What is the default value for this parameter if I don't mention it in the configuration file?

In a hundred of people enterprise environment, multiple tools - CDH Hadoop, analytics tool, Tableau, Wherecape red, etc. connect to AD.

SSSD is set to get group information from file then go to AD.

If I left this parameter blank, it takes 12 seconds get the group information back from AD without cache. However, if I set this parameter to 0, it takes 0.3 seconds to get the group information back.


  1. Why SSSD configuration for thd parameter ldap_group_nesting_level is not zero by default?
  2. What is this parameter used for?
  3. Is there any disadvantage for set this value to zero?



I suspect you may have an indexing issue.


  1. Setting it to 0 would break configuration where groups are not the base you specified.
  2. It specifies how many levels below the base that groups may exist.
  3. Not if all your groups can be found at the base. If you have groups below the top level, they will not be reported. This should not be an issue for a simple AD setup.
| improve this answer | |
  • Does it make sense to use 12 seconds to search the sub AD groups? – cdhit Apr 19 '17 at 3:13
  • @cdhil No, but it depends on the indexes, and depth of the data under groups. – BillThor Apr 19 '17 at 4:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.