Description of problem: Right now if SSSD has no domains defined in [sssd], it does not start. I'd like to request this behavior change slightly. If there are no domains defined in [sssd], then sssd looks for all defined '[domain/*]' domains and loads them alphabetically. If there are still no domains loaded then error out and don't start. Folks with required order or who wish to exclude some domains they've defined will still retain their existing behavior, but this common error is avoided and need to edit sssd.conf is removed. Version-Release number of selected component (if applicable): sssd-2.2.2-1.fc31.x86_64 How reproducible: 100% Steps to Reproduce: 1. No way to automatically import domains without editing sssd.conf 2. 3. Actual results: Must add domain [sssd] \n domains Expected results: Able to let SSSD import all defined domains if none were requested via sssd.conf Additional info:
sssd has always at least one domain on fedora: `implicit_files`. So it would never fail. It is not required to modify sssd.conf. You can can put snippet files into directory /etc/sssd/conf.d/ Sure you still need to "modify" the option domains in section `[sssd]` but the last match wins. e.g. [sssd] services = nss, sudo, pam, autofs, ssh services = nss, sudo, pam, autofs, ssh, ifp services = nss, pam, ssh debug_level = 0xBFF0 domains = default domains = default, example.com domains = idm.lab.example.com domains = ldapkrb5 domains = BZ1062232 domains = refLDAP domains = ldap-rfc2307 domains = example.com, LOCAL The following services `nss, pam, ssh` and domains `example.com, LOCAL` will be used. You can generate 10 snippet files for 10 domains and then 11th snippet which override the option domains in the `[sssd]` section. It is not ideal but reasonable workaround which will work even in el7 IIRC there was a plan to add boolean option to the domain section `enabled` ut you would need to check upstream issues. https://pagure.io/SSSD/sssd/issues
This package has changed maintainer in the Fedora. Reassigning to the new maintainer of this component.
There is a PR for the 'enabled' option Lukas mentioned: https://github.com/SSSD/sssd/pull/5213 I'm going to close this RFE BZ. Once the PR is merged and released in Fedora, you'll be enable to just drop in domain to /etc/sssd/sssd.conf and enable them via this attribute. If you want to track the status of the PR in this BZ, feel free to reopen it and change the description to reflect it.