Skip to content

[autobackport: sssd-2-9-4] man: add details about 'an2ln' #8435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexey-tikhonov merged 1 commit into from
Feb 6, 2026
Merged

[autobackport: sssd-2-9-4] man: add details about 'an2ln' #8435

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions src/man/sssd_krb5_localauth_plugin.8.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,13 +55,31 @@
<programlisting>
[plugins]
localauth = {
disable = an2ln
module = sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so
}
</programlisting>
automatically in the SSSD's public Kerberos configuration snippet
directory. If this directory is included in the local Kerberos
configuration the plugin will be enabled automatically.
</para>
<para>
This configuration snippet also disables the
<command>an2ln</command> module provided by MIT Kerberos if SSSD is
configured to use the AD or IPA provider. In those environments
<command>sssd_krb5_localauth_plugin</command> can reliably map the
system user names to Kerberos principals. A fallback to
<command>an2ln</command> might cause issues in environments where
users have the privilege to create Kerberos principals on their own
which might collide with names of other users used in the system.
Other modules provided by MIT Kerberos, e.g.
<command>k5login</command> are not affected.
</para>
<para>
Note: If using <quote>auth_provider = krb5</quote> then
<command>sssd_krb5_localauth_plugin</command> is not used, therefore
the above text is not applicable.
</para>
</refsect1>

<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/seealso.xml" />
Expand Down