sssd-cookbook

Launch, configure, and manage the SSSD service for communication with an AD backend such as Amazon Directory Service (Simple AD)

Supported Platforms

• Ubuntu 14.04 LTS
• CentOS 6.6

Attributes

Key	Type	Description	Default
['sssd']['join_domain']	Boolean	whether or not to join the domain (mostly useless to change unless testing)	true
['sssd']['enumerate']	Boolean	whether or not to enable enumeration (increased load on Simple AD servers, but some setups may need it)	true
['sssd']['packages']	Array	list of packages to install prior to adcli join	varies by OS
['sssd']['computer_name']	String	an optional alternate computer name to use when joining the domain (IE: ec2 instance ID)	nil
['sssd']['directory_name']	String	the directory name, as specified in "Directory Details" in the AWS console	nil
['sssd']['realm']['credentials_source']	String	source of the realm credentials. see "Realm Credentials" below	data_bag
['sssd']['realm']['databag']	String	databag that contains the username and password used in "adcli join" or "realm join"	nil
['sssd']['realm']['databag_item']	String	databag item that contains the username and password used in "adcli join" or "realm join"	nil
['sssd']['service_actions']	Symbol | Array of symbols	the actions to run on the sssd service	[:enable]
['sssd']['encypted_data_bag_secret']	String	The encrypted databag secret	nil
['sssd']['basedir']	String	The base directory under which users home directory should be created	/home

Usage

sssd::default

Include sssd in your node's run_list:

{
  "run_list": [
    "recipe[sssd::default]"
  ]
}

Realm Credentials

This cookbook natively supports passing the realm credentials in via a data bag. For those not using data bags or an alternate credential manager, you can implement a wrapper cookbook and pass the realm credentials in via node.run_state.

Example:

node.run_state['realm_username'] = 'Administrator'
node.run_state['realm_password'] = 'N0TaR34lPassw0rd'

include_recipe 'sssd'

Testing

See .kitchen.yml and .kitchen.local.yml.EXAMPLE.

To create a local databag for use with test kitchen's with-registration suite, do:

$ openssl rand -base64 512 | tr -d '\r\n' > test/integration/with-registration/encrypted_data_bag_secret_key
$ knife solo data bag create sssd_credentials realm -c .chef/solo.rb

License and Authors

Author:: Localytics (oss@localytics.com)

Copyright:: 2015, Localytics

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.