Help Center/ Huawei Cloud EulerOS/ FAQs/ How Do I Handle LDAP Authentication Failures After SSSD 2.9.0 or Later Is Switched to HCE SSSD 2.6.1?
Updated on 2026-02-28 GMT+08:00
View PDF
Share

How Do I Handle LDAP Authentication Failures After SSSD 2.9.0 or Later Is Switched to HCE SSSD 2.6.1?

Symptom

If HCE 2.0 is used, SSSD 2.9.0 or later is switched to SSSD 2.6.1. LDAP authentication may fail if enable_files_domain is not configured in the /etc/sssd/sssd.conf file. enable_files_domain is used to determine whether to use local authentication.

Possible Cause

HCE 2.0 uses SSSD 2.6.1. In versions later than SSSD 2.9.0, the open-source community changed the default value of enable_files_domain to false. This means that local authentication is disabled, and remote authentication is preferentially used. However, in SSSD 2.6.1 of HCE, local authentication is enabled. If enable_files_domain = false is not set in the configuration file, local authentication is preferentially used. In this case, if no password is configured for the local user, the authentication will fail.

Solution

In the SSSD authentication configuration file (/etc/sssd/sssd.conf) of HCE, add enable_files_domain = false to disable local authentication. Remote authentication will be used by default.