+
^\/etc\/sssd\/(sssd.conf|conf\.d\/.+\.conf)$
- ^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ \t]*=[ \t]*((?i)true)[ \t]*$
+ ^[\s]*\[domain\/[^]]*](?:[^\n\[\]]*\n+)+?[\s]*ldap_id_use_start_tls[ \t]*=[ \t]*((?i)\w+)[ \t]*$
1
+
+
+ (?i)true
+
+
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml
index 190e52eb285..36a8653a614 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml
@@ -12,7 +12,7 @@ description: |-
To check if LDAP is configured to use TLS when id_provider is
set to ldap or ipa, use the following command:
- $ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf
+ $ sudo grep -i ldap_id_use_start_tls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf
rationale: |-
Without cryptographic integrity protections, information can be
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value_conf_d.pass.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value_conf_d.pass.sh
new file mode 100644
index 00000000000..ef346b0eb5d
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/correct_value_conf_d.pass.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+# packages = /usr/lib/systemd/system/sssd.service
+
+. $SHARED/setup_config_files.sh
+setup_correct_sssd_config
+
+systemctl enable sssd
+
+mkdir -p /etc/sssd/conf.d/
+
+sed -i '/ldap_id_use_start_tls/d' /etc/sssd/sssd.conf
+
+cat > "/etc/sssd/conf.d/unused.conf" << EOF
+[domain/default]
+
+ldap_id_use_start_tls = True
+id_provider = ldap
+autofs_provider = ldap
+auth_provider = krb5
+chpass_provider = krb5
+ldap_search_base = dc=com
+ldap_tls_cacertdir = /etc/openldap/cacerts
+cache_credentials = True
+krb5_store_password_if_offline = True
+ldap_tls_reqcert = demand
+EOF
+
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false_conf_d.fail.sh b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false_conf_d.fail.sh
new file mode 100644
index 00000000000..31461b8ca3f
--- /dev/null
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/tests/ldap_id_provider_and_tls_false_conf_d.fail.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+# packages = /usr/lib/systemd/system/sssd.service
+
+. $SHARED/setup_config_files.sh
+setup_correct_sssd_config
+
+systemctl enable sssd
+
+mkdir -p /etc/sssd/conf.d/
+
+cat > "/etc/sssd/conf.d/unused.conf" << EOF
+[domain/default]
+
+ldap_id_use_start_tls = False
+EOF
diff --git a/shared/macros/10-ansible.jinja b/shared/macros/10-ansible.jinja
index fd8d96ac0d3..17ec425ce1b 100644
--- a/shared/macros/10-ansible.jinja
+++ b/shared/macros/10-ansible.jinja
@@ -707,6 +707,20 @@ The following macro remediates Audit syscall rule in :code:`/etc/audit/audit.rul
- test_grep_domain.stdout | length > 0
- test_id_provider.stdout is defined
- test_id_provider.stdout | length < 1
+
+- name: Find all the conf files inside /etc/sssd/conf.d/
+ find:
+ paths: "/etc/sssd/conf.d/"
+ patterns: "*.conf"
+ register: sssd_conf_d_files
+
+- name: Set {{{ parameter }}} to {{{ value }}} in /etc/sssd/conf.d/ if exists
+ ansible.builtin.replace:
+ path: "{{ item.path }}"
+ regexp: '[^#]*{{{ parameter }}}.*'
+ replace: '{{{ parameter }}} = {{{ value }}}'
+ with_items: "{{ sssd_conf_d_files.files }}"
+
{{%- endmacro %}}
diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
index 8aaff295e6a..3e4f668e0ff 100644
--- a/shared/macros/10-bash.jinja
+++ b/shared/macros/10-bash.jinja
@@ -1269,7 +1269,6 @@ for f in /etc/sudoers /etc/sudoers.d/* ; do
done
{{%- endmacro -%}}
-
{{% macro bash_sssd_ldap_config(parameter, value) -%}}
SSSD_CONF="/etc/sssd/sssd.conf"
LDAP_REGEX='[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*{{{ parameter }}}'
@@ -1296,6 +1295,12 @@ if grep -qvzosP $AD_REGEX $SSSD_CONF; then
fi
fi
fi
+
+readarray -t SSSD_CONF_D_FILES < <(find /etc/sssd/conf.d/ -name "*.conf")
+for SSSD_CONF_D_FILE in "${SSSD_CONF_D_FILES[@]}"; do
+ sed -i "s#{{{ parameter }}}[^(\n)]*#{{{ parameter }}} = {{{ value }}}#" "$SSSD_CONF_D_FILE"
+done
+
{{%- endmacro %}}