support sssd configuration

Author: sjpb

ansible/.gitignore

@@ -58,4 +58,5 @@ roles/*
 !roles/squid/**
 !roles/tuned/
 !roles/tuned/**
-
+!roles/sssd/
+!roles/sssd/**

ansible/iam.yml

@@ -40,3 +40,12 @@
       import_role:
         name: freeipa
         tasks_from: users.yml
+
+- hosts: sssd
+  become: yes
+  gather_facts: no
+  tags: sssd
+  tasks:
+    - name: Configure sssd
+      import_role:
+        name: sssd

ansible/roles/sssd/README.md

@@ -0,0 +1,2 @@
+# sssd
+

ansible/roles/sssd/defaults/main.yml

@@ -0,0 +1,7 @@
+sssd_packages:
+  - sssd-common
+  - sssd-ldap # TODO: maybe should be in ldap role ??
+sssd_conf_src: "{{ appliances_environment_root }}/files/sssd.conf.j2"
+sssd_conf_dest: /etc/sssd/sssd.conf
+sssd_started: true
+sssd_enabled: true

ansible/roles/sssd/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: Restart sssd
+  service:
+    name: sssd
+    state: restarted
+  when: sssd_started | bool

ansible/roles/sssd/tasks/configure.yml

@@ -0,0 +1,16 @@
+- name: Write sssd.conf
+  template:
+    src: "{{ sssd_conf_src }}"
+    dest: "{{ sssd_conf_dest }}"
+    owner: root
+    group: root
+    mode: u=rw,go=
+  notify: "Restart sssd"
+
+- meta: flush_handlers
+
+- name: Ensure sssd service state
+  systemd:
+    name: sssd
+    state: "{{ 'started' if sssd_started | bool else 'stopped' }}"
+    enabled: "{{ true if sssd_enabled else false }}"

ansible/roles/sssd/tasks/install.yml

@@ -0,0 +1,3 @@
+- name: Install packages
+  dnf:
+    name: "{{ sssd_packages }}"

ansible/roles/sssd/tasks/main.yml

@@ -0,0 +1,2 @@
+- import_tasks: install.yml
+- import_tasks: configure.yml

environments/common/inventory/group_vars/builder/defaults.yml

@@ -22,3 +22,5 @@ squid_cache_disk: 0 # just needs to be defined
 squid_cache_mem: 0
 tuned_started: false
 tuned_enabled: false
+sssd_started: false
+sssd_enabled: false

environments/common/inventory/groups

@@ -134,4 +134,7 @@ freeipa_client
 # Hosts to run TuneD configuration
 
 [ansible_init]
-# Hosts to run linux-anisble-init
+# Hosts to run linux-anisble-init
+
+[sssd]
+# Hosts to configure sssd on