enable mkhomedir

Author: sjpb

ansible/roles/sssd/README.md

@@ -10,6 +10,8 @@ The only required configuration is to create a [sssd.conf](https://www.mankier.c
 - `sssd_packages`: Optional list. Packages to install.
 - `sssd_ldap_install`: Optional bool. Whether to install packages enabling SSSD to authenticate against LDAP. Default `false`.
 - `sssd_ldap_packages`: Optional list. Packages to install when using `sssd_ldap_install`.
+- `sssd_enable_mkhomedir`: Optional bool. Whether to enable creation of home directories on login. Default `false`.
+- `sssd_mkhomedir_packages`: Optional list. Packages to install when using `sssd_enable_mkhomedir`.
 - `sssd_conf_src`: Optional string. Path to `sssd.conf` template. Default (which must be created) is `{{ appliances_environment_root }}/files/sssd.conf.j2`.
 - `sssd_conf_dest`: Optional string. Path to destination for `sssd.conf`. Default `/etc/sssd/sssd.conf`.
 - `sssd_started`: Optional bool. Whether `sssd` service should be started.

ansible/roles/sssd/defaults/main.yml

@@ -3,6 +3,9 @@ sssd_packages:
 sssd_install_ldap: false
 sssd_ldap_packages:
   - sssd-ldap
+sssd_enable_mkhomedir: false
+sssd_mkhomedir_packages:
+  - oddjob-mkhomedir
 sssd_conf_src: "{{ appliances_environment_root }}/files/sssd.conf.j2"
 sssd_conf_dest: /etc/sssd/sssd.conf
 sssd_started: true

ansible/roles/sssd/tasks/configure.yml

@@ -1,4 +1,4 @@
-- name: Write sssd.conf
+- name: Manage sssd.conf configuration
   template:
     src: "{{ sssd_conf_src }}"
     dest: "{{ sssd_conf_dest }}"
@@ -14,3 +14,15 @@
     name: sssd
     state: "{{ 'started' if sssd_started | bool else 'stopped' }}"
     enabled: "{{ sssd_enabled | bool }}"
+
+- name: Get current authselect configuration
+  command: authselect current --raw
+  changed_when: false
+  failed_when:
+    - _authselect_current.rc != 0
+    - "'No existing configuration detected' not in _authselect_current.stdout"
+  register: _authselect_current # stdout: sssd with-mkhomedir
+
+- name: Configure nsswitch and PAM for SSSD
+  command: "authselect select sssd --force{% if sssd_enable_mkhomedir | bool %} with-mkhomedir{% endif %}"
+  when: "'sssd' not in _authselect_current.stdout"

ansible/roles/sssd/tasks/install.yml

@@ -1,4 +1,4 @@
-- name: Install sssd packages
+- name: Ensure sssd packages are installed
   dnf:
     name: "{{ sssd_packages + sssd_ldap_packages if (sssd_install_ldap | bool) else [] }}"
 
@@ -7,3 +7,7 @@
   systemd:
     name: sssd
     enabled: "{{ sssd_enabled | bool }}"
+
+- name: Ensure mkhomedir packages are installed if required
+  dnf:
+    name: "{{ sssd_mkhomedir_packages }}"