Some AD provider option defaults are different from their default values mentioned in sssd-ldap or sssd-krb5 man pages. I am creating a general ticket for this under the assumption that there are other options i'm not aware of which differ but these two I came across myself during troubleshooting.

• krb5 provider example

  man sssd-krb5| grep -A5 krb5_validate

     krb5_validate (boolean)
         Verify with the help of krb5_keytab that the TGT obtained has not been spoofed. The keytab is checked for entries sequentially, and the first entry with a matching realm is used for validation. If no entry matches the
         realm, the last entry in the keytab is used. This process can be used to validate environments using cross-realm trust by placing the appropriate keytab entry as the last entry or the only entry in the keytab file.
  
         Default: false
  

  grep krb5_validate /var/log/sssd/sssd_AD.JSTEPHEN.log

  (Thu Oct 6 14:41:05 2016) [sssd[be[AD.JSTEPHEN]]] [dp_get_options] (0x0400): Option krb5_validate is TRUE

• ldap provider example

  man sssd-ldap| grep -A5 ldap_id_mapping

     ldap_id_mapping (boolean)
         Specifies that SSSD should attempt to map user and group IDs from the ldap_user_objectsid and ldap_group_objectsid attributes instead of relying on ldap_user_uid_number and ldap_group_gid_number.
  
         Currently this feature supports only ActiveDirectory objectSID mapping.
  
         Default: false
  

  grep 'ldap_id_mapping' /var/log/sssd/sssd_AD.JSTEPHEN.log

  (Thu Oct 6 14:41:05 2016) [sssd[be[AD.JSTEPHEN]]] [dp_get_options] (0x0400): Option ldap_id_mapping is TRUE

The 'ldap_id_mapping' example above is not the best example because the sssd-ad man page does discuss id mapping in some detail however there is nothing mentioned about krb5 validate in the sssd-ad man page.

Sumit suggested that we should add the different AD provider default value in the ldap/krb5 provider man page and also in the ad provider man page.

sbose| justin-time, the defaults are different in the plain krb5 and the AD provider. Would you mind to file a ticket to update the man page accordingly?
justin-tim| sbose: sure, should the option be added to the sssd-ad man page then or a conditional note in the sssd-krb5 man page?
sbose| justin-time, I guess best would be both, it would be redundant, but might help the user to find the information he is looking for.