---
- name: Install sssd-clients
  ansible.builtin.yum:
    name: sssd-client
    state: present
  when:
    - os_auth_pam_sssd_enable | bool

- name: Configure passwdqc and faillock via central system-auth config
  ansible.builtin.template:
    src: etc/pam.d/rhel_auth.j2
    dest: /etc/pam.d/system-auth-local
    mode: "0640"
    owner: root
    group: root

- name: Enable our config for system-auth
  ansible.builtin.file:
    src: /etc/pam.d/system-auth-local
    dest: /etc/pam.d/system-auth
    mode: "0640"
    owner: root
    group: root
    state: link
    force: true

- name: Configure passwdqc and faillock via central password-auth config
  ansible.builtin.template:
    src: etc/pam.d/rhel_auth.j2
    dest: /etc/pam.d/password-auth-local
    mode: "0640"
    owner: root
    group: root

- name: Enable our config for password-auth
  ansible.builtin.file:
    src: /etc/pam.d/password-auth-local
    dest: /etc/pam.d/password-auth
    mode: "0640"
    owner: root
    group: root
    state: link
    force: true