Launch, configure, and manage the SSSD service for communication with an AD backend such as Amazon Directory Service (Simple AD)
- Ubuntu 14.04 LTS
- CentOS 6.6
| Key | Type | Description | Default |
|---|---|---|---|
| ['sssd']['join_domain'] | Boolean | whether or not to join the domain (mostly useless to change unless testing) | true |
| ['sssd']['enumerate'] | Boolean | whether or not to enable enumeration (increased load on Simple AD servers, but some setups may need it) | true |
| ['sssd']['packages'] | Array | list of packages to install prior to adcli join | varies by OS |
| ['sssd']['computer_name'] | String | an optional alternate computer name to use when joining the domain (IE: ec2 instance ID) | nil |
| ['sssd']['directory_name'] | String | the directory name, as specified in "Directory Details" in the AWS console | nil |
| ['sssd']['realm']['credentials_source'] | String | source of the realm credentials. see "Realm Credentials" below | data_bag |
| ['sssd']['realm']['databag'] | String | databag that contains the username and password used in "adcli join" or "realm join" | nil |
| ['sssd']['realm']['databag_item'] | String | databag item that contains the username and password used in "adcli join" or "realm join" | nil |
| ['sssd']['service_actions'] | Symbol | Array of symbols | the actions to run on the sssd service | [:enable] |
| ['sssd']['encypted_data_bag_secret'] | String | The encrypted databag secret | nil |
| ['sssd']['basedir'] | String | The base directory under which users home directory should be created | /home |
| ['sssd']['ad_gpo_access_control'] | String | Group Policy Access Control | permissive |
Include sssd in your node's run_list:
{
"run_list": [
"recipe[sssd::default]"
]
}This cookbook natively supports passing the realm credentials in via a data bag.
For those not using data bags or an alternate credential manager, you can implement
a wrapper cookbook and pass the realm credentials in via node.run_state.
Example:
node.run_state['realm_username'] = 'Administrator'
node.run_state['realm_password'] = 'N0TaR34lPassw0rd'
include_recipe 'sssd'See .kitchen.yml and .kitchen.local.yml.EXAMPLE.
To create a local databag for use with test kitchen's with-registration suite, do:
$ openssl rand -base64 512 | tr -d '\r\n' > test/integration/with-registration/encrypted_data_bag_secret_key
$ knife solo data bag create sssd_credentials realm -c .chef/solo.rbAuthor:: Localytics ([email protected])
Copyright:: 2015, Localytics
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.