Chef Cookbook for SSSD
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
.chef
attributes
recipes
templates/default
test
.foodcritic
.gitignore
.kitchen.local.yml.EXAMPLE
.kitchen.yml
Berksfile
CHANGELOG.md
GETTING_STARTED.md
LICENSE
README.md
Thorfile
chefignore
metadata.rb

README.md

sssd-cookbook

Launch, configure, and manage the SSSD service for communication with an AD backend such as Amazon Directory Service (Simple AD)

Supported Platforms

  • Ubuntu 14.04 LTS
  • CentOS 6.6

Attributes

Key Type Description Default
['sssd']['join_domain'] Boolean whether or not to join the domain (mostly useless to change unless testing) true
['sssd']['enumerate'] Boolean whether or not to enable enumeration (increased load on Simple AD servers, but some setups may need it) true
['sssd']['packages'] Array list of packages to install prior to adcli join varies by OS
['sssd']['computer_name'] String an optional alternate computer name to use when joining the domain (IE: ec2 instance ID) nil
['sssd']['directory_name'] String the directory name, as specified in "Directory Details" in the AWS console nil
['sssd']['realm']['credentials_source'] String source of the realm credentials. see "Realm Credentials" below data_bag
['sssd']['realm']['databag'] String databag that contains the username and password used in "adcli join" or "realm join" nil
['sssd']['realm']['databag_item'] String databag item that contains the username and password used in "adcli join" or "realm join" nil
['sssd']['service_actions'] Symbol | Array of symbols the actions to run on the sssd service [:enable]
['sssd']['encypted_data_bag_secret'] String The encrypted databag secret nil
['sssd']['basedir'] String The base directory under which users home directory should be created /home

Usage

sssd::default

Include sssd in your node's run_list:

{
  "run_list": [
    "recipe[sssd::default]"
  ]
}

Realm Credentials

This cookbook natively supports passing the realm credentials in via a data bag. For those not using data bags or an alternate credential manager, you can implement a wrapper cookbook and pass the realm credentials in via node.run_state.

Example:

node.run_state['realm_username'] = 'Administrator'
node.run_state['realm_password'] = 'N0TaR34lPassw0rd'

include_recipe 'sssd'

Testing

See .kitchen.yml and .kitchen.local.yml.EXAMPLE.

To create a local databag for use with test kitchen's with-registration suite, do:

$ openssl rand -base64 512 | tr -d '\r\n' > test/integration/with-registration/encrypted_data_bag_secret_key
$ knife solo data bag create sssd_credentials realm -c .chef/solo.rb

License and Authors

Author:: Localytics (oss@localytics.com)

Copyright:: 2015, Localytics

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.