AWS res documentation change
Summary
Added documentation for SSSD configuration parameters 'enumerate' and 'ldap_id_mapping'
Security assessment
Added explanations for security-adjacent SSSD settings affecting user enumeration and ID mapping, but no specific security vulnerability is addressed. Improves documentation of security-related configurations.
Diff
diff --git a/res/latest/ug/active-directory-sync.md b/res/latest/ug/active-directory-sync.md index 7ed523db0..35d953732 100644 --- a//res/latest/ug/active-directory-sync.md +++ b//res/latest/ug/active-directory-sync.md @@ -43 +43,12 @@ Administrators can filter the users or groups to sync using the **Users Filter** -Administrators can provide a dictionary of key-value pairs containing SSSD parameters and values to write to the `[domain_type/DOMAIN_NAME]` section of the SSSD config file on cluster instances. RES applies the SSSD updates automatically– it restarts the SSSD service on cluster instances and triggers the AD sync process. For a full description of the SSSD configuration file, see the Linux man pages for `SSSD`. +Administrators can provide a dictionary of key-value pairs containing SSSD parameters and values to write to the `[domain_type/DOMAIN_NAME]` section of the SSSD config file on cluster instances. RES applies the SSSD updates automatically– it restarts the SSSD service on cluster instances and triggers the AD sync process. + +Some common custom SSSD settings are: + + * `enumerate` \- Set to 'true' to cache all user and group entries from the directory service. Disabling this could add a short delay to users' first login. + + * `ldap_id_mapping` \- Set to 'true' to map LDAP/AD user and group IDs to local UIDs and GIDs on the Linux system. Enabling this can improve compatibility with existing POSIX scripts and applications. + + + + +For a full description of the SSSD configuration file, see the Linux man pages for `SSSD`. @@ -92 +103 @@ The Active Directory synchronization process has been moved from the Cluster Man - 5. Observe the logs of the running AD Sync task under **CloudWatch** → **Log Groups** → ``<environment-name>`/ad-sync`. You'll see logs from each of the running ECS tasks. Select the most recent to view the logs. + 5. Observe the logs of the running AD Sync task under **CloudWatch** → **Log Groups** → `/`<environment-name>`/ad-sync`. You'll see logs from each of the running ECS tasks. Select the most recent to view the logs.