Support SSSD and optionally LDAP (#438)

* support sssd configuration

* make sssd-ldap optional

* SSSD PR review tweaks

* enable installing sssd in fatimage

* install sssd and sssd-ldap packages in stackhpc fatimage

* fix sssd being enabled in fatimage

* bump CI image

* simplify sssd-ldap package installation in fatimage

* bump CI image

* enable mkhomedir

* add sshd role

* auto enable ssh passwords if using ldap

* actually run sshd role

* make sshd config more flexible

* add basic_users_override_sssd flag

* port PR comment re. basic_users docs

* add sssd-ldap package during stackhpc build only

* bump CI image

* add missing empty sssd group

* remove deprecated & empty block_devices group

* regularise common groups & everything groups template a bit

* bumb CI image

* sssd review comments

Co-authored-by: Will Szumski <will@stackhpc.com>

---------

Co-authored-by: Will Szumski <will@stackhpc.com>

Author: sjpb

ansible/.gitignore

@@ -58,6 +58,10 @@ roles/*
 !roles/squid/**
 !roles/tuned/
 !roles/tuned/**
+!roles/sssd/
+!roles/sssd/**
+!roles/sshd/
+!roles/sshd/**
 !roles/compute_init/
 !roles/compute_init/**
 !roles/k3s/

ansible/bootstrap.yml

@@ -110,6 +110,15 @@
         policy: "{{ selinux_policy }}"
       register: sestatus
 
+- hosts: sshd
+  tags: sshd
+  gather_facts: no
+  become: yes
+  tasks:
+    - name: Configure sshd
+      import_role:
+        name: sshd
+
 - hosts: dnf_repos
   become: yes
   tasks:

ansible/fatimage.yml

@@ -54,6 +54,11 @@
         name: freeipa
         tasks_from: client-install.yml
       when: "'freeipa_client' in group_names"
+    - name: Install sssd
+      import_role:
+        name: sssd
+        tasks_from: install.yml
+      when: "'sssd' in group_names"
 
     # - import_playbook: filesystems.yml:
     - name: Install nfs packages

ansible/iam.yml

@@ -40,3 +40,12 @@
       import_role:
         name: freeipa
         tasks_from: users.yml
+
+- hosts: sssd
+  become: yes
+  gather_facts: no
+  tags: sssd
+  tasks:
+    - name: Configure sssd
+      import_role:
+        name: sssd

ansible/roles/basic_users/README.md

@@ -24,6 +24,7 @@ Role Variables
   - An additional key `sudo` may optionally be specified giving a string (possibly multiline) defining sudo rules to be templated.
   - Any other keys may present for other purposes (i.e. not used by this role).
 - `basic_users_groups`: Optional, default empty list. A list of mappings defining information for each group. Mapping keys/values are passed through as parameters to [ansible.builtin.group](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/group_module.html) and default values are as given there.
+- `basic_users_override_sssd`: Optional bool, default false. Whether to disable `sssd` when ensuring users/groups exist with this role. Permits creating local users/groups even if they clash with users provided via sssd (e.g. from LDAP). Ignored if host is not in group `sssd` as well. Note with this option active `sssd` will be stopped and restarted each time this role is run.
 
 Dependencies
 ------------

ansible/roles/basic_users/defaults/main.yml

@@ -7,3 +7,4 @@ basic_users_userdefaults:
   shell: "{{'/sbin/nologin' if 'control' in group_names else omit }}"
 basic_users_users: []
 basic_users_groups: []
+basic_users_override_sssd: false

ansible/roles/basic_users/tasks/main.yml

@@ -7,7 +7,16 @@
     label: "{{ item.name }}"
   when:
     - "item.state | default('present') == 'absent'"
-  
+
+- name: Stop sssd if required
+  systemd:
+    name: sssd
+    state: stopped
+  register: _stop_sssd
+  when:
+    - "'sssd' in group_names"
+    - basic_users_override_sssd | bool
+
 - name: Create groups
   ansible.builtin.group: "{{ item }}"
   loop:  "{{ basic_users_groups }}"
@@ -19,6 +28,12 @@
     label: "{{ item.name }} [{{ item.state | default('present') }}]"
   register: basic_users_info
 
+- name: Restart sssd if required
+  systemd:
+    name: sssd
+    state: started
+  when: _stop_sssd is changed
+
 - name: Write supplied public key as authorized for SSH access
   authorized_key:
     user: "{{ item.name }}"

ansible/roles/sshd/README.md

@@ -0,0 +1,9 @@
+# sshd
+
+Configure sshd.
+
+## Role variables
+
+- `sshd_password_authentication`: Optional bool. Whether to enable password login. Default `false`.
+- `sshd_conf_src`: Optional string. Path to sshd configuration template. Default is in-role template.
+- `sshd_conf_dest`: Optional string. Path to destination for sshd configuration file. Default is `/etc/ssh/sshd_config.d/10-ansible.conf` which overides `50-{cloud-init,redhat}` files, if present.

ansible/roles/sshd/defaults/main.yml

@@ -0,0 +1,3 @@
+sshd_password_authentication: false
+sshd_conf_src: sshd.conf.j2
+sshd_conf_dest: /etc/ssh/sshd_config.d/10-ansible.conf

ansible/roles/sshd/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: Restart sshd
+  systemd:
+    name: sshd
+    state: restarted