diff --git a/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf
new file mode 100644
index 0000000..91c9fe9
--- /dev/null
+++ b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf
@@ -0,0 +1,6 @@
+passwd:     {if "with-files-domain":sss files|files sss} systemd   {exclude if "with-custom-passwd"}
+group:      {if "with-files-domain":sss files|files sss} systemd   {exclude if "with-custom-group"}
+netgroup:   sss files           {exclude if "with-custom-netgroup"}
+automount:  sss files           {exclude if "with-custom-automount"}
+services:   sss files           {exclude if "with-custom-services"}
+sudoers:    files sss           {include if "with-sudo"}
diff --git a/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth
new file mode 100644
index 0000000..6e17e8a
--- /dev/null
+++ b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth
@@ -0,0 +1,40 @@
+{imply "with-smartcard" if "with-smartcard-required"}
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        required                                     pam_faillock.so preauth audit silent deny=5 unlock_time=900 {include if "with-faillock"}
+auth        [success=1 default=ignore]                   pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"}
+auth        [success=done ignore=ignore default=die]     pam_sss.so require_cert_auth ignore_authinfo_unavail   {include if "with-smartcard-required"}
+auth        sufficient                                   pam_fprintd.so                                         {include if "with-fingerprint"}
+auth        sufficient                                   pam_u2f.so cue                                         {include if "with-pam-u2f"}
+auth        required                                     pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
+auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
+auth        [default=1 ignore=ignore success=ok]         pam_localuser.so                                       {exclude if "with-smartcard"}
+auth        [default=2 ignore=ignore success=ok]         pam_localuser.so                                       {include if "with-smartcard"}
+auth        [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth           {include if "with-smartcard"}
+auth        sufficient                                   pam_unix.so {if not "without-nullok":nullok} try_first_pass
+auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
+auth        sufficient                                   pam_sss.so forward_pass
+auth        required                                     pam_faillock.so authfail audit deny=5 unlock_time=900 fail_interval=900       {include if "with-faillock"}
+auth        required                                     pam_deny.so
+
+account     required                                     pam_access.so                                          {include if "with-pamaccess"}
+account     required                                     pam_faillock.so                                        {include if "with-faillock"}
+account     required                                     pam_unix.so
+account     sufficient                                   pam_localuser.so                                       {exclude if "with-files-access-provider"}
+account     sufficient                                   pam_usertype.so issystem
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+account     required                                     pam_permit.so
+
+password    requisite                                    pam_pwquality.so try_first_pass local_users_only minlen=14 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1 retry=3
+password    requisite                                    pam_pwhistory.so use_authok remember=5
+password    sufficient                                   pam_unix.so sha512 shadow {if not "without-nullok":nullok} try_first_pass use_authtok
+password    sufficient                                   pam_sss.so use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     optional                                     pam_oddjob_mkhomedir.so umask=0077                    {include if "with-mkhomedir"}
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     required                                     pam_unix.so
+session     optional                                     pam_sss.so
diff --git a/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf
new file mode 120000
index 0000000..1ff8004
--- /dev/null
+++ b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf
@@ -0,0 +1 @@
+RedHat-9-nsswitch.conf
\ No newline at end of file
diff --git a/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth
new file mode 120000
index 0000000..cbddfcd
--- /dev/null
+++ b/ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth
@@ -0,0 +1 @@
+RedHat-9-system-auth
\ No newline at end of file