authselect

List available profiles

$ authselect list

$ authselect current

$ sudo authselect select sssd --force

$ sudo authselect select sssd with-fingerprint --force

$ sudo authselect select winbind --force

$ sudo authselect enable-feature with-mkhomedir

$ sudo authselect backup [backup-name]

$ sudo authselect backup-restore [backup-name]

authselect command [options]

authselect configures system authentication sources by managing PAM stack and nsswitch.conf files through predefined profiles. It replaced authconfig starting with Fedora 28 and RHEL 8.
Profiles define how users are authenticated and where identity information is retrieved. The sssd profile is most common for enterprise environments using LDAP, FreeIPA, or Active Directory. The winbind profile provides an alternative for Active Directory integration.
Authselect only configures PAM and nsswitch; it does not configure the underlying daemons (SSSD, Winbind). Use tools like realm join or ipa-client-install to set up domain membership, which automatically configure authselect.
Custom profiles can be created by copying and modifying existing profiles in /etc/authselect/custom/.

list

List available profiles

Display information about a profile

Show currently selected profile and features

Activate a profile with optional features

Enable a feature on the current profile

Disable a feature on the current profile

Backup current system configuration

Restore configuration from backup

List available backups

Remove authselect management of configuration

Overwrite existing non-authselect configuration

Create backup before making changes

Suppress output messages

sssd

System Security Services Daemon for LDAP, FreeIPA, Active Directory

Samba Winbind for direct Active Directory integration

Legacy Network Information Service compatibility

Local users and groups only (system files)

with-mkhomedir

Automatically create home directories on first login

Enable fingerprint authentication

Enable smart card authentication

Enable account lockout after failed attempts

Enable SSSD as source for sudo rules

Using --force is required when switching from manually configured systems. Do not modify authselect profiles configured by ipa-client-install or realm join. Changes to nsswitch.conf or PAM files outside authselect will be overwritten on profile changes.

authselect was developed by Red Hat and introduced in Fedora 28 (2018) as a replacement for authconfig. It was designed to provide a simpler, more maintainable approach to authentication configuration using predefined profiles rather than individual option flags. By Fedora 35, authconfig was fully removed, making authselect the standard tool.

sssd(8), pam(8), nsswitch.conf(5), realm(8)