---
- name: Résoudre l'annuaire (rôle partagé)
  ansible.builtin.include_role:
    name: resoudre_annuaire

- name: Adopter la connexion annuaire pour SSSD
  ansible.builtin.set_fact:
    client_ldap_uri: "{{ resoudre_annuaire_uri }}"
    client_ldap_base_dn: "{{ resoudre_annuaire_base_dn }}"

- name: Installer SSSD et les modules LDAP
  ansible.builtin.apt:
    name: "{{ client_ldap_paquets }}"
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Deployer la configuration SSSD
  ansible.builtin.template:
    src: sssd.conf.j2
    dest: /etc/sssd/sssd.conf
    owner: root
    group: root
    mode: "0600"
  no_log: true
  notify: Redemarrer sssd

- name: Activer SSS dans nsswitch
  ansible.builtin.lineinfile:
    path: /etc/nsswitch.conf
    regexp: '^({{ item }}:\s+)(?!.*\bsss\b)(.*)$'
    line: '\1\2 sss'
    backrefs: true
  loop:
    - passwd
    - group
    - shadow

- name: Activer la creation automatique des repertoires personnels
  ansible.builtin.command:
    cmd: pam-auth-update --enable mkhomedir
  changed_when: false
  when: client_ldap_mkhomedir | bool

- name: Activer et demarrer SSSD
  ansible.builtin.systemd:
    name: "{{ client_ldap_service }}"
    enabled: true
    state: started