---
# Reconcile the UniFi controller SSO login setting
# (super_sdn.sso_login_enabled = "Sync Local Admin with Ubiquiti SSO").
#
# Safe by default: run with --check for a read-only status report, or supply
# unifi_sso_confirm=true to apply the declared target value.
#
#   # Read-only status
#   ansible-playbook playbooks/unifi-sso.yml --limit ubnt --check
#
#   # Apply (disable SSO login; local accounts use local passwords, no MFA)
#   ansible-playbook playbooks/unifi-sso.yml --limit ubnt \
#     -e '{"unifi_sso_confirm": true, "unifi_sso_target_value": false}'
#
#   # Rollback (re-enable SSO login)
#   ansible-playbook playbooks/unifi-sso.yml --limit ubnt \
#     -e '{"unifi_sso_confirm": true, "unifi_sso_target_value": true}'
- name: Reconcile UniFi SSO login setting
  hosts: unifi
  become: true
  gather_facts: false
  serial: 1
  roles:
    - role: unifi_sso
      tags: [unifi, sso, mutating]