Hiera for sssd

config.yaml

sssd::config:
  'sssd':
    'domains': 'my.domain.com, ldap'
    'config_file_version': 2
    'services':
      - 'nss'
      - 'pam'
      - 'ssh'
      - 'autofs'
  'domain/my.domain.com':
    'ad_domain': 'my.domain.com'
    'ad_server':
      - 'PDC01.my.domain.com'
      - 'PDC02.my.domain.com'
    'krb5_realm': 'MY.DOMAIN.COM'
    'realmd_tags': 'joined-with-puppet'
    'cache_credentials': false
    'id_provider': 'ad'
    'krb5_store_password_if_offline': true
    'default_shell': '/bin/bash'
    'ldap_id_mapping': true
    'use_fully_qualified_names': false
    'fallback_homedir': '/home/%u@%d'
    'access_provider': 'ad'
  'domain/ldap':
    'cache_credentials': false
    'id_provider': ldap
    'auth_provider': ldap
    'ldap_schema': rfc2307
    'ldap_id_use_start_tls': True
    'chpass_provider': ldap
    'ldap_netgroup_search_base': ou=people,cn=iddata,ou=de,ou=unix,dc=my.domain,dc=com
    'ldap_group_search_base': ou=groups,cn=iddata,ou=de,ou=unix,dc=my.domain,dc=com
    'ldap_user_search_base': ou=people,cn=iddata,ou=de,ou=unix,dc=my.domain,dc=com
    'ldap_default_authtok_type': password
    'ldap_search_base': cn=iddata,ou=de,ou=unix,dc=my.domain,dc=com
    'ldap_default_bind_dn': cn=linux_generic_sec,ou=machines,ou=com,ou=unix,dc=my.domain,dc=com
    'ldap_uri': ldaps://ldap-02.my.domain.com/,ldaps://ldap-01.my.domain.com/
    'ldap_default_authtok': JoinLinUx
    'ldap_tls_cacertdir': /etc/openldap/cacerts
    'ldap_tls_cacert': /etc/openldap/cacerts/my.domain.com.ca.crt
    'access_provider': ldap