I have LDAP Group.


In LDAP Group has some users:

developer1, tester1, analitic1, project1

I want to create ansible playbook for add LDAP group to SSH access on host.

Found only

group – Add or remove groups

- name: Ensure group "somegroup" exists
    name: somegroup
    state: present

How to add LDAP group superproduct1 for ssh access?

2 Answers 2


You don't need to edit /etc/groups since the LDAP group already exists in your LDAP database. You want to let SSH know to use it, try using the AllowGroups setting in /etc/ssh/sshd_config.

From the manpage: "If specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups."

See this question for more information


As explained by @TheFiddlerWins, there is no need to add ldap groups into /etc/group.

The challenge here is to give ssh a way to access your ldap directory: I did this some time ago by adding a custom script to the sshd config, but using pam looks a lot cleaner today.

Then you just need to handle the required changes using your playbook.

Just remember that your ldap accounts will need a posixAccount object in order to be able to log into you ubuntu boxes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.