# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Find all the conf files inside the /etc/sssd/conf.d/
    directory
  ansible.builtin.find:
    paths:
    - /etc/sssd/conf.d/
    patterns: '*.conf'
  register: sssd_conf_d_files
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Modify lines in files in the /etc/sssd/conf.d/
    directory
  ansible.builtin.replace:
    path: '{{ item }}'
    regexp: ^(\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*services\s*=(?!.*\bpam\b).*)$
    replace: \1,pam
  with_items: '{{ sssd_conf_d_files.files | map(attribute=''path'') }}'
  register: modify_lines_sssd_conf_d_files
  when:
  - '"sssd-common" in ansible_facts.packages'
  - sssd_conf_d_files.matched is defined and sssd_conf_d_files.matched >= 1
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Find /etc/sssd/sssd.conf
  ansible.builtin.stat:
    path: /etc/sssd/sssd.conf
  register: sssd_conf_file
  when: '"sssd-common" in ansible_facts.packages'
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Modify lines in /etc/sssd/sssd.conf
  ansible.builtin.replace:
    path: /etc/sssd/sssd.conf
    regexp: ^(\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*services\s*=(?!.*\bpam\b).*)$
    replace: \1,pam
  register: modify_lines_sssd_conf_file
  when:
  - '"sssd-common" in ansible_facts.packages'
  - sssd_conf_file.stat.exists
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Find services key in /etc/sssd/sssd.conf
  ansible.builtin.replace:
    path: /etc/sssd/sssd.conf
    regexp: ^\s*\[sssd\][^\[\]]*?(?:\n(?!\[)[^\n]*?services\s*=)+
    replace: ''
  changed_when: false
  check_mode: true
  register: sssd_conf_file_services
  when:
  - '"sssd-common" in ansible_facts.packages'
  - sssd_conf_file.stat.exists
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services

- name: Configure PAM in SSSD Services - Insert entry to /etc/sssd/sssd.conf
  community.general.ini_file:
    path: /etc/sssd/sssd.conf
    section: sssd
    option: services
    value: pam
  when:
  - '"sssd-common" in ansible_facts.packages'
  - not modify_lines_sssd_conf_d_files.changed
  - not modify_lines_sssd_conf_file.changed
  - (sssd_conf_file_services.msg is defined and "replacements" not in sssd_conf_file_services.msg)
    or not sssd_conf_file.stat.exists
  tags:
  - NIST-800-53-CM-6(a)
  - NIST-800-53-IA-2(1)
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
  - sssd_enable_pam_services
