sssd

pdk
Install and configure SSSD

sgnl05

sgnl05

662,417 downloads

7,973 latest version

5.0 quality score

Version information

  • 3.1.0 (latest)
  • 3.0.0
  • 2.13.1
  • 2.13.0
  • 2.12.0
  • 2.11.0
  • 2.10.1
  • 2.10.0
  • 2.9.0
  • 2.8.0
  • 2.7.0
  • 2.6.0
  • 2.5.0
  • 2.4.1
  • 2.4.0
  • 2.3.0
  • 2.2.2
  • 2.2.1
  • 2.2.0
  • 2.1.0
  • 2.0.0
  • 1.0.1
  • 1.0.0
  • 0.4.1
  • 0.4.0
  • 0.3.1
  • 0.3.0
  • 0.2.1
  • 0.2.0
  • 0.1.4
  • 0.1.3
  • 0.1.2
  • 0.1.1
  • 0.1.0
released Jan 28th 2020
This version is compatible with:
  • Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x
  • Puppet >= 5.5.10 < 7.0.0
  • Amazon
    ,
    RedHat
    ,
    CentOS
    ,
    Fedora
    ,
    Gentoo
    ,
    OracleLinux
    ,
    Ubuntu
    ,
    Debian
    ,
    Suse

Start using this module

Documentation

sgnl05/sssd — version 3.1.0 Jan 28th 2020

sssd

Build Status Puppet Forge Puppet Forge Downloads Puppet Forge Score

Table of Contents

  1. Overview
  2. Usage - Configuration options and additional functionality
  3. Limitations - OS compatibility, etc.
  4. Credits

Overview

This module installs and configures SSSD (System Security Services Daemon)

SSSD is used to provide access to identity and authentication remote resource through a common framework that can provide caching and offline support to the system.

Documented with Puppet Strings

Puppet Strings documentation

Usage

Example configuration:

class {'::sssd':
  config => {
    'sssd' => {
      'domains'             => 'ad.example.com',
      'config_file_version' => 2,
      'services'            => ['nss', 'pam'],
    },
    'domain/ad.example.com' => {
      'ad_domain'                      => 'ad.example.com',
      'ad_server'                      => ['server01.ad.example.com', 'server02.ad.example.com'],
      'krb5_realm'                     => 'AD.EXAMPLE.COM',
      'realmd_tags'                    => 'joined-with-samba',
      'cache_credentials'              => true,
      'id_provider'                    => 'ad',
      'krb5_store_password_if_offline' => true,
      'default_shell'                  => '/bin/bash',
      'ldap_id_mapping'                => false,
      'use_fully_qualified_names'      => false,
      'fallback_homedir'               => '/home/%d/%u',
      'access_provider'                => 'simple',
      'simple_allow_groups'            => ['admins', 'users'],
    }
  }
}

...or the same config in Hiera:

sssd::config:
  'sssd':
    'domains': 'ad.example.com'
    'config_file_version': 2
    'services':
      - 'nss'
      - 'pam'
  'domain/ad.example.com':
    'ad_domain': 'ad.example.com'
    'ad_server':
      - 'server01.ad.example.com'
      - 'server02.ad.example.com'
    'krb5_realm': 'AD.EXAMPLE.COM'
    'realmd_tags': 'joined-with-samba'
    'cache_credentials': true
    'id_provider': 'ad'
    'krb5_store_password_if_offline': true
    'default_shell': '/bin/bash'
    'ldap_id_mapping': false
    'use_fully_qualified_names': false
    'fallback_homedir': '/home/%d/%u'
    'access_provider': 'simple'
    'simple_allow_groups':
      - 'admins'
      - 'users'

Will be represented in sssd.conf like this:

[sssd]
domains = ad.example.com
config_file_version = 2
services = nss, pam

[domain/ad.example.com]
ad_domain = ad.example.com
ad_server = server01.ad.example.com, server02.ad.example.com
krb5_realm = AD.EXAMPLE.COM
realmd_tags = joined-with-samba
cache_credentials = true
id_provider = ad
krb5_store_password_if_offline = true
default_shell = /bin/bash
ldap_id_mapping = false
use_fully_qualified_names = false
fallback_homedir = /home/%d/%u
access_provider = simple
simple_allow_groups = admins, users

Tip: Using 'ad' as id_provider require you to run 'adcli join domain' on the target node. adcli join creates a computer account in the domain for the local machine, and sets up a keytab for the machine.

Example:

$ sudo adcli join ad.example.com

Or you can use a relevant module for automation.

Limitations

This module tracks the latest release of the latest two major releases, currently Puppet versions 5 and 6.

Tested on

  • Amazon Linux 2
  • Debian 8
  • Debian 9
  • EL 6
  • EL 7
  • EL 8
  • Fedora 29
  • Fedora 30
  • Gentoo 4
  • Suse 11
  • Suse 12
  • Ubuntu 14.04
  • Ubuntu 16.04
  • Ubuntu 18.04

May work with

These platforms are end of life (EOL) and once worked with the module and probably still do. We keep the data for them and if you use them a warning will appear instead of a failure. In order to speed up testing, we no longer run tests for EOL platforms.

  • Debian 7
  • EL 5
  • Fedora 26
  • Fedora 27
  • Gentoo 3

Versioning

The v1 series of this module will support both Puppet v3 and v4. The v2 series of this module will drop support for Puppet v3.

Credits

  • sssd.conf template from walkamongus-sssd by Chadwick Banning
  • See CHANGELOG.md file for additional credits