diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml
index 9a0f295..34b4230 100644
--- a/inventory/group_vars/all.yml
+++ b/inventory/group_vars/all.yml
@@ -59,6 +59,27 @@ ntp_restrict:
   - '127.0.0.1'
   - '::1'
 
+# SSSD & OpenLDAP core settings
+sssd_domain_name: "metaunix"
+openldap_host: "ldap.int.metaunix.net"
+openldap_port: 636
+openldap_use_starttls: false
+openldap_search_base: "dc=metaunix,dc=net"
+openldap_schema: "rfc2307bis"
+
+# TLS / Certificate validation
+sssd_disable_tls_verify: true
+
+# Behavior & Performance
+sssd_enable_mkhomedir: true
+sssd_cache_credentials: true
+sssd_enumerate: false
+sssd_default_shell: "/bin/bash"
+
+# Bind Account (referencing vaulted secret below)
+openldap_bind_dn: "cn=sssd-service,ou=Services,dc=internal,dc=local"
+openldap_bind_password: "{{ vault_openldap_bind_password }}"
+
 sudoers_sudoers:
   privileges:
     - name: '%sudo'
diff --git a/playbooks/auth.yml b/playbooks/auth.yml
index 8ed7bf6..a9d6d24 100644
--- a/playbooks/auth.yml
+++ b/playbooks/auth.yml
@@ -1,5 +1,12 @@
 ---
 
+- name: Install and configure SSSD
+  hosts: all
+  become: true
+
+  roles:
+    - gballan.sssd
+
 - name: Configure sudoers
   hosts: all
   become: true