[rule/allowed_sections]

validator = ini_allowed_sections

section = sssd

section = nss

section = pam

section = sudo

section = autofs

section = ssh

section = pac

section = ifp

section_re = ^secrets\(/users/\([0-9]\+\)\?\)\?$

section_re = ^domain/.*$

[rule/allowed_sssd_options]

validator = ini_allowed_options

section_re = ^sssd$

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# Monitor service

option = services

option = domains

option = timeout

option = sbus_timeout

option = re_expression

option = full_name_format

option = krb5_rcache_dir

option = user

option = default_domain_suffix

option = certificate_verification

option = override_space

option = config_file_version

option = disable_netlink

[rule/allowed_nss_options]

validator = ini_allowed_options

section_re = ^nss$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# Name service

option = user_attributes

option = enum_cache_timeout

option = entry_cache_nowait_percentage

option = entry_negative_timeout

option = local_negative_timeout

option = filter_users

option = filter_groups

option = filter_users_in_groups

option = pwfield

option = override_homedir

option = fallback_homedir

option = homedir_substring

option = override_shell

option = allowed_shells

option = vetoed_shells

option = shell_fallback

option = default_shell

option = get_domains_timeout

option = memcache_timeout

[rule/allowed_pam_options]

validator = ini_allowed_options

section_re = ^pam$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# Authentication service

option = offline_credentials_expiration

option = offline_failed_login_attempts

option = offline_failed_login_delay

option = pam_verbosity

option = pam_response_filter

option = pam_id_timeout

option = pam_pwd_expiration_warning

option = get_domains_timeout

option = pam_trusted_users

option = pam_public_domains

option = pam_account_expired_message

option = pam_account_locked_message

option = pam_cert_auth

option = pam_cert_db_path

option = p11_child_timeout

[rule/allowed_sudo_options]

validator = ini_allowed_options

section_re = ^sudo$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# sudo service

option = sudo_timed

option = sudo_inverse_order

[rule/allowed_autofs_options]

validator = ini_allowed_options

section_re = ^autofs$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# autofs service

option = autofs_negative_timeout

[rule/allowed_ssh_options]

validator = ini_allowed_options

section_re = ^ssh$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# ssh service

option = ssh_hash_known_hosts

option = ssh_known_hosts_timeout

option = ca_db

[rule/allowed_pac_options]

validator = ini_allowed_options

section_re = ^pac$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# PAC responder

option = allowed_uids

option = pac_lifetime

[rule/allowed_ifp_options]

validator = ini_allowed_options

section_re = ^ifp$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# InfoPipe responder

option = allowed_uids

option = user_attributes

[rule/allowed_sec_options]

validator = ini_allowed_options

section_re = ^secrets\(/users/\([0-9]\+\)\?\)\?$

option = timeout

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

# Secrets service

option = provider

option = containers_nest_level

option = max_secrets

# Secrets service - proxy

option = proxy_url

option = auth_type

option = auth_header_name

option = auth_header_value

option = forward_headers

option = username

option = password

[rule/allowed_domain_options]

validator = ini_allowed_options

section_re = ^domain/.*$

option = debug

option = debug_level

option = debug_timestamps

option = debug_microseconds

option = debug_to_files

option = command

option = reconnection_retries

option = fd_limit

option = client_idle_timeout

option = description

#Available provider types

option = id_provider

option = auth_provider

option = access_provider

option = chpass_provider

option = sudo_provider

option = autofs_provider

option = hostid_provider

option = subdomains_provider

option = selinux_provider

# Options available to all domains

option = min_id

option = max_id

option = timeout

option = try_inotify

option = enumerate

option = subdomain_enumerate

option = offline_timeout

option = cache_credentials

option = cache_credentials_minimal_first_factor_length

option = store_legacy_passwords

option = use_fully_qualified_names

option = ignore_group_members

option = entry_cache_timeout

option = lookup_family_order

option = account_cache_expiration

option = pwd_expiration_warning

option = filter_users

option = filter_groups

option = dns_resolver_timeout

option = dns_discovery_domain

option = override_gid

option = case_sensitive

option = override_homedir

option = fallback_homedir

option = homedir_substring

option = override_shell

option = default_shell

option = description

option = realmd_tags

option = subdomain_refresh_interval

option = subdomain_inherit

option = cached_auth_timeout

option = wildcard_limit

option = full_name_format

option = re_expression

#Entry cache timeouts

option = entry_cache_user_timeout

option = entry_cache_group_timeout

option = entry_cache_netgroup_timeout

option = entry_cache_service_timeout

option = entry_cache_autofs_timeout

option = entry_cache_sudo_timeout

option = entry_cache_ssh_host_timeout

option = refresh_expired_interval

# Dynamic DNS updates

option = dyndns_update

option = dyndns_ttl

option = dyndns_iface

option = dyndns_refresh_interval

option = dyndns_update_ptr

option = dyndns_force_tcp

option = dyndns_auth

option = dyndns_server

# local provider specific options

option = create_homedir

option = remove_homedir

option = homedir_umask

option = skel_dir

option = mail_dir

option = userdel_cmd

option = base_directory

# proxy provider specific options

option = proxy_lib_name

option = proxy_fast_alias

option = proxy_pam_target

option = proxy_max_children

# simple access provider specific options

option = simple_allow_users

option = simple_deny_users

option = simple_allow_groups

option = simple_deny_groups

# AD provider specific options

option = ad_access_filter

option = ad_backup_server

option = ad_domain

option = ad_enable_dns_sites

option = ad_enabled_domains

option = ad_enable_gc

option = ad_gpo_access_control

option = ad_gpo_cache_timeout

option = ad_gpo_default_right

option = ad_gpo_map_batch

option = ad_gpo_map_deny

option = ad_gpo_map_interactive

option = ad_gpo_map_network

option = ad_gpo_map_permit

option = ad_gpo_map_remote_interactive

option = ad_gpo_map_service

option = ad_hostname

option = ad_machine_account_password_renewal_opts

option = ad_maximum_machine_account_password_age

option = ad_server

option = ad_site

# IPA provider specific options

option = ipa_anchor_uuid

option = ipa_automount_location

option = ipa_backup_server

option = ipa_domain

option = ipa_dyndns_iface

option = ipa_dyndns_ttl

option = ipa_dyndns_update

option = ipa_enable_dns_sites

option = ipa_group_override_object_class

option = ipa_hbac_refresh

option = ipa_hbac_search_base

option = ipa_hbac_support_srchost

option = ipa_host_fqdn

option = ipa_hostgroup_memberof

option = ipa_hostgroup_member

option = ipa_hostgroup_name

option = ipa_hostgroup_objectclass

option = ipa_hostgroup_uuid

option = ipa_host_member_of

option = ipa_host_name

option = ipa_hostname

option = ipa_host_object_class

option = ipa_host_search_base

option = ipa_host_serverhostname

option = ipa_host_ssh_public_key

option = ipa_host_uuid

option = ipa_master_domain_search_base

option = ipa_netgroup_domain

option = ipa_netgroup_member_ext_host

option = ipa_netgroup_member_host

option = ipa_netgroup_member_of

option = ipa_netgroup_member

option = ipa_netgroup_member_user

option = ipa_netgroup_name

option = ipa_netgroup_object_class

option = ipa_netgroup_uuid

option = ipa_overide_object_class

option = ipa_ranges_search_base

option = ipa_selinux_refresh

option = ipa_selinux_usermap_enabled

option = ipa_selinux_usermap_host_category

option = ipa_selinux_usermap_member_host

option = ipa_selinux_usermap_member_user

option = ipa_selinux_usermap_name

option = ipa_selinux_usermap_object_class

option = ipa_selinux_usermap_see_also

option = ipa_selinux_usermap_selinux_user

option = ipa_selinux_usermap_user_category

option = ipa_selinux_usermap_uuid

option = ipa_server_mode

option = ipa_server

option = ipa_subdomains_search_base

option = ipa_sudocmdgroup_entry_usn

option = ipa_sudocmdgroup_member

option = ipa_sudocmdgroup_name

option = ipa_sudocmdgroup_object_class

option = ipa_sudocmdgroup_uuid

option = ipa_sudocmd_memberof

option = ipa_sudocmd_object_class

option = ipa_sudocmd_sudoCmd

option = ipa_sudocmd_uuid

option = ipa_sudorule_allowcmd

option = ipa_sudorule_cmdcategory

option = ipa_sudorule_denycmd

option = ipa_sudorule_enabled_flag

option = ipa_sudorule_entry_usn

option = ipa_sudorule_externaluser

option = ipa_sudorule_hostcategory

option = ipa_sudorule_host

option = ipa_sudorule_name

option = ipa_sudorule_notafter

option = ipa_sudorule_notbefore

option = ipa_sudorule_object_class

option = ipa_sudorule_option

option = ipa_sudorule_runasextgroup

option = ipa_sudorule_runasextusergroup

option = ipa_sudorule_runasextuser

option = ipa_sudorule_runasgroupcategory

option = ipa_sudorule_runasgroup

option = ipa_sudorule_runasusercategory

option = ipa_sudorule_sudoorder

option = ipa_sudorule_usercategory

option = ipa_sudorule_user

option = ipa_sudorule_uuid

option = ipa_user_override_object_class

option = ipa_view_class

option = ipa_view_name

option = ipa_views_search_base

# krb5 provider specific options

option = krb5_auth_timeout

option = krb5_backup_kpasswd

option = krb5_backup_server

option = krb5_canonicalize

option = krb5_ccachedir

option = krb5_ccname_template

option = krb5_confd_path

option = krb5_fast_principal

option = krb5_kdcip

option = krb5_keytab

option = krb5_kpasswd

option = krb5_lifetime

option = krb5_map_user

option = krb5_realm

option = krb5_realm

option = krb5_renewable_lifetime

option = krb5_renew_interval

option = krb5_server

option = krb5_store_password_if_offline

option = krb5_use_enterprise_principal

option = krb5_use_fast

option = krb5_use_kdcinfo

option = krb5_validate

# ldap provider specific options

option = ldap_access_filter

option = ldap_access_order

option = ldap_account_expire_policy

option = ldap_autofs_entry_key

option = ldap_autofs_entry_object_class

option = ldap_autofs_entry_value

option = ldap_autofs_map_master_name

option = ldap_autofs_map_name

option = ldap_autofs_map_object_class

option = ldap_autofs_search_base

option = ldap_backup_uri

option = ldap_chpass_backup_uri

option = ldap_chpass_dns_service_name

option = ldap_chpass_update_last_change

option = ldap_chpass_uri

option = ldap_connection_expire_timeout

option = ldap_default_authtok

option = ldap_default_authtok_type

option = ldap_default_bind_dn

option = ldap_deref

option = ldap_deref_threshold

option = ldap_disable_paging

option = ldap_disable_range_retrieval

option = ldap_dns_service_name

option = ldap_entry_usn

option = ldap_enumeration_refresh_timeout

option = ldap_enumeration_search_timeout

option = ldap_force_upper_case_realm

option = ldap_group_entry_usn

option = ldap_group_external_member

option = ldap_group_gid_number

option = ldap_group_member

option = ldap_group_modify_timestamp

option = ldap_group_name

option = ldap_group_nesting_level

option = ldap_group_object_class

option = ldap_group_objectsid

option = ldap_group_search_base

option = ldap_group_search_filter

option = ldap_group_search_scope

option = ldap_groups_use_matching_rule_in_chain

option = ldap_group_type

option = ldap_group_uuid

option = ldap_idmap_autorid_compat

option = ldap_idmap_default_domain_sid

option = ldap_idmap_default_domain

option = ldap_idmap_helper_table_size

option = ldap_id_mapping

option = ldap_idmap_range_max

option = ldap_idmap_range_min

option = ldap_idmap_range_size

option = ldap_id_use_start_tls

option = ldap_initgroups_use_matching_rule_in_chain

option = ldap_krb5_init_creds

option = ldap_krb5_keytab

option = ldap_krb5_ticket_lifetime

option = ldap_max_id

option = ldap_min_id

option = ldap_netgroup_member

option = ldap_netgroup_modify_timestamp

option = ldap_netgroup_name

option = ldap_netgroup_object_class

option = ldap_netgroup_search_base

option = ldap_netgroup_triple

option = ldap_network_timeout

option = ldap_ns_account_lock

option = ldap_offline_timeout

option = ldap_opt_timeout

option = ldap_page_size

option = ldap_purge_cache_timeout

option = ldap_pwd_attribute

option = ldap_pwdlockout_dn

option = ldap_pwd_policy

option = ldap_referrals

option = ldap_rfc2307_fallback_to_local_users

option = ldap_rootdse_last_usn

option = ldap_sasl_authid

option = ldap_sasl_canonicalize

option = ldap_sasl_mech

option = ldap_sasl_minssf

option = ldap_schema

option = ldap_search_base

option = ldap_search_timeout

option = ldap_service_entry_usn

option = ldap_service_name

option = ldap_service_object_class

option = ldap_service_port

option = ldap_service_proto

option = ldap_service_search_base

option = ldap_sudo_full_refresh_interval

option = ldap_sudo_hostnames

option = ldap_sudo_include_netgroups

option = ldap_sudo_include_regexp

option = ldap_sudo_ip

option = ldap_sudorule_command

option = ldap_sudorule_host

option = ldap_sudorule_name

option = ldap_sudorule_notafter

option = ldap_sudorule_notbefore

option = ldap_sudorule_object_class

option = ldap_sudorule_option

option = ldap_sudorule_order

option = ldap_sudorule_runasgroup

option = ldap_sudorule_runas

option = ldap_sudorule_runasuser

option = ldap_sudorule_user

option = ldap_sudo_search_base

option = ldap_sudo_smart_refresh_interval

option = ldap_sudo_use_host_filter

option = ldap_tls_cacertdir

option = ldap_tls_cacert

option = ldap_tls_cert

option = ldap_tls_cipher_suite

option = ldap_tls_key

option = ldap_tls_reqcert

option = ldap_uri

option = ldap_user_ad_account_expires

option = ldap_user_ad_user_account_control

option = ldap_user_authorized_host

option = ldap_user_authorized_service

option = ldap_user_auth_type

option = ldap_user_certificate

option = ldap_user_email

option = ldap_user_entry_usn

option = ldap_user_extra_attrs

option = ldap_user_fullname

option = ldap_user_gecos

option = ldap_user_gid_number

option = ldap_user_home_directory

option = ldap_user_krb_last_pwd_change

option = ldap_user_krb_password_expiration

option = ldap_user_member_of

option = ldap_user_modify_timestamp

option = ldap_user_name

option = ldap_user_nds_login_allowed_time_map

option = ldap_user_nds_login_disabled

option = ldap_user_nds_login_expiration_time

option = ldap_user_object_class

option = ldap_user_objectsid

option = ldap_user_primary_group

option = ldap_user_principal

option = ldap_user_search_base

option = ldap_user_search_filter

option = ldap_user_search_scope

option = ldap_user_shadow_expire

option = ldap_user_shadow_flag

option = ldap_user_shadow_inactive

option = ldap_user_shadow_last_change

option = ldap_user_shadow_max

option = ldap_user_shadow_min

option = ldap_user_shadow_warning

option = ldap_user_shell

option = ldap_user_ssh_public_key

option = ldap_user_uid_number

option = ldap_user_uuid

option = ldap_use_tokengroups