D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.9
/
site-packages
/
SSSDConfig
/
__pycache__
/
Filename :
sssdoptions.cpython-39.opt-1.pyc
back
Copy
a �,h�� � @ sX d dl Z d dlZdZdZejeedd�Ze jd dkr>ejZnejZG dd� de�Z dS ) � NZ sss_daemonz/usr/share/localeT)�fallback� c � @ s� e Zd Zdd� Zed�ed�ed�ed�ed�ed�ed�ed �ed �ed �ed �ed �ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed �ed �ed �ed �ed �ed!�ed"�ed#�ed$�ed%�ed&�ed'�ed(�ed)�ed*�ed+�ed,�ed-�ed.�ed/�ed0�ed1�ed2�ed3�ed4�ed5�ed6�ed7�ed8�ed9�ed:�ed;�ed<�ed=�ed>�ed?�ed@�edA�edB�edC�edD�edE�edF�edG�edH�edI�edJ�edK�edL�edM�edN�edO�edP�edQ�edR�edS�ed#�edT�edU�edV�edW�edX�edY�edZ�ed[�ed\�ed]�ed^�ed_�ed`�eda�edb�edc�edd�ede�edf�edg�edh�edi�edj�edk�edl�edm�edn�edo�edp�edq�edr�eds�edt�edu�edv�edw�edx�edy�edz�ed{�ed|�ed}�edt�edt�edt�edt�edt�edt�edt�ed~�ed�ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ededÃedăed��edŃedƃedǃedȃedɃedʃed˃ed̃ed̓ededσed��edЃedуed҃edӃedԃedՃedփed׃ededكedڃedۃed܃ed݃edރed߃ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed�ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��ed��e�d �e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d �e�d �e�d �e�d �e�d �e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d�e�d �e�d �e�d �e�d �e�d �e�d!�e�d"�e�d#�e�d$�e�d%�e�d&�e�d'�e�d(�e�d)�e�d*�e�d+�e�d,�e�d-�e�d.�e�d/�e�d0�e�d1�e�d2�e�d3�e�d4�e�d5�e�d6�e�d7�e�d8�e�d9�e�d:�e�d;�e�d<�e�d=�e�d>�e�d?�e�d@�e�dA�e�dB�e�dC�e�dD�e�dE�e�dF�e�dG�e�dH�e�dI�e�dJ�e�dK�e�dL�e�dM�e�dN�e�dO�e�dP�e�dQ�e�dR�e�dS�e�dT�e�dU�e�dV�e�dW�e�dX�e�d3�e�dY�e�dZ�e�d[�e�d\�e�d]�e�d^�e�d_�e�d`�e�da�e�db�e�dc�e�dd�e�de�e�df�e�dg�e�dh�e�di�e�dj�e�dk�e�dl�e�dm�e�dn�e�do�e�dp�e�dq�e�dr�e�ds�e�dt�e�du�e�dv�e�dw�edЃe�dx�ed��e�dy�e�dz�e�d{�e�d|�e�d}�e�d~�e�d�e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d��e�d���d����Z�d�S (� � SSSDOptionsc C s d S )N� )�selfr r �:/usr/lib/python3.9/site-packages/SSSDConfig/sssdoptions.py�__init__ s zSSSDOptions.__init__z&Set the verbosity of the debug loggingz Include timestamps in debug logsz0Include microseconds in timestamps in debug logsz Enable/disable debug backtracez*Watchdog timeout before restarting servicezCommand to start servicez7Number of times to attempt connection to Data ProviderszCThe number of file descriptors that may be opened by this responderz4Idle time before automatic disconnection of a clientz4Idle time before automatic shutdown of the responderz>Always query all the caches before querying the Data Providersz�When SSSD switches to offline mode the amount of time before it tries to go back online will increase based upon the time spent disconnected. This value is in seconds and calculated by the following: offline_timeout + random_offset.zTIndicates what is the syntax of the config file. SSSD 0.6.0 and later use version 2.zSSSD Services to startzSSSD Domains to startz"Regex to parse username and domainz=Printf-compatible format for displaying fully-qualified nameszPDirectory on the filesystem where SSSD should store Kerberos replay cache files.z2Domain to add to names without a domain component.z The user to drop privileges toz Tune certificate verificationzFAll spaces in group or user names will be replaced with this characterz2Tune sssd to honor or ignore netlink state changesz+Enable or disable the implicit files domainz/A specific order of the domains to be looked upzwControls if SSSD should monitor the state of resolv.conf to identify when it needs to update its internal DNS resolver.z�SSSD monitors the state of resolv.conf to identify when it needs to update its internal DNS resolver. By default, we will attempt to use inotify for this, and will fall back to polling resolv.conf every five seconds if inotify cannot be used.z7Run PAC responder automatically for AD and IPA providerz4Enable or disable core dumps for all SSSD processes.z"Tune passkey verification behaviorz*Enumeration cache timeout length (seconds)z6Entry cache background update timeout length (seconds)z'Negative cache timeout length (seconds)z-Files negative cache timeout length (seconds)z(Users that SSSD should explicitly ignorez)Groups that SSSD should explicitly ignorez&Should filtered users appear in groupsz>The value of the password field the NSS provider should returnzAOverride homedir value from the identity provider with this valuezISubstitute empty homedir value from the identity provider with this valuez?Override shell value from the identity provider with this valuez3The list of shells users are allowed to log in withzLThe list of shells that will be vetoed, and replaced with the fallback shellzVIf a shell stored in central directory is allowed but not available, use this fallbackz.Shell to use if the provider does not list onez.How long will be in-memory cache records validz_Size (in megabytes) of the data table allocated inside fast in-memory cache for passwd requestsz^Size (in megabytes) of the data table allocated inside fast in-memory cache for group requestszcSize (in megabytes) of the data table allocated inside fast in-memory cache for initgroups requestsz�The value of this option will be used in the expansion of the override_homedir option if the template contains the format string %H.zTSpecifies time in seconds for which the list of subdomains will be considered valid.z�The entry cache can be set to automatically update entries in the background if they are requested beyond a percentage of the entry_cache_timeout value for the domain.z<How long to allow cached logins between online logins (days)z8How many failed logins attempts are allowed when offlinezUHow long (minutes) to deny login after offline_failed_login_attempts has been reachedzEWhat kind of messages are displayed to the user during authenticationz(Filter PAM responses sent to the pam_ssszEHow many seconds to keep identity information cached for PAM requestszFHow many days before password expiration a warning should be displayedz#List of trusted uids or user's namez4List of domains accessible even for untrusted users.z-Message printed when user account is expired.z,Message printed when user account is locked.z1Allow certificate based/Smartcard authentication.z2Path to certificate database with PKCS#11 modules.z5Tune certificate verification for PAM authentication.z:How many seconds will pam_sss wait for p11_child to finishz?Which PAM services are permitted to contact application domainsz%Allowed services for using smartcardsz2Additional timeout to wait for a card if requestedzMPKCS#11 URI to restrict the selection of devices for Smartcard authenticationz8When shall the PAM responder force an initgroups requestzBList of PAM services that are allowed to authenticate with GSSAPI.z3Whether to match authenticated UPN with target userzvList of pairs <PAM service>:<authentication indicator> that must be enforced for PAM access with GSSAPI authenticationz$Allow passkey device authentication.z>How many seconds will pam_sss wait for passkey_child to finishz(Enable debugging in the libfido2 libraryz;Whether to evaluate the time-based attributes in sudo rulesz;If true, SSSD will switch back to lower-wins ordering logiczfMaximum number of rules that can be refreshed at once. If this is exceeded, full refresh is performed.z@Whether to hash host names and addresses in the known_hosts filezZHow many seconds to keep a host in the known_hosts file after its host keys were requestedz*Path to storage of trusted CA certificatesz,Allow to generate ssh-keys from certificateszRUse the following matching rules to filter the certificates for ssh-key generationz>List of UIDs or user names allowed to access the PAC responderz)How long the PAC data is considered validzValidate the PACz:List of user attributes the InfoPipe is allowed to publishz�One of the following strings specifying the scope of session recording: none - No users are recorded. some - Users/groups specified by users and groups options are recorded. all - All users are recorded.z�A comma-separated list of users which should have session recording enabled. Matches user names as returned by NSS. I.e. after the possible space replacement, case changes, etc.z�A comma-separated list of groups, members of which should have session recording enabled. Matches group names as returned by NSS. I.e. after the possible space replacement, case changes, etc.zRA comma-separated list of users to be excluded from recording, only when scope=allzlA comma-separated list of groups, members of which should be excluded from recording, only when scope=all. zIdentity providerzAuthentication providerzAccess control providerzPassword change providerz SUDO providerzAutofs providerzHost identity providerzSELinux providerzSession management providerzResolver providerz9Whether the domain is usable by the OS or by applicationsz Enable or disable the domainzMinimum user IDzMaximum user IDz#Enable enumerating all users/groupsz#Cache credentials for offline loginz,Display users/groups in fully-qualified formz,Don't include group members in group lookupsz$Entry cache timeout length (seconds)zHRestrict or prefer a specific address family when performing DNS lookupszBHow long to keep cached entries after last successful login (days)zVHow long should SSSD talk to single DNS server before trying next server (miliseconds)zAHow long should keep trying to resolve single DNS query (seconds)zFHow long to wait for replies from DNS when resolving servers (seconds)z.The domain part of service discovery DNS queryz�Specifies the interval, in seconds, that SSSD waits before attempting to reconnect to the primary server after a successful connection to the backup serverz=Override GID value from the identity provider with this valuez!Treat usernames as case sensitivez;How often should expired entries be refreshed in backgroundzFMaximum period deviation when refreshing expired entries in backgroundz6Whether to automatically update the client's DNS entryzdWhether DNS update of A and AAAA record should be performed in one update or in two separate updatesz<The TTL to apply to the client's DNS entry after updating itz=The interface whose IP should be used for dynamic DNS updatesz7How often to periodically update the client's DNS entryz=Maximum period deviation when updating the client's DNS entryzDWhether the provider should explicitly update the PTR record as wellz8Whether the nsupdate utility should default to using TCPzDWhat kind of authentication should be used to perform the DNS updatez6Override the DNS server used to perform the DNS updatez<The file of the certificate authorities certificates for DoTz@The certificate(s) file for authentication for the DoT transportz?The key file for authenticated encryption for the DoT transportz&Control enumeration of trusted domainsz-How often should subdomains list be refreshedz;Maximum period deviation when refreshing the subdomain listz9List of options that should be inherited into a subdomainz Default subdomain homedir valuezAHow long can cached credentials be used for cached authenticationz8Whether to automatically create private groups for usersz5Display a warning N days before the password expires.zHVarious tags stored by the realmd configuration service for this domain.zmThe provider which should handle fetching of subdomains. This value should be always the same as id_provider.z]How many seconds to keep a host ssh key after refresh. IE how long to cache the host key for.z�If 2-Factor-Authentication (2FA) is used and credentials should be saved this value determines the minimal length the first authentication factor (long term password) must have to be saved as SHA512 hash into the cache.z$Local authentication methods policy z IPA domainzIPA server addressz Address of backup IPA serverzIPA client hostnamezAWhether to automatically update the client's DNS entry in FreeIPAz$Search base for HBAC related objectszKThe amount of time between lookups of the HBAC rules against the IPA serverzXThe amount of time in seconds between lookups of the SELinux maps against the IPA serverz;If set to false, host argument given by PAM will be ignoredz1The automounter location this IPA client is usingz7Search base for object containing info about IPA domainz7Search base for objects containing info about ID rangesz3Enable DNS sites - location based service discoveryz Search base for view containersz Objectclass for view containersz#Attribute with the name of the viewz Objectclass for override objectsz3Attribute with the reference to the original objectz%Objectclass for user override objectsz&Objectclass for group override objectsz/Search base for Desktop Profile related objectszaThe amount of time in seconds between lookups of the Desktop Profile rules against the IPA serverz�The amount of time in minutes between lookups of Desktop Profiles rules against the IPA server when the last request did not find any rulez Search base for SUBID rangesz5Which rules should be used to evaluate access controlz2The LDAP attribute that contains FQDN of the host.z)The object class of a host entry in LDAP.z5Use the given string as search base for host objects.z<The LDAP attribute that contains the host's SSH public keys.zAThe LDAP attribute that contains NIS domain name of the netgroup.zEThe LDAP attribute that contains the names of the netgroup's members.z^The LDAP attribute that lists FQDNs of hosts and host groups that are members of the netgroup.z\The LDAP attribute that lists hosts and host groups that are direct members of the netgroup.z5The LDAP attribute that lists netgroup's memberships.z^The LDAP attribute that lists system users and groups that are direct members of the netgroup.z9The LDAP attribute that corresponds to the netgroup name.z-The object class of a netgroup entry in LDAP.zJThe LDAP attribute that contains the UUID/GUID of an LDAP netgroup object.zNThe LDAP attribute that contains whether or not is user map enabled for usage.z=The LDAP attribute that contains host category such as 'all'.zPThe LDAP attribute that contains all hosts / hostgroups this rule match against.zLThe LDAP attribute that contains all users / groups this rule match against.z=The LDAP attribute that contains the name of SELinux usermap.zuThe LDAP attribute that contains DN of HBAC rule which can be used for matching instead of memberUser and memberHost.z<The LDAP attribute that contains SELinux user string itself.z=The LDAP attribute that contains user category such as 'all'.z;The LDAP attribute that contains unique ID of the user map.z�The option denotes that the SSSD is running on IPA server and should perform lookups of users and groups from trusted domains differently.z8Use the given string as search base for trusted domains.zActive Directory domainz Enabled Active Directory domainsz Active Directory server addressz&Active Directory backup server addressz Active Directory client hostnamez*LDAP filter to determine access privilegesz-Whether to use the Global Catalog for lookupsz+Operation mode for GPO-based access controlzPThe amount of time between lookups of the GPO policy files against the AD serverzQPAM service names that map to the GPO (Deny)InteractiveLogonRight policy settingszWPAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight policy settingszMPAM service names that map to the GPO (Deny)NetworkLogonRight policy settingszKPAM service names that map to the GPO (Deny)BatchLogonRight policy settingszMPAM service names that map to the GPO (Deny)ServiceLogonRight policy settingsz>PAM service names for which GPO-based access is always grantedz=PAM service names for which GPO-based access is always deniedzJDefault logon right (or permit/deny) to use for unmapped PAM service namesz*a particular site to be used by the clientzIMaximum age in days before the machine account password should be renewedz2Option for tuning the machine account renewal taskzDWhether to update the machine account password in the Samba databasez3Use LDAPS port for LDAP and Global Catalog requestsz4Do not filter domain local groups from other domainszKerberos server addressz Kerberos backup server addresszKerberos realmzAuthentication timeoutz Whether to create kdcinfo filesz"Where to drop krb5 config snippetsz$Directory to store credential cachesz'Location of the user's credential cachez.Location of the keytab to validate credentialsz Enable credential validationz9Store password if offline for later online authenticationz Renewable lifetime of the TGTzLifetime of the TGTz#Time between two checks for renewalz Enables FASTz%Selects the principal to use for FASTz0Use anonymous PKINIT to request FAST credentialsz"Enables principal canonicalizationz Enables enterprise principalsz5Enables using of subdomains realms for authenticationz5A mapping from user names to Kerberos principal nameszEServer where the change password service is running if not on the KDCz$ldap_uri, The URI of the LDAP serverz+ldap_backup_uri, The URI of the LDAP serverzThe default base DNz$How to read rootDSE from LDAP serverz2The Schema Type in use on the LDAP server, rfc2307z!Mode used to change user passwordzThe default bind DNz;The type of the authentication token of the default bind DNz/The authentication token of the default bind DNz$Length of time to attempt connectionz5Length of time to attempt synchronous LDAP operationsz:Length of time between attempts to reconnect while offlinez'Use only the upper case for realm namesz"File that contains CA certificatesz Path to CA certificate directoryz)File that contains the client certificatez!File that contains the client keyz List of possible ciphers suitesz$Require TLS certificate verificationz!Specify the sasl mechanism to usez(Specify the sasl authorization id to usez+Specify the sasl authorization realm to usez3Specify the minimal SSF for LDAP sasl authorizationz3Specify the maximal SSF for LDAP sasl authorizationzKerberos service keytabz%Use Kerberos auth for LDAP connectionzFollow LDAP referralsz#Lifetime of TGT for LDAP connectionzHow to dereference aliasesz$Service name for DNS service lookupsz8The number of records to retrieve in a single LDAP queryzBThe number of members that must be missing to trigger a full derefz!Ignore unreadable LDAP referencesziWhether the LDAP library should perform a reverse lookup to canonicalize the host name during a SASL bindzaAllows to retain local users as members of an LDAP group for servers that use the RFC2307 schema.zentryUSN attributezlastUSN attributezGHow long to retain a connection to the LDAP server before disconnectingz Disable the LDAP paging controlz(Disable Active Directory range retrievalz+Length of time to wait for a search requestz0Length of time to wait for a enumeration requestz*Length of time between enumeration updatesz4Maximum period deviation between enumeration updatesz%Length of time between cache cleanupsz-Maximum time deviation between cache cleanupszRequire TLS for ID lookupsz2Use ID-mapping of objectSID instead of pre-set IDszBase DN for user lookupszScope of user lookupszFilter for user lookupszObjectclass for userszUsername attributez UID attributezPrimary GID attributezGECOS attributezHome directory attributezShell attributezUUID attributezobjectSID attributez7Active Directory primary group attribute for ID-mappingz'User principal attribute (for Kerberos)z Full NamezmemberOf attributezModification time attributezshadowLastChange attributezshadowMin attributezshadowMax attributezshadowWarning attributezshadowInactive attributezshadowExpire attributezshadowFlag attributez)Attribute listing authorized PAM servicesz)Attribute listing authorized server hostsz*Attribute listing authorized server rhostszkrbLastPwdChange attributez krbPasswordExpiration attributezBAttribute indicating that server side password policies are activez accountExpires attribute of ADz"userAccountControl attribute of ADznsAccountLock attributez loginDisabled attribute of NDSz$loginExpirationTime attribute of NDSz$loginAllowedTimeMap attribute of NDSzSSH public key attributez9attribute listing allowed authentication types for a userz5attribute containing the X509 certificate of the userz2attribute containing the email address of the userz9attribute containing the passkey mapping data of the userz@A list of extra attributes to download along with the user entryzBase DN for group lookupszObjectclass for groupsz Group namezGroup passwordz GID attributezGroup member attributezGroup UUID attributez&Modification time attribute for groupsz!Type of the group and other flagsz(The LDAP group external member attributez&Maximum nesting level SSSD will followzFilter for group lookupszScope of group lookupsz Base DN for netgroup lookupszObjectclass for netgroupsz Netgroup namezNetgroups members attributezNetgroup triple attributez)Modification time attribute for netgroupszBase DN for service lookupszObjectclass for serviceszService name attributezService port attributezService protocol attributezLower bound for ID-mappingzUpper bound for ID-mappingz,Number of IDs for each slice when ID-mappingz/Use autorid-compatible algorithm for ID-mappingz)Name of the default domain for ID-mappingz(SID of the default domain for ID-mappingzNumber of secondary sliceszWhether to use Token-Groupsz7Set lower boundary for allowed IDs from the LDAP serverz7Set upper boundary for allowed IDs from the LDAP serverzDN for ppolicy queriesz;How many maximum entries to fetch during a wildcard requestzSet libldap debug levelz*Policy to evaluate the password expirationzCWhich attributes shall be used to evaluate if an account is expiredz8URI of an LDAP server where password changes are allowedz>URI of a backup LDAP server where password changes are allowedz0DNS service name for LDAP password change serverzTWhether to update the ldap_user_shadow_last_change attribute after a password changez Base DN for sudo rules lookupsz Automatic full refresh periodz Automatic smart refresh periodz$Smart and full refresh random offsetz=Whether to filter rules by hostname, IP addresses and networkzRHostnames and/or fully qualified domain names of this machine to filter sudo ruleszFIPv4 or IPv6 addresses or network of this machine to filter sudo ruleszAWhether to include rules that contains netgroup in host attributezKWhether to include rules that contains regular expression in host attributezObject class for sudo rulesz=Name of attribute that is used as object class for sudo ruleszSudo rule namezSudo rule command attributezSudo rule host attributezSudo rule user attributezSudo rule option attributezSudo rule runas attributez Sudo rule runasuser attributez Sudo rule runasgroup attributez Sudo rule notbefore attributez Sudo rule notafter attributezSudo rule order attributez!Object class for automounter mapsz Automounter map name attributez(Object class for automounter map entriesz#Automounter map entry key attributez%Automounter map entry value attributez#Base DN for automounter map lookupsz-The name of the automount master map in LDAP.z Base DN for IP hosts lookupszObject class for IP hostszIP host name attributez"IP host number (address) attributezIP host entryUSN attributez Base DN for IP networks lookupsz Object class for IP networkszIP network name attributez%IP network number (address) attributez IP network entryUSN attributez%Comma separated list of allowed usersz(Comma separated list of prohibited usersz�Comma separated list of groups that are allowed to log in. This applies only to groups within this SSSD domain. Local groups are not evaluated.z�Comma separated list of groups that are explicitly denied access. This applies only to groups within this SSSD domain. Local groups are not evaluated.z'The number of preforked proxy children.z"The name of the NSS library to usezAThe name of the NSS library to use for hosts and networks lookupsz>Whether to look up canonical group name from cache if possiblezPAM stack to usez Path of passwd file sources.zPath of group file sources.(� �debugZ debug_levelZdebug_timestampsZdebug_microsecondsZdebug_backtrace_enabled�timeoutZcommandZreconnection_retriesZfd_limitZclient_idle_timeoutZresponder_idle_timeoutZ cache_firstZoffline_timeoutZconfig_file_versionZservicesZdomainsZ re_expressionZfull_name_formatZkrb5_rcache_dirZdefault_domain_suffix�userZcertificate_verificationZoverride_spaceZdisable_netlinkZenable_files_domainZdomain_resolution_orderZmonitor_resolv_confZ try_inotifyZimplicit_pac_responderZ core_dumpableZpasskey_verificationZenum_cache_timeoutZentry_cache_no_wait_timeoutZentry_negative_timeoutZlocal_negative_timeoutZ filter_usersZ filter_groupsZfilter_users_in_groupsZpwfieldZoverride_homedirZfallback_homedirZoverride_shellZallowed_shellsZ vetoed_shellsZshell_fallbackZ default_shellZmemcache_timeoutZmemcache_size_passwdZmemcache_size_groupZmemcache_size_initgroupsZhomedir_substringZget_domains_timeoutZ entry_cache_nowait_percentageZ offline_credentials_expirationZ offline_failed_login_attemptsZoffline_failed_login_delayZ pam_verbosityZpam_response_filterZpam_id_timeoutZpam_pwd_expiration_warningZpam_trusted_usersZpam_public_domainsZpam_account_expired_messageZpam_account_locked_messageZ pam_cert_authZpam_cert_db_pathZpam_cert_verificationZp11_child_timeoutZpam_app_servicesZpam_p11_allowed_servicesZp11_wait_for_card_timeoutZp11_uriZpam_initgroups_schemeZpam_gssapi_servicesZpam_gssapi_check_upnZpam_gssapi_indicators_mapZpam_passkey_authZpasskey_child_timeoutZpasskey_debug_libfido2Z sudo_timedZsudo_inverse_orderZsudo_thresholdZautofs_negative_timeoutZssh_hash_known_hostsZssh_known_hosts_timeoutZca_dbZssh_use_certificate_keysZ"ssh_use_certificate_matching_rulesZ allowed_uidsZ pac_lifetimeZ pac_checkZuser_attributesZscopeZusers�groupsZ exclude_usersZexclude_groupsZ id_providerZ auth_providerZaccess_providerZchpass_providerZ sudo_providerZautofs_providerZhostid_providerZselinux_providerZsession_providerZresolver_providerZ domain_typeZenabledZmin_idZmax_id� enumerateZcache_credentialsZuse_fully_qualified_namesZignore_group_membersZentry_cache_timeoutZlookup_family_orderZaccount_cache_expirationZdns_resolver_server_timeoutZdns_resolver_op_timeoutZdns_resolver_timeoutZdns_discovery_domainZfailover_primary_timeoutZ override_gidZcase_sensitiveZentry_cache_user_timeoutZentry_cache_group_timeoutZ entry_cache_netgroup_timeoutZentry_cache_service_timeoutZentry_cache_autofs_timeoutZentry_cache_sudo_timeoutZ entry_cache_resolver_timeoutZrefresh_expired_intervalZ refresh_expired_interval_offsetZ dyndns_updateZdyndns_update_per_familyZ dyndns_ttlZ dyndns_ifaceZdyndns_refresh_intervalZ dyndns_refresh_interval_offsetZdyndns_update_ptrZdyndns_force_tcpZ dyndns_authZ dyndns_serverZdyndns_dot_cacertZdyndns_dot_certZdyndns_dot_keyZsubdomain_enumerateZsubdomain_refresh_intervalZ!subdomain_refresh_interval_offsetZsubdomain_inheritZsubdomain_homedirZcached_auth_timeoutZauto_private_groupsZpwd_expiration_warningZ realmd_tagsZsubdomains_providerZ entry_cache_ssh_host_timeoutZ-cache_credentials_minimal_first_factor_lengthZlocal_auth_policyZ ipa_domainZ ipa_serverZipa_backup_serverZ ipa_hostnameZipa_dyndns_updateZipa_dyndns_ttlZipa_dyndns_ifaceZipa_hbac_search_baseZipa_hbac_refreshZipa_selinux_refreshZipa_hbac_support_srchostZipa_automount_locationZ ipa_master_domain_search_baseZipa_ranges_search_baseZipa_enable_dns_sitesZipa_views_search_baseZipa_view_classZ ipa_view_nameZipa_override_object_classZipa_anchor_uuidZ ipa_user_override_object_classZ ipa_group_override_object_classZipa_deskprofile_search_baseZipa_deskprofile_refreshZ ipa_deskprofile_request_intervalZ ipa_subid_ranges_search_baseZipa_access_orderZ ipa_host_fqdnZipa_host_object_classZipa_host_search_baseZipa_host_ssh_public_keyZipa_netgroup_domainZipa_netgroup_memberZ ipa_netgroup_member_ext_hostZipa_netgroup_member_hostZipa_netgroup_member_ofZipa_netgroup_member_userZipa_netgroup_nameZipa_netgroup_object_classZipa_netgroup_uuidZipa_selinux_usermap_enabledZ!ipa_selinux_usermap_host_categoryZ ipa_selinux_usermap_member_hostZ ipa_selinux_usermap_member_userZipa_selinux_usermap_nameZ ipa_selinux_usermap_object_classZ ipa_selinux_usermap_see_alsoZ ipa_selinux_usermap_selinux_userZ!ipa_selinux_usermap_user_categoryZipa_selinux_usermap_uuidZipa_server_modeZipa_subdomains_search_baseZ ad_domainZad_enabled_domainsZ ad_serverZad_backup_serverZ ad_hostnameZad_enable_dns_sitesZad_access_filterZ ad_enable_gcZad_gpo_access_controlZad_gpo_cache_timeoutZad_gpo_map_interactiveZ ad_gpo_map_remote_interactiveZad_gpo_map_networkZad_gpo_map_batchZad_gpo_map_serviceZad_gpo_map_permitZad_gpo_map_denyZad_gpo_default_rightZad_siteZ'ad_maximum_machine_account_password_ageZ(ad_machine_account_password_renewal_optsZ(ad_update_samba_machine_account_passwordZ ad_use_ldapsZ#ad_allow_remote_domain_local_groupsZ krb5_kdcipZ krb5_serverZkrb5_backup_serverZ krb5_realmZkrb5_auth_timeoutZkrb5_use_kdcinfoZkrb5_confd_pathZkrb5_ccachedirZkrb5_ccname_templateZ krb5_keytabZ krb5_validateZ krb5_store_password_if_offlineZkrb5_renewable_lifetimeZ krb5_lifetimeZkrb5_renew_intervalZ krb5_use_fastZkrb5_fast_principalZ krb5_fast_use_anonymous_pkinitZkrb5_canonicalizeZ krb5_use_enterprise_principalZkrb5_use_subdomain_realmZ krb5_map_userZ krb5_kpasswdZkrb5_backup_kpasswdZldap_uriZldap_backup_uriZldap_search_baseZldap_read_rootdseZ ldap_schemaZldap_pwmodify_modeZldap_default_bind_dnZldap_default_authtok_typeZldap_default_authtokZldap_network_timeoutZldap_opt_timeoutZldap_offline_timeoutZldap_force_upper_case_realmZldap_tls_cacertZldap_tls_cacertdirZ ldap_tls_certZ ldap_tls_keyZldap_tls_cipher_suiteZldap_tls_reqcertZldap_sasl_mechZldap_sasl_authidZldap_sasl_realmZldap_sasl_minssfZldap_sasl_maxssfZldap_krb5_keytabZldap_krb5_init_credsZldap_referralsZldap_krb5_ticket_lifetimeZ ldap_derefZldap_dns_service_nameZldap_page_sizeZldap_deref_thresholdZ!ldap_ignore_unreadable_referencesZldap_sasl_canonicalizeZ$ldap_rfc2307_fallback_to_local_usersZldap_entry_usnZldap_rootdse_last_usnZ"ldap_connection_expiration_timeoutZldap_disable_pagingZ ldap_disable_range_retrievalZldap_search_timeoutZ ldap_enumeration_search_timeoutZ ldap_enumeration_refresh_timeoutZ ldap_enumeration_refresh_offsetZldap_purge_cache_timeoutZldap_purge_cache_offsetZldap_id_use_start_tlsZldap_id_mappingZldap_user_search_baseZldap_user_search_scopeZldap_user_search_filterZldap_user_object_classZldap_user_nameZldap_user_uid_numberZldap_user_gid_numberZldap_user_gecosZldap_user_home_directoryZldap_user_shellZldap_user_uuidZldap_user_objectsidZldap_user_primary_groupZldap_user_principalZldap_user_fullnameZldap_user_member_ofZldap_user_modify_timestampZ ldap_user_shadow_last_changeZldap_user_shadow_minZldap_user_shadow_maxZldap_user_shadow_warningZldap_user_shadow_inactiveZldap_user_shadow_expireZldap_user_shadow_flagZ ldap_user_authorized_serviceZldap_user_authorized_hostZldap_user_authorized_rhostZ ldap_user_krb_last_pwd_changeZ!ldap_user_krb_password_expirationZldap_pwd_attributeZ ldap_user_ad_account_expiresZ!ldap_user_ad_user_account_controlZldap_ns_account_lockZ ldap_user_nds_login_disabledZ#ldap_user_nds_login_expiration_timeZ$ldap_user_nds_login_allowed_time_mapZldap_user_ssh_public_keyZldap_user_auth_typeZldap_user_certificateZldap_user_emailZldap_user_passkeyZldap_user_extra_attrsZldap_group_search_baseZldap_group_object_classZldap_group_nameZldap_group_pwdZldap_group_gid_numberZldap_group_memberZldap_group_uuidZldap_group_objectsidZldap_group_modify_timestampZldap_group_typeZldap_group_external_memberZldap_group_nesting_levelZldap_group_search_filterZldap_group_search_scopeZldap_netgroup_search_baseZldap_netgroup_object_classZldap_netgroup_nameZldap_netgroup_memberZldap_netgroup_tripleZ ldap_netgroup_modify_timestampZldap_service_search_baseZldap_service_object_classZldap_service_nameZldap_service_portZldap_service_protoZldap_idmap_range_minZldap_idmap_range_maxZldap_idmap_range_sizeZldap_idmap_autorid_compatZldap_idmap_default_domainZ ldap_idmap_default_domain_sidZ ldap_idmap_helper_table_sizeZldap_use_tokengroupsZ ldap_min_idZ ldap_max_idZldap_pwdlockout_dnZwildcard_limitZldap_library_debug_levelZldap_pwd_policyZldap_access_filterZldap_account_expire_policyZldap_access_orderZldap_chpass_uriZldap_chpass_backup_uriZ ldap_chpass_dns_service_nameZ ldap_chpass_update_last_changeZldap_sudo_search_baseZ ldap_sudo_full_refresh_intervalZ ldap_sudo_smart_refresh_intervalZldap_sudo_random_offsetZldap_sudo_use_host_filterZldap_sudo_hostnamesZ ldap_sudo_ipZldap_sudo_include_netgroupsZldap_sudo_include_regexpZldap_sudorule_object_classZ ldap_sudorule_object_class_attrZldap_sudorule_nameZldap_sudorule_commandZldap_sudorule_hostZldap_sudorule_userZldap_sudorule_optionZldap_sudorule_runasZldap_sudorule_runasuserZldap_sudorule_runasgroupZldap_sudorule_notbeforeZldap_sudorule_notafterZldap_sudorule_orderZ ldap_autofs_map_object_classZldap_autofs_map_nameZ ldap_autofs_entry_object_classZldap_autofs_entry_keyZldap_autofs_entry_valueZldap_autofs_search_baseZldap_autofs_map_master_nameZldap_iphost_search_baseZldap_iphost_object_classZldap_iphost_nameZldap_iphost_numberZldap_iphost_entry_usnZldap_ipnetwork_search_baseZldap_ipnetwork_object_classZldap_ipnetwork_nameZldap_ipnetwork_numberZldap_ipnetwork_entry_usnZsimple_allow_usersZsimple_deny_usersZsimple_allow_groupsZsimple_deny_groupsZproxy_max_childrenZproxy_lib_nameZproxy_resolver_lib_nameZproxy_fast_aliasZproxy_pam_targetZ passwd_filesZ group_filesN)�__name__� __module__� __qualname__r �_�option_stringsr r r r r s� ������ � � � �r ) �sys�gettextZPACKAGEZ LOCALEDIR� translation� version_infor Zugettext�objectr r r r r �<module> s