I am trying to setup LDAP authentication using SSSD on CentOS 7.

Is it possible to set up SSSD in a way that it uses two LDAP servers: one LDAP server is used just for login (basically just to authenticate with the password) and other LDAP server is used for getting all the other attributes of a user (homeDirectory, additional LDAP attributes defined only on that LDAP server)?

Users are defined on both servers (same uid, but different base).

1 Answer 1


This (same) questions was answered at serverfault:

No, I don't think this is possible except with an ugly hack. The only special-case that sssd supports is a different LDAP server for change password operations (with ldap_chpass_uri).

But what you could do is to use id_provider=proxy, configure it to use nslcd (aka nss-pam-ldapd) and configure nslcd to use the identity LDAP server. Then configure auth_provider=ldap and point it to the auth LDAP server.

It's not pretty and you would have two LDAP daemons running, but I can't think of another way of solving the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .