feat: Add sssd custom settings

README.md

@@ -207,6 +207,19 @@ Useful if some specific configuration like --user-principal=host/name@REALM or -
 See man realm for details.
 Example: ad_integration_join_parameters: "--user-principal host/[email protected]"
 
+
+#### ad_integration_sssd_custom_settings
+
+A list of custom setting to be included into the [domain/<REALM>] section
+of the sssd.conf file. See sssd.conf man pages for details.
+
+Example:
+```yaml
+ad_integration_sssd_custom_settings:
+ - key: "configuration_name"
+   value: "configuration_value"
+```
+
 ## Example Playbook
 
 The following is an example playbook to setup direct Active Directory integration with AD domain `domain.example.com`, the join will be performed with user Administrator using the vault stored password. Prior to the join, the crypto policy for AD SUPPORT with RC4 encryption allowed will be set.

defaults/main.yml

@@ -130,3 +130,9 @@ ad_dyndns_server: null
 # Any additional parameters passed to realm join command
 # Useful for passing things like --user-principal etc.
 ad_integration_join_parameters: ""
+
+# A list of custom setting to be included into the [domain/<REALM>] section
+# of the sssd.conf file. The list will be composed of two entry:
+# - key: "configuration_name"
+#   value: "configuration_value"
+ad_integration_sssd_custom_settings: []

tasks/main.yml

@@ -196,7 +196,7 @@
     search("Already joined to this domain")
 
 - name: Configure dynamic DNS updates
-  ini_file:
+  community.general.ini_file:
     path: /etc/sssd/sssd.conf
     state: present
     section: "domain/{{ ad_integration_realm | lower }}"
@@ -205,7 +205,7 @@
     create: true
     owner: root
     group: root
-    mode: 0600
+    mode: u=rw,g=,o=
   loop:
     - key: dyndns_update
       value: "{{ ad_dyndns_update | string }}"
@@ -237,6 +237,20 @@
     - item.value != ''
   notify: Handler for ad_integration to restart services
 
+- name: Configure custom SSSD settings
+  community.general.ini_file:
+    path: /etc/sssd/sssd.conf
+    state: "{{ item.state | default('present') }}"
+    section: "domain/{{ ad_integration_realm | lower }}"
+    option: "{{ item.key }}"
+    value: "{{ item.value }}"
+    create: true
+    owner: root
+    group: root
+    mode: u=rw,g=,o=
+  loop: "{{ ad_integration_sssd_custom_settings }}"
+  notify: Handler for ad_integration to restart services
+
 # If dyndns_iface and/or dyndns_server previously had a configured value but are
 # now being set to `none` or `''`, remove the options form sssd.conf so sssd
 # will determine the default values.
@@ -248,7 +262,7 @@
     option: "{{ item.key }}"
     owner: root
     group: root
-    mode: 0600
+    mode: u=rw,g=,o=
   loop:
     - key: dyndns_iface
       value: "{{ '' if ad_dyndns_iface is none else ad_dyndns_iface }}"

tests/tests_sssd_custom_setttings.yml

@@ -0,0 +1,98 @@
+# SPDX-License-Identifier: MIT
+---
+
+- name: Ensure that the role configures dynamic dns
+  hosts: all,!ad
+  gather_facts: false  # test that role works in this case
+  vars:
+    ad_integration_sssd_custom_settings:
+      - key: "auth_provider_test"
+        value: "ad"
+      - key: "override_shell_test"
+        value: "/bin/bash"
+
+  tasks:
+    - name: Test - Run the system role with bogus vars
+      ansible.builtin.include_role:
+        name: linux-system-roles.ad_integration
+
+    - name: Test - Verify sssd.conf custom settings were written
+      block:
+        - name: Copy sssd.conf file from host to local /tmp/
+          ansible.builtin.fetch:
+            src: /etc/sssd/sssd.conf
+            dest: /tmp/
+            flat: true
+          changed_when: false
+        - name: Assert sssd.conf options were written
+          ansible.builtin.assert:
+            that:
+              - "{{ lookup('ini', item.key, section='domain/' +
+                ad_integration_realm | lower, file='/tmp/sssd.conf') | tojson }}
+                == {{ item.value | tojson }}"
+          loop: "{{ ad_integration_sssd_custom_settings }}"
+        - name: Remove /tmp/sssd.conf
+          ansible.builtin.file:
+            path: /tmp/sssd.conf
+            state: absent
+          changed_when: false
+
+    - name: Test - Check sssd.log for unsupported options
+      block:
+        - name: Search /var/log/sssd/sssd.log for [sss_ini_call_validators]
+          # noqa: command-instead-of-shell
+          ansible.builtin.command: |
+            grep -i sss_ini_call_validators /var/log/sssd/sssd.log
+          register: sssd_log
+          changed_when: false
+          failed_when: false
+        - name: Fail if signature found
+          ansible.builtin.fail:
+            msg: Appears to be an unsupported option in /etc/sssd/sssd.conf
+          when: sssd_log.stdout | length > 0
+
+    - name: Test - Re-Build a list of settings with state=absent
+      ansible.builtin.set_fact:
+        update_list: "{{ update_list + update }}"
+      loop: "{{ ad_integration_sssd_custom_settings }}"
+      loop_control:
+        index_var: idx
+      vars:
+        update_list: []
+        update:
+          - key: "{{ item['key'] }}"
+            value: "{{ item['value'] }}"
+            state: absent
+
+    - name: Test - Re-run the system role to remove vars
+      block:
+        - name: Rerun system role
+          ansible.builtin.include_role:
+            name: linux-system-roles.ad_integration
+          vars:
+            ad_integration_sssd_custom_settings: "{{ update_list }}"
+        - name: Restart sssd
+          ansible.builtin.service:
+            name: sssd
+            state: restarted
+
+    - name: Test - Verify sssd.conf options were removed
+      block:
+        - name: Copy sssd.conf file from host to local /tmp/
+          ansible.builtin.fetch:
+            src: /etc/sssd/sssd.conf
+            dest: /tmp/
+            flat: true
+          changed_when: false
+        - name: Assert sssd.conf options were removed
+          ansible.builtin.assert:
+            that:
+              - "{{ lookup('ini', item.key, default='removed',
+                section='domain/' + ad_integration_realm | lower,
+                file='/tmp/sssd.conf') | tojson }} == {{ 'removed' | tojson }}"
+          loop: "{{ ad_integration_sssd_custom_settings }}"
+        - name: Remove /tmp/sssd.conf
+          ansible.builtin.file:
+            path: /tmp/sssd.conf
+            state: absent
+          changed_when: false