ldap/kerberos & sssd - conflicting options

[Sauraus]

I was just reading this thread https://bugzilla.redhat.com/show_bug.cgi?id=1001021 and I am wondering how the cookbook should handle this.

From the thread it looks like if you want all 3 services playing nicely you must enfore:
['authconfig']['kerberos']['realmdns'] = false

[jcam]

is it enough to document the requirement? Maybe have it log an error if set incorrectly? I generally like to avoid having the cookbooks do too much for you under the hood that is unexpected.

[Sauraus]

I feel like that having some logic that 'breaks' the run if both settings are set is the best method, besides referring to the authconfig docs.