# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: "Test for domain group"
  ansible.builtin.command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  failed_when: false
  changed_when: False
  check_mode: no

- name: "Add default domain group (if no domain there)"
  community.general.ini_file:
    path: /etc/sssd/sssd.conf
    section: "{{ item.section }}"
    option: "{{ item.option }}"
    value: "{{ item.value }}"
    create: yes
    mode: 0600
  with_items:
    - { section: sssd, option: domains, value: default}
    - { section: domain/default, option: id_provider, value: files }
  when:
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length < 1

- name: "Configure SSD to Expire Offline Credentials"
  community.general.ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: offline_credentials_expiration
    value: 1
    create: yes
    mode: 0600

- name: Find all the conf files inside /etc/sssd/conf.d/
  ansible.builtin.find:
    paths: "/etc/sssd/conf.d/"
    patterns: "*.conf"
  register: sssd_conf_d_files

- name: Fix offline_credentials_expiration configuration in /etc/sssd/conf.d/
  ansible.builtin.replace:
    path: "{{ item.path }}"
    regexp: '[^#]*offline_credentials_expiration.*'
    replace: 'offline_credentials_expiration = 1'
  with_items: "{{ sssd_conf_d_files.files }}"
