# sss\_user and sss\_group

The `sss_user` and `sss_group` utilities are part of the SSSD (System Security Services Daemon) suite. They are used to query detailed information about users and groups from SSSD’s local cache, which aggregates identity and authentication data from remote sources such as LDAP or Active Directory.

## Overview

* **Purpose**:\
  These commands allow administrators to retrieve and review user and group attributes as stored in SSSD. This is especially useful for troubleshooting identity issues, auditing account details, and verifying that centralized authentication data is correctly cached on the local system.
* **Integration**:\
  They work in conjunction with SSSD, which is configured (via `/etc/sssd/sssd.conf`) to pull information from remote identity sources. This local cache is then used to resolve user and group information via the Name Service Switch (NSS).

## Usage

The typical syntax for the commands is as follows:

```bash
sss_user [OPTIONS] <username>
sss_group [OPTIONS] <groupname>
```

* **`sss_user`**: Displays detailed information for the specified user.
* **`sss_group`**: Displays detailed information for the specified group.

## Examples

1. **Querying a User**:\
   To display cached information for a user named `alice`:

   ```bash
   sss_user alice
   ```

   This command outputs details such as the user's UID, GID, home directory, and any additional attributes retrieved from the remote source.
2. **Querying a Group**:\
   To display details for a group named `developers`:

   ```bash
   sss_group developers
   ```

   This returns information about the group, including its GID and a list of its member users.

## Common Options

* **`-v` or `--verbose`**:\
  Display detailed output, providing additional information useful for debugging.
* **`--help`**:\
  Show a help message with usage details and available options.

## Integration with Other Tools

* **getent**:\
  In addition to using `sss_user` and `sss_group`, you can retrieve similar information using:

  ```bash
  getent passwd <username>
  getent group <groupname>
  ```

  These commands will query the NSS, which, if configured with SSSD (via `/etc/nsswitch.conf`), will return the same data.
* **sss\_cache and sssctl**:\
  Use these utilities to manage SSSD's cache and troubleshoot issues. For example, you might refresh the cache with:

  ```bash
  sss_cache -E
  ```

  or check the status of SSSD with:

  ```bash
  sssctl domain-list
  ```

## Troubleshooting

* **No Output or Incomplete Data**:
  * Ensure that SSSD is running:

    ```bash
    systemctl status sssd
    ```
  * Verify that your SSSD configuration in `/etc/sssd/sssd.conf` is correct and that the domains are properly defined.
  * Check the SSSD logs (usually in `/var/log/sssd/`) for error messages.
* **Inconsistencies**:\
  If user or group information appears outdated or incorrect, consider clearing the SSSD cache with:

  ```bash
  sss_cache -E
  ```

## Conclusion

The `sss_user` and `sss_group` utilities are valuable tools for administrators working in environments where SSSD is used for centralized identity management. They provide a direct way to query and verify the user and group information cached by SSSD, helping ensure that authentication and authorization processes function correctly across systems.
