Permission conflict for configuration on RHEL10

[dabelenda]

When using this module on a RHEL10 system, puppet changes files permissions every single run (and the sssd unit changes them back immediately on refresh):

Notice: /Stage[main]/Sssd::Config/File[/etc/sssd]/mode: mode changed '0750' to '0710' (go-rw) (corrective)
Notice: /Stage[main]/Sssd::Config/File[/etc/sssd/sssd.conf]/group: group changed 'sssd' to 'root' (corrective)
Notice: /Stage[main]/Sssd::Config/File[/etc/sssd/sssd.conf]/mode: mode changed '0640' to '0600' (corrective)
Info: /Stage[main]/Sssd::Config/File[/etc/sssd/sssd.conf]: Scheduling refresh of Class[Sssd::Service]
Info: /Stage[main]/Sssd::Config/File[/etc/sssd/sssd.conf]: Scheduling refresh of Class[Sssd::Service]
Notice: /Stage[main]/Sssd::Service::Nss/Sssd::Config::Entry[puppet_service_nss]/File[/etc/sssd/conf.d/50_puppet_service_nss.conf]/group: group changed 'sssd' to 'root' (corrective)
Notice: /Stage[main]/Sssd::Service::Nss/Sssd::Config::Entry[puppet_service_nss]/File[/etc/sssd/conf.d/50_puppet_service_nss.conf]/mode: mode changed '0640' to '0600' (corrective)
Info: /Stage[main]/Sssd::Service::Nss/Sssd::Config::Entry[puppet_service_nss]/File[/etc/sssd/conf.d/50_puppet_service_nss.conf]: Scheduling refresh of Class[Sssd::Service]
Info: /Stage[main]/Sssd::Service::Nss/Sssd::Config::Entry[puppet_service_nss]/File[/etc/sssd/conf.d/50_puppet_service_nss.conf]: Scheduling refresh of Class[Sssd::Service]
Notice: /Stage[main]/Sssd::Service::Pam/Sssd::Config::Entry[puppet_service_pam]/File[/etc/sssd/conf.d/50_puppet_service_pam.conf]/group: group changed 'sssd' to 'root' (corrective)
Notice: /Stage[main]/Sssd::Service::Pam/Sssd::Config::Entry[puppet_service_pam]/File[/etc/sssd/conf.d/50_puppet_service_pam.conf]/mode: mode changed '0640' to '0600' (corrective)
Info: /Stage[main]/Sssd::Service::Pam/Sssd::Config::Entry[puppet_service_pam]/File[/etc/sssd/conf.d/50_puppet_service_pam.conf]: Scheduling refresh of Class[Sssd::Service]
Info: /Stage[main]/Sssd::Service::Pam/Sssd::Config::Entry[puppet_service_pam]/File[/etc/sssd/conf.d/50_puppet_service_pam.conf]: Scheduling refresh of Class[Sssd::Service]
Notice: /Stage[main]/Base::Accounts/Sssd::Domain[epfl.ch]/Sssd::Config::Entry[puppet_domain_example.com]/File[/etc/sssd/conf.d/50_puppet_domain_example.com.conf]/group: group changed 'sssd' to 'root' (corrective)
Notice: /Stage[main]/Base::Accounts/Sssd::Domain[example.com]/Sssd::Config::Entry[puppet_domain_example.com]/File[/etc/sssd/conf.d/50_puppet_domain_example.com.conf]/mode: mode changed '0640' to '0600' (corrective)
Info: /Stage[main]/Base::Accounts/Sssd::Domain[example.com]/Sssd::Config::Entry[puppet_domain_example.com]/File[/etc/sssd/conf.d/50_puppet_domain_example.com.conf]: Scheduling refresh of Class[Sssd::Service]
Info: /Stage[main]/Base::Accounts/Sssd::Domain[example.com]/Sssd::Config::Entry[puppet_domain_example.com]/File[/etc/sssd/conf.d/50_puppet_domain_example.com.conf]: Scheduling refresh of Class[Sssd::Service]
Notice: /Stage[main]/Base::Accounts/Sssd::Provider::Ldap[example.com]/Sssd::Config::Entry[puppet_provider_example.com_ldap]/File[/etc/sssd/conf.d/50_puppet_provider_example.com_ldap.conf]/group: group changed 'sssd' to 'root' (corrective)
Notice: /Stage[main]/Base::Accounts/Sssd::Provider::Ldap[example.com]/Sssd::Config::Entry[puppet_provider_example.com_ldap]/File[/etc/sssd/conf.d/50_puppet_provider_example.com_ldap.conf]/mode: mode changed '0640' to '0600' (corrective)
Info: /Stage[main]/Base::Accounts/Sssd::Provider::Ldap[example.com]/Sssd::Config::Entry[puppet_provider_example.com_ldap]/File[/etc/sssd/conf.d/50_puppet_provider_example.com_ldap.conf]: Scheduling refresh of Class[Sssd::Service]
Info: /Stage[main]/Base::Accounts/Sssd::Provider::Ldap[example.com]/Sssd::Config::Entry[puppet_provider_example.com_ldap]/File[/etc/sssd/conf.d/50_puppet_provider_example.com_ldap.conf]: Scheduling refresh of Class[Sssd::Service]
Info: Class[Sssd::Service]: Scheduling refresh of Service[sssd]
Notice: /Stage[main]/Sssd::Service/Service[sssd]: Triggered 'refresh' from 1 event
Info: Stage[main]: Unscheduling all events on Stage[main]

When using the following manifest:

  class { 'sssd::service::nss':
    default_shell    => '/bin/bash',
    override_shell   => '/bin/bash',
    fallback_homedir => '/home/%u',
  }
  class { 'sssd':
    cache_credentials => false,
    domains           => [
      'example.com',
    ],
    services          => [
      'nss',
      'pam',
    ],
  }
  sssd::domain { 'example.com':
    id_provider               => 'ldap',
    use_fully_qualified_names => false,
  }
  sssd::provider::ldap { 'example.com':
    client_tls                     => false,
    krb5_canonicalize              => false,
    krb5_use_kdcinfo               => false,
    ldap_chpass_update_last_change => false,
    ldap_id_mapping                => false,
    ldap_id_use_start_tls          => false,
    ldap_idmap_autorid_compat      => false,
    ldap_krb5_init_creds           => false,
    ldap_referrals                 => false,
    ldap_sudo_include_netgroups    => false,
    ldap_sudo_include_regexp       => false,
    ldap_sudo_use_host_filter      => false,
    ldap_use_tokengroups           => false,
    ldap_user_search_base          => inline_template($ldap_user_search_filter),
    ldap_group_search_base         => inline_template($ldap_group_search_filter),
    ldap_uri                       => ['ldaps://example.com'],
    ldap_tls_reqcert               => 'allow',
    ldap_group_member              => 'member',
    ldap_group_object_class        => 'groupOfNames',
    ldap_schema                    => 'rfc2307bis',
  }