---
apiVersion: v1
data:
  SSSD_CONF: |
    [sssd]
    config_file_version = 2
    services = nss,pam
    sbus_timeout = 30
    domains = FOO.COM

    [domain/FOO.COM]
    enumerate = false
    cache_credentials = true
    ignore_group_members = true
    id_provider = ldap
    auth_provider = ldap
    chpass_provider = ldap
    ldap_uri = ldap://ldap.foo.com:3268
    ldap_schema = rfc2307bis
    ldap_user_object_class = user
    ldap_user_home_directory = unixHomeDirectory
    ldap_user_principal = sAMAccountName
    ldap_user_name = sAMAccountName
    ldap_group_object_class = group
    ldap_access_order = expire
    ldap_account_expire_policy = ad
    ldap_force_upper_case_realm = true
    ldap_referrals = false
    ldap_user_search_base = DC=FOO,DC=com?subtree?(memberOf=CN=Development Users,OU=Groups,DC=foona,DC=FOO,DC=com)
    ldap_default_bind_dn = CN=Anonymous LDAP,CN=Users,DC=foona,DC=FOO,DC=com
    ldap_default_authtok_type = password
    ldap_default_authtok = ldap.secret.password
    ldap_id_use_start_tls = true
    ldap_tls_reqcert = demand
    # TODO path changeable?
    #ldap_tls_cacert = /etc/ssl/certs/sssd

    ldap_use_tokengroups = true

    [nss]
    filter_users = root
    filter_groups = root

    # override the user home directory that is provided by the LDAP password entry
    override_homedir=/home/%u

    # override the user shell that is provided by the LDAP password entry
    override_shell=/bin/bash
kind: ConfigMap
metadata:
  name: foo-sssd-config
