We are using SSSD for authentication using LDAP. And I filter the user access using simple_allow_groups as follows:

access_provider = simple
simple_allow_groups = Computer Admins

(Note: Computer Admins is a LDAP group)

Is it possible to get a list of ONLY allowed users using getent or something else??

There is an option enumeration, but this lists all users from LDAP. I am only interested in the allowed users.

  • Authenticaton for what? Secure Shell? If so, add the relevant groups to /etc/ssh/sssd_config's AllowGroups directive once you have PAM enabled and configured.
    – DopeGhoti
    May 23, 2017 at 22:03
  • I want get a listing of the users that are allowed by "simple_allow_groups" for e.g.
    – Saqib Ali
    May 23, 2017 at 22:07
  • Good question. Did you ever find an answer?
    – jrw32982
    Mar 6, 2019 at 19:10
  • Nope. I don’t think it is possible 😕
    – Saqib Ali
    Mar 6, 2019 at 19:17

1 Answer 1


getent only works if your group is a Unix group (that is, it has a gidNumber and is visible to the nss part of sssd). If /etc/nsswtich.conf is set up to look up groups via sss, then getent group 'Computer Admins' will give you a list of members of that group, transitively closed (that is, including members of groups that are themselves members of this group etc.). This list should only include users who are also Unix users (who have an uidNumber attribute).

If 'Computer Admins' is not a Unix group, then you'll have to work with an LDAP client (such as ldapsearch or ldapvi) to get its members and implement transitive closure yourself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .