diff --git a/roles/ipa/client/tasks/main.yml b/roles/ipa/client/tasks/main.yml
index aa85d44651..96b2bf393a 100644
--- a/roles/ipa/client/tasks/main.yml
+++ b/roles/ipa/client/tasks/main.yml
@@ -74,7 +74,7 @@
   run_once: yes
 
 - name: Ensure that nss knows to skip certain users
-  template: src=fedora-nss-ignore.conf.j2 dest=/etc/sssd/conf.d/fedora-nss-ignore.conf mode=600 owner=root group=root
+  template: src=fedora-nss-ignore.conf.j2 dest=/etc/sssd/conf.d/fedora-nss-ignore.conf mode=600 owner=sssd group=sssd
   tags:
   - ipa/client
   - config