Aktualisisert von Coderberg

roles/lmn_sssd/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+sssd_domjoin_user: global-admin

roles/lmn_sssd/handlers/main.yml

@@ -1,6 +1,5 @@
 - name: Restart sssd
-  ansible.builtin.service:
+  ansible.builtin.systemd:
     name: sssd
     state: restarted
     enabled: true
-  listen: "Restart sssd"

roles/lmn_sssd/tasks/main.yml

@@ -10,16 +10,27 @@
   ansible.builtin.template:
     src: sssd.conf.j2
     dest: /etc/sssd/sssd.conf
-    mode: '0600'
+    mode: '0640'
   notify: Restart sssd
 
-  ## Either one of the variables is defined:
+- name: Check if the machine account password and the join are still valid
+  ansible.builtin.shell:
+    cmd: adcli testjoin -D {{ domain | upper }}
+  register: adcli_test_result
+  failed_when: false
+  changed_when: false
+
+  # If domjoin not valid:
 - name: Join the domain
   ansible.builtin.shell:
     cmd: >
-      echo "{{ ansible_cmdline.adpw | default('') + adpw.user_input | default('') + joinpw | default('') }}" |
-      adcli join --stdin-password -U global-admin {{ domain | upper }}
-  when: >
-    ansible_cmdline.adpw | default('') | length > 0 or
-    adpw.user_input | default('') | length > 0 or
-    joinpw is defined
+      echo "{{ ad_passwd }}" | adcli join --stdin-password -U {{ ad_user }} {{ domain | upper }}
+  no_log: true
+  vars:
+    ad_user: "{{ 'global-admin' if (adpw.user_input | default(ansible_cmdline.adpw) | default('') | length > 0) else sssd_domjoin_user }}"
+    ad_passwd: "{{ adpw.user_input | default('') if  adpw.user_input | default ('') | length > 0 else ansible_cmdline.adpw | default(sssd_domjoin_passwd) | default('') }}"
+  throttle: 1
+  when:
+    - adpw.user_input | default('') | length > 0 or
+      ansible_cmdline.adpw | default(sssd_domjoin_passwd) | default('') | length > 0
+    - adcli_test_result.rc != 0

roles/lmn_sssd/templates/sssd.conf.j2

@@ -9,7 +9,9 @@ ad_domain = {{ domain }}
 id_provider = ad
 access_provider = ad
 use_fully_qualified_names = False
+{% if localhome is defined and localhome %}
 cache_credentials = True
+{% endif %}
 krb5_store_password_if_offline = True
 default_shell = /usr/bin/bash
 # default: # ldap_id_mapping = True
@@ -17,6 +19,7 @@ ad_gpo_access_control = disabled
 ad_gpo_ignore_unreadable = True
 ad_maximum_machine_account_password_age = 0
 ignore_group_members = True
+krb5_renew_interval = 1h
 {% if localhome is defined and localhome %}
 override_homedir = /home/%u
 {% endif %}