I am trying to setup LDAP authentication using SSSD on CentOS 7.

Is it possible to set up SSSD in a way that it uses two LDAP servers: one LDAP server is used just for login (basically just to authenticate with the password) and other LDAP server is used for getting all the other attributes of a user (homeDirectory, additional LDAP attributes defined only on that LDAP server)?

Users are defined on both servers (same uid, but different base).


This (same) questions was answered at serverfault:

No, I don't think this is possible except with an ugly hack. The only special-case that sssd supports is a different LDAP server for change password operations (with ldap_chpass_uri).

But what you could do is to use id_provider=proxy, configure it to use nslcd (aka nss-pam-ldapd) and configure nslcd to use the identity LDAP server. Then configure auth_provider=ldap and point it to the auth LDAP server.

It's not pretty and you would have two LDAP daemons running, but I can't think of another way of solving the problem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.