Skip to content

Commit 22d2fb6

Browse files
jaymzhjaymzh
committed
new cookbook: fb_sssd
This is a very simple cookbook to manage `sssd` a common staple on modern Linux machines - both servers and client machines. I've tried to stick as close as possible to my recollection of the internal FB cookbook. Other than some extra symlinks and a bit of internal config, I think this should be a nearly drop-in replacement that will be easy to migrate to.
1 parent def3aa7 commit 22d2fb6

File tree

7 files changed

+214
-0
lines changed

7 files changed

+214
-0
lines changed

‎cookbooks/fb_init_sample/metadata.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@
5858
depends 'fb_sdparm'
5959
depends 'fb_securetty'
6060
depends 'fb_smartmon'
61+
depends 'fb_sssd'
6162
depends 'fb_storage'
6263
depends 'fb_stunnel'
6364
depends 'fb_sudo'

‎cookbooks/fb_init_sample/recipes/default.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
include_recipe 'fb_launchd'
5050
end
5151
include_recipe 'fb_nsswitch'
52+
include_recipe 'fb_sssd'
5253
# HERE: ssh
5354
include_recipe 'fb_less'
5455
if node.linux? && !node.embedded? && !node.container?

‎cookbooks/fb_sssd/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
fb_sssd Cookbook
2+
================
3+
Manage sssd configuration
4+
5+
Requirements
6+
------------
7+
8+
Attributes
9+
----------
10+
* node['fb_sssd']['enable']
11+
* node['fb_sssd']['manage_packages']
12+
* node['fb_sssd']['config']
13+
14+
Usage
15+
-----
16+
### enable
17+
18+
Enable will install, setup, and start sssd if `true`, and will stop and
19+
uninstall it if `false` (default).
20+
21+
### manage_packages
22+
23+
If true (default) will install or uninstall packages based on `enable`. Otherwise does not touch packages.
24+
25+
### config
26+
27+
The config is a two-level hash where the top-level hash is the **section** of the INI file (`/etc/sssd/sssd.conf`), and the hash under that is key-value pairs. For example:
28+
29+
```ruby
30+
node.default['fb_sssd']['config']['nss']['default_shell'] = '/bin/bash'
31+
```
32+
33+
is rendered as:
34+
35+
```text
36+
[nss]
37+
default_shell = /bin/bash
38+
```
39+
40+
If the value is an array it is joined into a string using `, `, ala:
41+
42+
```ruby
43+
node.default['fb_sssd']['config']['sssd']['services'] = [
44+
'nss',
45+
'pam',
46+
'ssh',
47+
]
48+
```
49+
50+
will be rendered as:
51+
52+
```text
53+
[sssd]
54+
services = nss, pam, ssh
55+
```

‎cookbooks/fb_sssd/attributes/default.rb‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#
2+
# Copyright (c) 2025-present, Meta Platforms, Inc.
3+
# Copyright (c) 2025-present, Phil Dibowitz
4+
# All rights reserved.
5+
#
6+
# Licensed under the Apache License, Version 2.0 (the "License");
7+
# you may not use this file except in compliance with the License.
8+
# You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
#
18+
19+
default['fb_sssd'] = {
20+
'enable' => false,
21+
'manage_packages' => true,
22+
'config' => {
23+
'sssd' => {
24+
'config_file_version' => 2,
25+
},
26+
},
27+
}

‎cookbooks/fb_sssd/metadata.rb‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#
2+
# Copyright (c) 2019-present, Vicarious, Inc.
3+
# All rights reserved.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
name 'fb_sssd'
19+
maintainer 'Facebook'
20+
maintainer_email '[email protected]'
21+
license 'Apache-2.0'
22+
source_url 'https://github.com/facebook/chef-cookbooks/'
23+
description 'Installs/Configures sssd'
24+
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
25+
supports 'centos'
26+
supports 'debian'
27+
supports 'ubuntu'
28+
# never EVER change this number, ever.
29+
version '0.1.0'

‎cookbooks/fb_sssd/recipes/default.rb‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#
2+
# Cookbook:: fb_sssd
3+
# Recipe:: default
4+
#
5+
# Copyright (c) 2025-present, Meta Platforms, Inc.
6+
# Copyright (c) 2025-present, Phil Dibowitz
7+
# All rights reserved.
8+
#
9+
# Licensed under the Apache License, Version 2.0 (the "License");
10+
# you may not use this file except in compliance with the License.
11+
# You may obtain a copy of the License at
12+
#
13+
# http://www.apache.org/licenses/LICENSE-2.0
14+
#
15+
# Unless required by applicable law or agreed to in writing, software
16+
# distributed under the License is distributed on an "AS IS" BASIS,
17+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18+
# See the License for the specific language governing permissions and
19+
# limitations under the License.
20+
#
21+
22+
packages = %w{
23+
sssd
24+
sssd-ad
25+
sssd-common
26+
sssd-dbus
27+
sssd-ipa
28+
sssd-krb5
29+
sssd-krb5-common
30+
sssd-ldap
31+
sssd-proxy
32+
sssd-tools
33+
}
34+
35+
extra_packages = value_for_platform_family(
36+
['fedora', 'rhel'] => ['sssd-client'],
37+
['debian'] => ['sssd-ad-common'],
38+
)
39+
40+
packages += extra_packages
41+
42+
package packages do
43+
only_if { node['fb_sssd']['enable'] && node['fb_sssd']['manage_packages'] }
44+
action :upgrade
45+
end
46+
47+
package 'remove sssd' do
48+
not_if { node['fb_sssd']['enable'] }
49+
package_name packages
50+
action :remove
51+
end
52+
53+
template '/etc/sssd/sssd.conf' do
54+
only_if { node['fb_sssd']['enable'] }
55+
owner 'root'
56+
group 'root'
57+
mode '0600'
58+
notifies :restart, 'service[sssd]'
59+
end
60+
61+
file '/etc/sssd/sssd.conf' do
62+
not_if { node['fb_sssd']['enable'] }
63+
action :delete
64+
end
65+
66+
Dir.glob('/etc/sssd/conf.d/*').each do |f|
67+
file f do
68+
only_if { node['fb_sssd']['enable'] }
69+
action :delete
70+
end
71+
end
72+
73+
service 'sssd' do
74+
only_if { node['fb_sssd']['enable'] }
75+
action [:enable, :start]
76+
# nsswitch is before sssd (for good reasons), but that means on first
77+
# boot, we'll trigger on the nsswitch notification and try to restart
78+
# even when we can't. This could of course happen outside of firstboot
79+
# so if the binary isn't there at compile time, don't bother setting up
80+
# the notification. This is safe: if the binary isn't there, it can't
81+
# be running and therefore can't have an old config... it will then be
82+
# started by this resource
83+
if File.exist?('/usr/sbin/sssd')
84+
subscribes :restart, 'template[/etc/nsswitch.conf]', :immediately
85+
end
86+
end
87+
88+
service 'disable sssd' do
89+
not_if { node['fb_sssd']['enable'] }
90+
# once the package is removed, this fails, sadly
91+
only_if { ::File.exist?('/lib/systemd/system/sssd.service') }
92+
service_name 'sssd'
93+
action [:stop, :disable]
94+
end

‎cookbooks/fb_sssd/templates/sssd.conf.erb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This file is managed by Chef, do not edit manually!
2+
<% node['fb_sssd']['config'].each do |section, conf| %>
3+
[<%= section %>]
4+
<% conf.each do |key, val| %>
5+
<%= key %> = <%= val.is_a?(Array) ? val.join(', ') : val %>
6+
<% end %>
7+
<% end %>

0 commit comments

Comments
 (0)