---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [identity_ad, always]

- name: Install AD integration packages
  ansible.builtin.package:
    name: "{{ identity_ad_packages }}"
    state: present
  tags: [identity_ad]

- name: Check whether host is already domain-joined
  ansible.builtin.command: realm list
  register: identity_ad_realm_status
  changed_when: false
  failed_when: false
  tags: [identity_ad]

- name: Join Active Directory domain
  ansible.builtin.command: >
    realm join --user={{ ad_join_username }}
    --computer-ou="{{ ad_ou }}"
    {{ ad_domain }}
  args:
    stdin: "{{ ad_join_password }}"
  when: ad_domain not in identity_ad_realm_status.stdout
  changed_when: true
  no_log: true
  tags: [identity_ad]

- name: Deploy sssd.conf
  ansible.builtin.template:
    src: sssd.conf.j2
    dest: /etc/sssd/sssd.conf
    owner: root
    group: root
    mode: "0600"
  notify: restart sssd
  tags: [identity_ad]

- name: Enable oddjobd (required for pam_mkhomedir, RedHat family)
  ansible.builtin.systemd:
    name: oddjobd
    enabled: true
    state: started
  when: ansible_facts['os_family'] == "RedHat"
  tags: [identity_ad]

- name: Enable automatic home directory creation (RedHat family)
  ansible.builtin.command: authselect enable-feature with-mkhomedir
  register: identity_ad_authselect_result
  changed_when: "'already enabled' not in identity_ad_authselect_result.stderr"
  failed_when: false
  when: ansible_facts['os_family'] == "RedHat"
  tags: [identity_ad]

- name: Check whether pam_mkhomedir is already enabled (Debian family)
  ansible.builtin.command: grep -q pam_mkhomedir.so /etc/pam.d/common-session
  register: identity_ad_mkhomedir_check
  changed_when: false
  failed_when: false
  when: ansible_facts['os_family'] == "Debian"
  tags: [identity_ad]

- name: Enable automatic home directory creation (Debian family)
  ansible.builtin.command: pam-auth-update --enable mkhomedir
  when:
    - ansible_facts['os_family'] == "Debian"
    - identity_ad_mkhomedir_check.rc != 0
  changed_when: true
  tags: [identity_ad]

- name: Enable and start sssd
  ansible.builtin.systemd:
    name: sssd
    enabled: true
    state: started
  tags: [identity_ad]

- name: Restrict login access to authorized AD groups
  ansible.builtin.lineinfile:
    path: /etc/sssd/sssd.conf
    regexp: "^access_provider"
    line: "access_provider = simple"
  notify: restart sssd
  tags: [identity_ad]