AD auth help - sssd/realmd

[mjaco]

After configuring CentOS 7 to authenticate with AD using realmd (the preferred method now?), there are two things that I am having a hard time finding in the documentation:

1. Is there a way to restrict system access to a group using the realm command? In CentOS 6 I restrict access using /etc/pam.d/system-auth... I would like to simplify the configuration, but should I continue doing it that way?

2. I would like to be able to login without having to use the @domain "username@domain.com", is there any way to do this without using Samba?

Thanks in advance!

[mjaco]

Figured it out, here is what I missed if anyone else needs it...

1. realm permit -g group@example.com, don't know how I missed that.

2. add "default_domain_suffix = example.com" to sssd.conf