.

Default: not set

ldap\_user\_ssh\_public\_key (string)

The LDAP attribute that contains the user's SSH public keys.

Default: sshPublicKey

ldap\_user\_fullname (string)

The LDAP attribute that corresponds to the user's full name.

Default: cn

ldap\_user\_member\_of (string)

The LDAP attribute that lists the user's group memberships.

Default: memberOf

ldap\_user\_authorized\_service (string)

If access\_provider=ldap and ldap\_access\_order=authorized\_service, SSSD will use the presence of the authorizedService attribute in the user's LDAP entry to determine access privilege.

An explicit deny (!svc) is resolved first. Second, SSSD searches for explicit allow (svc) and finally for allow\_all (\*).

Please note that the ldap\_access\_order configuration option *must* include “authorized\_service” in order for the ldap\_user\_authorized\_service option to work.

Some distributions (such as Fedora-29+ or RHEL-8) always include the “systemd-user” PAM service as part of the login process. Therefore when using service-based access control, the “systemd-user” service might need to be added to the list of allowed services.

Default: authorizedService

ldap\_user\_authorized\_host (string)

If access\_provider=ldap and ldap\_access\_order=host, SSSD will use the presence of the host attribute in the user's LDAP entry to determine access privilege.

An explicit deny (!host) is resolved first. Second, SSSD searches for explicit allow (host) and finally for allow\_all (\*).

Please note that the ldap\_access\_order configuration option *must* include “host” in order for the ldap\_user\_authorized\_host option to work.

Default: host

ldap\_user\_authorized\_rhost (string)

If access\_provider=ldap and ldap\_access\_order=rhost, SSSD will use the presence of the rhost attribute in the user's LDAP entry to determine access privilege. Similarly to host verification process.

An explicit deny (!rhost) is resolved first. Second, SSSD searches for explicit allow (rhost) and finally for allow\_all (\*).

Please note that the ldap\_access\_order configuration option *must* include “rhost” in order for the ldap\_user\_authorized\_rhost option to work.

Default: rhost

ldap\_user\_certificate (string)

Name of the LDAP attribute containing the X509 certificate of the user.

Default: userCertificate;binary

ldap\_user\_email (string)

Name of the LDAP attribute containing the email address of the user.

Note: If an email address of a user conflicts with an email address or fully qualified name of another user, then SSSD will not be able to serve those users properly. This option allows users to login by (1) username, and (2) e-mail address. If for some reason several users need to share the same email address then set this option to a nonexistent attribute name in order to disable user lookup/login by email.

Default: mail

ldap\_user\_passkey (string)

Name of the LDAP attribute containing the passkey mapping data of the user.

Default: passkey (LDAP), ipaPassKey (IPA), altSecurityIdentities (AD)

## GROUP ATTRIBUTES

ldap\_group\_object\_class (string)

The object class of a group entry in LDAP.

Default: posixGroup

ldap\_group\_name (string)

The LDAP attribute that corresponds to the group name. In an environment with nested groups, this value must be an LDAP attribute which has a unique name for every group. This requirement includes non-POSIX groups in the tree of nested groups.

Default: cn (rfc2307, rfc2307bis and IPA), sAMAccountName (AD)

ldap\_group\_gid\_number (string)

The LDAP attribute that corresponds to the group's id.

Default: gidNumber

ldap\_group\_member (string)

The LDAP attribute that contains the names of the group's members.

Default: memberuid (rfc2307) / member (rfc2307bis)

ldap\_group\_uuid (string)

The LDAP attribute that contains the UUID/GUID of an LDAP group object.

Default: not set in the general case, objectGUID for AD and ipaUniqueID for IPA

ldap\_group\_objectsid (string)

The LDAP attribute that contains the objectSID of an LDAP group object. This is usually only necessary for ActiveDirectory servers.

Default: objectSid for ActiveDirectory, not set for other servers.

ldap\_group\_modify\_timestamp (string)

The LDAP attribute that contains timestamp of the last modification of the parent object.

Default: modifyTimestamp

ldap\_group\_type (string)

The LDAP attribute that contains an integer value indicating the type of the group and maybe other flags.

This attribute is currently only used by the AD provider to determine if a group is a domain local groups and has to be filtered out for trusted domains.

Default: groupType in the AD provider, otherwise not set

ldap\_group\_external\_member (string)

The LDAP attribute that references group members that are defined in an external domain. At the moment, only IPA's external members are supported.

Default: ipaExternalMember in the IPA provider, otherwise unset.

## NETGROUP ATTRIBUTES

ldap\_netgroup\_object\_class (string)

The object class of a netgroup entry in LDAP.

In IPA provider, ipa\_netgroup\_object\_class should be used instead.

Default: nisNetgroup

ldap\_netgroup\_name (string)

The LDAP attribute that corresponds to the netgroup name.

In IPA provider, ipa\_netgroup\_name should be used instead.

Default: cn

ldap\_netgroup\_member (string)

The LDAP attribute that contains the names of the netgroup's members.

In IPA provider, ipa\_netgroup\_member should be used instead.

Default: memberNisNetgroup

ldap\_netgroup\_triple (string)

The LDAP attribute that contains the (host, user, domain) netgroup triples.

This option is not available in IPA provider.

Default: nisNetgroupTriple

ldap\_netgroup\_modify\_timestamp (string)

The LDAP attribute that contains timestamp of the last modification of the parent object.

This option is not available in IPA provider.

Default: modifyTimestamp

## HOST ATTRIBUTES

ldap\_host\_object\_class (string)

The object class of a host entry in LDAP.

Default: ipService

ldap\_host\_name (string)

The LDAP attribute that corresponds to the host's name.

Default: cn

ldap\_host\_fqdn (string)

The LDAP attribute that corresponds to the host's fully-qualified domain name.

Default: fqdn

ldap\_host\_serverhostname (string)

The LDAP attribute that corresponds to the host's name.

Default: serverHostname

ldap\_host\_member\_of (string)

The LDAP attribute that lists the host's group memberships.

Default: memberOf

ldap\_host\_ssh\_public\_key (string)

The LDAP attribute that contains the host's SSH public keys.

Default: sshPublicKey

ldap\_host\_uuid (string)

The LDAP attribute that contains the UUID/GUID of an LDAP host object.

Default: not set

## SERVICE ATTRIBUTES

ldap\_service\_object\_class (string)

The object class of a service entry in LDAP.

Default: ipService

ldap\_service\_name (string)

The LDAP attribute that contains the name of service attributes and their aliases.

Default: cn

ldap\_service\_port (string)

The LDAP attribute that contains the port managed by this service.

Default: ipServicePort

ldap\_service\_proto (string)

The LDAP attribute that contains the protocols understood by this service.

Default: ipServiceProtocol

## SUDO ATTRIBUTES

ldap\_sudorule\_object\_class (string)

The object class of a sudo rule entry in LDAP.

Default: sudoRole

ldap\_sudorule\_name (string)

The LDAP attribute that corresponds to the sudo rule name.

Default: cn

ldap\_sudorule\_command (string)

The LDAP attribute that corresponds to the command name.

Default: sudoCommand

ldap\_sudorule\_host (string)

The LDAP attribute that corresponds to the host name (or host IP address, host IP network, or host netgroup)

Default: sudoHost

ldap\_sudorule\_user (string)

The LDAP attribute that corresponds to the user name (or UID, group name or user's netgroup)

Default: sudoUser

ldap\_sudorule\_option (string)

The LDAP attribute that corresponds to the sudo options.

Default: sudoOption

ldap\_sudorule\_runasuser (string)

The LDAP attribute that corresponds to the user name that commands may be run as.

Default: sudoRunAsUser

ldap\_sudorule\_runasgroup (string)

The LDAP attribute that corresponds to the group name or group GID that commands may be run as.

Default: sudoRunAsGroup

ldap\_sudorule\_notbefore (string)

The LDAP attribute that corresponds to the start date/time for when the sudo rule is valid.

Default: sudoNotBefore

ldap\_sudorule\_notafter (string)

The LDAP attribute that corresponds to the expiration date/time, after which the sudo rule will no longer be valid.

Default: sudoNotAfter

ldap\_sudorule\_order (string)

The LDAP attribute that corresponds to the ordering index of the rule.

Default: sudoOrder

## AUTOFS ATTRIBUTES

ldap\_autofs\_map\_object\_class (string)

The object class of an automount map entry in LDAP.

Default: nisMap (rfc2307, autofs\_provider=ad), otherwise automountMap

ldap\_autofs\_map\_name (string)

The name of an automount map entry in LDAP.

Default: nisMapName (rfc2307, autofs\_provider=ad), otherwise automountMapName

ldap\_autofs\_entry\_object\_class (string)

The object class of an automount entry in LDAP. The entry usually corresponds to a mount point.

Default: nisObject (rfc2307, autofs\_provider=ad), otherwise automount

ldap\_autofs\_entry\_key (string)

The key of an automount entry in LDAP. The entry usually corresponds to a mount point.

Default: cn (rfc2307, autofs\_provider=ad), otherwise automountKey

ldap\_autofs\_entry\_value (string)

The key of an automount entry in LDAP. The entry usually corresponds to a mount point.

Default: nisMapEntry (rfc2307, autofs\_provider=ad), otherwise automountInformation

## IP HOST ATTRIBUTES

ldap\_iphost\_object\_class (string)

The object class of an iphost entry in LDAP.

Default: ipHost

ldap\_iphost\_name (string)

The LDAP attribute that contains the name of the IP host attributes and their aliases.

Default: cn

ldap\_iphost\_number (string)

The LDAP attribute that contains the IP host address.

Default: ipHostNumber

## IP NETWORK ATTRIBUTES

ldap\_ipnetwork\_object\_class (string)

The object class of an ipnetwork entry in LDAP.

Default: ipNetwork

ldap\_ipnetwork\_name (string)

The LDAP attribute that contains the name of the IP network attributes and their aliases.

Default: cn

ldap\_ipnetwork\_number (string)

The LDAP attribute that contains the IP network address.

Default: ipNetworkNumber

## SUBID ATTRIBUTES

ldap\_subuid\_object\_class (string)

The object class of an subid entry in LDAP.

Default: subordinateIdEntry

ldap\_subuid\_count (string)

Subordinate user ID count (range size)

Default: subUidCount

ldap\_subgid\_count (string)

Subordinate group ID count (range size)

Default: subGidCount

ldap\_subuid\_number (string)

Numerical subordinate user ID (range start value)

Default: subUidNumber

ldap\_subgid\_number (string)

Numerical subordinate group ID (range start value)

Default: subGidNumber

ldap\_subid\_range\_owner (string)

Owner of an entry

Default: subidRangeOwner

## SEE ALSO

[**sssd**(8)](/sssd/8.md), [**sssd.conf**(5)](/sssd.conf/5.md), [**sssd-ldap**(5)](/sssd-ldap/5.md), [**sssd-ldap-attributes**(5)](/sssd-ldap-attributes/5.md), [**sssd-krb5**(5)](/sssd-krb5/5.md), [**sssd-simple**(5)](/sssd-simple/5.md), [**sssd-ipa**(5)](/sssd-ipa/5.md), [**sssd-ad**(5)](/sssd-ad/5.md), [**sssd-idp**(5)](/sssd-idp/5.md), [**sssd-sudo**(5)](/sssd-sudo/5.md), [**sssd-session-recording**(5)](/sssd-session-recording/5.md), [**sss\_cache**(8)](/sss_cache/8.md), [**sss\_debuglevel**(8)](/sss_debuglevel/8.md), [**sss\_obfuscate**(8)](/sss_obfuscate/8.md), [**sss\_seed**(8)](/sss_seed/8.md), [**sssd\_krb5\_locator\_plugin**(8)](/sssd_krb5_locator_plugin/8.md), [**sss\_ssh\_authorizedkeys**(1)](/sss_ssh_authorizedkeys/1.md), [**sss\_ssh\_knownhosts**(1)](/sss_ssh_knownhosts/1.md), [**sssd-ifp**(5)](/sssd-ifp/5.md), [**pam\_sss**(8)](/pam_sss/8.md). [**sss\_rpcidmapd**(5)](/sss_rpcidmapd/5.md)

## AUTHORS

**The SSSD upstream - https://github.com/SSSD/sssd/**