nss.attributes

Names the directory attribute each POSIX field is read from.

Key	Type	Default
nss.attributes.name	string	uid
nss.attributes.uid	string	uidNumber
nss.attributes.gid	string	gidNumber
nss.attributes.home	string	homeDirectory
nss.attributes.shell	string	loginShell
nss.attributes.group_name	string	cn
nss.attributes.group_gid	string	gidNumber
nss.attributes.group_member	string	memberUid
nss.attributes.gecos_attributes	list	displayName, cn

name

string, default uid

The account name, stored verbatim. A person can log in by their own name only when it equals their username claim. A preset from ldap.schema may set this.

nss:
  attributes:
    name: "uid"

uid

string, default uidNumber

The numeric user id; it must parse as an unsigned 32-bit number. Frozen once stored: a later change waits for an admin. A preset from ldap.schema may set this.

nss:
  attributes:
    uid: "uidNumber"

gid

string, default gidNumber

The numeric primary group id, before auto_private_groups is applied. Required unless auto_private_groups is true, where it is optional and only a supplementary group. Frozen once stored, like uid, except under auto_private_groups true, where it follows the directory. A preset from ldap.schema may set this.

nss:
  attributes:
    gid: "gidNumber"

home

string, default homeDirectory

The home directory; optional on the entry, absolute when present. An entry without one is served nss.default_home. A preset from ldap.schema may set this.

nss:
  attributes:
    home: "homeDirectory"

shell

string, default loginShell

The login shell; optional on the entry. A preset from ldap.schema may set this.

nss:
  attributes:
    shell: "loginShell"

group_name

string, default cn

A group’s name. A preset from ldap.schema may set this.

nss:
  attributes:
    group_name: "cn"

group_gid

string, default gidNumber

A group’s numeric gid. Frozen once stored, like uid. A preset from ldap.schema may set this.

nss:
  attributes:
    group_gid: "gidNumber"

group_member

string, default memberUid

Lists a group’s members. Whether its values are names or DNs is decided by the attribute’s name, case-insensitively: member and uniqueMember (RFC 2307bis, groupOfNames, groupOfUniqueNames) hold DNs, matched against the accounts’ DNs as DNs, so case and the spacing around separators do not matter (a uniqueMember’s optional #’…’B suffix is dropped); any other attribute, memberUid (RFC 2307) included, holds account names, matched byte for byte. A member that resolves to no account the sync has stored is left out. A preset from ldap.schema may set this.

nss:
  attributes:
    group_member: "memberUid"

gecos_attributes

list, default displayName, cn

The only attributes nss.gecos_template may read, in order of preference for .DisplayName. Anything else on the entry (userPassword, sshPublicKey, description) cannot reach a field every local user can read with getent unless it is listed here on purpose. At least one is required.

nss:
  attributes:
    gecos_attributes: [displayName, cn]