fix: Switch SSSD config files provider to Proxy Provider

[justin-stephenson]

SSSD Files provider is being deprecated and removed in later RHEL/Fedora releases.

[spetrosi]

Will this work on earlier RHEL 8 and 9?
Please update your commit to include a commit type. We now follow conventional commits format to automate changelog generating and updating release version numbers.

[justin-stephenson]

Will this work on earlier RHEL 8 and 9?

Yes it will, and all fedora versions.

Please update your commit to include a commit type. We now follow conventional commits format to automate changelog generating and updating release version numbers.

Updated.

[spetrosi]

[citest]

[richm]

So it is ok if the role "owns" /etc/sssd/sssd.conf? I guess ini_file was used to preserve changes from users or other apps, and we don't need to preserve these changes anymore?
This is the only place ini_file is used, so we can also get rid of the file meta/collection-requirements.yml (and make a note to change the spec file not to vendor this for the tlog role).
Finally, make the following change to tests_sssd.yml:

    - name: Check for ansible_managed, fingerprint in generated files
      include_tasks: tasks/check_header.yml
      loop:
        - "{{ __tlog_sssd_session_recording_conf }}"
        - "{{ __tlog_sssd_conf }}"
      loop_control:
        loop_var: __file
      vars:
        __fingerprint: "system_role:tlog"

[justin-stephenson]

So it is ok if the role "owns" /etc/sssd/sssd.conf? I guess ini_file was used to preserve changes from users or other apps, and we don't need to preserve these changes anymore? This is the only place ini_file is used, so we can also get rid of the file meta/collection-requirements.yml (and make a note to change the spec file not to vendor this for the tlog role). Finally, make the following change to tests_sssd.yml:

    - name: Check for ansible_managed, fingerprint in generated files
      include_tasks: tasks/check_header.yml
      loop:
        - "{{ __tlog_sssd_session_recording_conf }}"
        - "{{ __tlog_sssd_conf }}"
      loop_control:
        loop_var: __file
      vars:
        __fingerprint: "system_role:tlog"

I would prefer to not have tlog own /etc/sssd/sssd.conf, based on your comments I think it will be better to continue using the ini_file module. I will update the PR once ready.

[richm]

I would prefer to not have tlog own /etc/sssd/sssd.conf

What other app makes changes to sssd.conf that we want to preserve?

[justin-stephenson]

Tlog uses SSSD behind the scenes to configure shell recording configuration of local users, but it is done "behind the scenes" - it is a non-typical use case for majority of SSSD userbase. If someone wants to setup remote authentication as an IDM client (ansible-freeipa), or AD integration role then both those playbooks would generate a new sssd.conf, through realmd or ipa-client-install.

[richm]

Tlog uses SSSD behind the scenes to configure shell recording configuration of local users, but it is done "behind the scenes" - it is a non-typical use case for majority of SSSD userbase. If someone wants to setup remote authentication as an IDM client (ansible-freeipa), or AD integration role then both those playbooks would generate a new sssd.conf, through realmd or ipa-client-install.

ok - then ini_file it is

[justin-stephenson]

@spoore1 @aborah-sudo FYI

[spoore1]

@spoore1 @aborah-sudo FYI

I ran a quick check on RHEL9. LGTM

[richm]

[citest]

[richm]

lgtm - ready to merge?

[justin-stephenson]

Good with me.