feat: Add SSSD parameters support

README.md

@@ -204,6 +204,18 @@ Useful if some specific configuration like --user-principal=host/name@REALM or -
 See man realm for details.
 Example: ad_integration_join_parameters: "--user-principal host/[email protected]"
 
+#### ad_integration_sssd_settings
+
+A list of setting to be included into the `[sssd]` section
+of the sssd.conf file. See sssd.conf man pages for details.
+Example:
+
+```yaml
+ad_integration_sssd_settings:
+  - key: "configuration_name"
+    value: "configuration_value"
+```
+
 #### ad_integration_sssd_custom_settings
 
 A list of custom setting to be included into the `[domain/$REALM]` section

tasks/main.yml

@@ -197,6 +197,20 @@
   changed_when: not __realm_join_output.stderr is
     search("Already joined to this domain")
 
+- name: Configure SSSD settings
+  community.general.ini_file:
+    path: /etc/sssd/sssd.conf
+    state: "{{ item.state | default('present') }}"
+    section: "sssd"
+    option: "{{ item.key }}"
+    value: "{{ item.value }}"
+    create: true
+    owner: root
+    group: root
+    mode: u=rw,g=,o=
+  loop: "{{ ad_integration_sssd_settings }}"
+  notify: Handler for ad_integration to restart services
+
 - name: Configure dynamic DNS updates
   community.general.ini_file:
     path: /etc/sssd/sssd.conf

tests/tests_sssd_settings.yml

@@ -0,0 +1,72 @@
+# SPDX-License-Identifier: MIT
+---
+
+- name: Ensure that the role configures dynamic dns
+  hosts: all,!ad
+  gather_facts: false  # test that role works in this case
+  vars:
+    ad_integration_realm: sample-realm.com
+    __ad_integration_test_sssd_config_only: true
+    ad_integration_sssd_settings:
+      - key: reconnection_retries 
+        value: 5
+      - key: default_domain_suffix
+        value: addomain.xyz
+
+  tasks:
+    - name: Test - Run the system role with bogus vars
+      include_role:
+        name: linux-system-roles.ad_integration
+
+    - name: Check SSSD settings
+      community.general.ini_file:
+        path: /etc/sssd/sssd.conf
+        state: "{{ item.state | default('present') }}"
+        section: sssd
+        option: "{{ item.key }}"
+        value: "{{ item.value }}"
+        create: true
+        owner: root
+        group: root
+        mode: u=rw,g=,o=
+      loop: "{{ ad_integration_sssd_settings }}"
+      register: __result
+      failed_when: __result is changed
+
+    - name: Search /var/log/sssd/sssd.log for [sss_ini_call_validators]
+      command: >-
+        grep -i sss_ini_call_validators /var/log/sssd/sssd.log
+      register: sssd_log
+      changed_when: false
+      failed_when: false
+
+    - name: Fail if signature found
+      fail:
+        msg: Appears to be an unsupported option in /etc/sssd/sssd.conf
+      when: sssd_log.stdout | length > 0
+
+    - name: Test - Re-Build a list of settings with state=absent
+      set_fact:
+        update_list: "{{ ad_integration_sssd_settings |
+          map('combine', {'state': 'absent'}) | list }}"
+
+    - name: Test - Re-run the system role to remove vars
+      include_role:
+        name: linux-system-roles.ad_integration
+      vars:
+        ad_integration_sssd_custom_settings: "{{ update_list }}"
+
+    - name: Check custom SSSD settings
+      community.general.ini_file:
+        path: /etc/sssd/sssd.conf
+        state: "{{ item.state | default('present') }}"
+        section: sssd
+        option: "{{ item.key }}"
+        value: "{{ item.value }}"
+        create: true
+        owner: root
+        group: root
+        mode: u=rw,g=,o=
+      loop: "{{ update_list }}"
+      register: __result
+      failed_when: __result is changed