subdomains_provider=none would do what you're asking for

Well, I am not sure
subdomains_provider = none
disables the whole AD forest discovery. I think we can keep it enabled (and enumerate subdomains, too) - just stick with the ad servers specified.

But I admit that I do not know if it makes a sense, depends if multiple domains can be served by a single AD controller:

• if not (which is likely the case), we could at least drop some warning message saying that ad_server parameter will be ignored or enforce subdomains_provider=none
• if yes, we should continue AD forest discovery as normal, just skip the DC detection procedure

Leave this on you though. subdomains=none works fine for me, indeed

Moving to 1.15 for now, mostly because there is a viable workaround - use separate [domain] sections and set the ad_server options in each of them.

In a single forest, using a single keytab should work, otherwise separate keytabs must be used.

milestone: NEEDS_TRIAGE => SSSD 1.15 beta

Fields changed

rhbz: => todo

We already have an option ad_enabled_domains and when we implement #2599 we will be able to selectively configure and enable subdomains.

resolution: => duplicate
status: new => closed

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3745

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.