---
# Here is the right place to put the role's input variables.
# This file also serves as a documentation for such a variables.

## Required vars
# Realm name to join
ad_integration_realm:
# Password of the user used to authenticate the join operation
ad_integration_password: ""

## Optional vars
# Active Directory user used to join the domain
ad_integration_user: "Administrator"

# Active Directory domain controller's host name or IP address to join
# via that domain controller directly.
ad_integration_join_to_dc:

# Leave existing domain prior to performing join.
ad_integration_force_rejoin: false

# Turn it off to use UID and GID information stored in the directory
#  (as-per RFC2307) rather than automatically generating UID and GID numbers
ad_integration_auto_id_mapping: true

# Control which client software is the preferred default for use with
# Active Directory.  Possible values include sssd or winbind.
ad_integration_client_software: "sssd"

# The software to use when joining to the realm.
# Possible values include samba or adcli.
ad_integration_membership_software: "adcli"

# The distinguished name of an organizational unit to create the computer
# account.  It can be relative to the Root DSE, or a complete LDAP DN.
ad_integration_computer_ou:

# If true, the ad_integration role will use fedora.linux_system_roles.timesync.
# `ad_integration_timesync_source` variable is required,
# time will then be synchronized with this server.
ad_integration_manage_timesync: false

# Hostname or IP address of time source to synchronize the system clock with.
# Only applicable if `ad_integration_manage_timesync` is true.
ad_integration_timesync_source:

# If true, the ad_integration role will use
# fedora.linux_system_roles.crypto_policies as needed
ad_integration_manage_crypto_policies: false

# If true, the ad_integration role will set the crypto policy
# allowing RC4 encryption.
# Requires ad_integration_manage_crypto_policies to be set to true
ad_integration_allow_rc4_crypto: false

# If true, the ad_integration role will use fedora.linux_system_roles.network
# to configure an existing network connection DNS configuration (manual)
# to point to the provided AD DNS server.
# If true then the following variables are required:
# `ad_integration_dns_server`
# `ad_integration_dns_connection_name`
# `ad_integration_dns_connection_type`
ad_integration_manage_dns: false

# IP address of DNS server to add to existing networking configuration
ad_integration_dns_server:

# The name option identifies the connection profile to be configured by the
# network role. It is not the name of the networking interface for which the
# profile applies.
# Only applicable if `ad_integration_manage_dns` is true
ad_integration_dns_connection_name:

# Network connection type, the network role contains a list of possible values.
# Only applicable if `ad_integration_manage_dns` is true
ad_integration_dns_connection_type:

# If true, SSSD is configured to automatically update the AD DNS server with
# the IP address of the client.
# If true, then the following optional variables can be set for fine tuning:
# `ad_dyndns_ttl`
# `ad_dyndns_iface`
# `ad_dyndns_refresh_interval`
# `ad_dyndns_update_ptr`
# `ad_dyndns_force_tcp`
# `ad_dyndns_auth`
# `ad_dyndns_server`
ad_dyndns_update: false

# Optional. The TTL, in seconds, to apply to the client's DNS record when
# updating it.
# Note: This will override the TTL set by an administrator on the server.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_ttl: 3600

# Optional. Interface or a list of interfaces whose IP addresses should be used
# for dynamic DNS updates. Special value "*" implies all IPs from all interfaces
# should be used.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_iface:

# Optional. How often should, in seconds, periodic DNS updates be performed in
# addition to when the back end goes online.
# Note: lowest possible value is 60 seconds. If value less than 60 is specified
# sssd will assume lowest value only.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_refresh_interval: 86400

# Optional. If true, the PTR record should also be explicitly updated.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_update_ptr: true

# Optional. If true, the nsupdate utility should default to using TCP for
# communicating with the DNS server.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_force_tcp: false

# Optional. GSS-TSIG authentication is used for secure updates
# with the DNS server when updating A and AAAA records.
# Valid values are "GSS-TSIG" or "none" allowing insecure updates.
# The default value in sssd is 'GSS-TSIG'.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_auth:

# Optional. DNS server to use when performing a DNS update when autodetection
# settings fail.
# Only applicable if `ad_dyndns_update` is true
ad_dyndns_server:

# Any additional parameters passed to realm join command
# Useful for passing things like --user-principal etc.
ad_integration_join_parameters: ""

# A list of setting to be included into the [sssd] section
# of the sssd.conf file. The list will be composed of two entry:
# - key: "configuration_name"
#   value: "configuration_value"
ad_integration_sssd_settings: []

# A list of custom setting to be included into the [domain/<REALM>] section
# of the sssd.conf file. The list will be composed of two entry:
# - key: "configuration_name"
#   value: "configuration_value"
ad_integration_sssd_custom_settings: []

# If `true`, configure realmd.conf to remove the `authselect` command from
# `sssd-enable-logins` to avoid overwriting previous PAM/nsswitch changes, until
# https://issues.redhat.com/browse/RHEL-5101 is addressed.
ad_integration_preserve_authselect_profile: false

# Set to false to skip the package installation task.
ad_integration_manage_packages: true

# There may be duplicate sections for the realm in sssd.conf - if you set this
# to true, then the role will consolidate the data from those duplicate sections
# and remove the duplicate sections
ad_integration_sssd_merge_duplicate_sections: false
