How to add LDAP group for ssh access by ansible playbook?

Question

I have LDAP Group.

superproduct1

In LDAP Group has some users:

developer1, tester1, analitic1, project1

I want to create ansible playbook for add LDAP group to SSH access on host.

Found only

group – Add or remove groups

- name: Ensure group "somegroup" exists
  group:
    name: somegroup
    state: present

How to add LDAP group superproduct1 for ssh access?

Answer 1

You don't need to edit /etc/groups since the LDAP group already exists in your LDAP database. You want to let SSH know to use it, try using the AllowGroups setting in /etc/ssh/sshd_config.

From the manpage: "If specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups."

See this question for more information

Answer 2

As explained by @TheFiddlerWins, there is no need to add ldap groups into /etc/group.

The challenge here is to give ssh a way to access your ldap directory: I did this some time ago by adding a custom script to the sshd config, but using pam looks a lot cleaner today.

Then you just need to handle the required changes using your playbook.

Just remember that your ldap accounts will need a posixAccount object in order to be able to log into you ubuntu boxes.