My Favorites


Please to see your favorites.

  • Bookmark
  • Email Document
  • Printer Friendly
  • Favorite
  • Rating:

Limit access of Active Directory users with sssd

This document (7024238) is provided subject to the disclaimer at the end of this document.


SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 15 Service Pack 1 (SLES 15 SP1)
SUSE Linux Enterprise Server 12 Service Pack 3 (SLES 12 SP3)
SUSE Linux Enterprise Server 12 Service Pack 4 (SLES 12 SP4)


In a large Active Directory environment, it may be necessary to limit certain AD users from accessing certain Linux systems. If Linux's authentication against the AD is handled with sssd, there is a simple solution to configure the access with sssd.


This is a simple example configuration done via YaST :

config_file_version = 2
services = nss,pam
domains = intern.priv



id_provider = ad
auth_provider = ad
enumerate = false
cache_credentials = false
case_sensitive = true
ad_server = w2019.intern.priv
ad_hostname = sles15sp11.intern.priv

In this example, we want members of the "Domain Admins" group to be able to login to the system.  All other users from the Active Directory domain should have no access.
The domain name is "INTERN.PRIV" .

Add the following lines to the Domain section:

simple_allow_groups = Domain Admins@INTERN.PRIV
access_provider = simple

and restart the sssd daemon:

systemctl restart sssd

Check whether the configuration is working:

e.g. as member of the "Domain Users" group:

helga:~ # ssh INTERN.PRIV\\hmabuse@sles15sp11
Connection closed by port 22

and as a member of the "Domain Admins" group:

helga:~ # ssh INTERN.PRIV\\Administrator@sles15sp11
Last login: Tue Nov  5 12:08:08 2019 from


This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7024238
  • Creation Date:05-NOV-19
  • Modified Date:25-NOV-19
    • NovellSUSE Linux Enterprise Server for SAP Applications
    • SUSESUSE Linux Enterprise Desktop
      SUSE Linux Enterprise Server
< Back to Support Search

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center