Perhaps one can use the validate= setting when templating sssd.conf (when RHEL 7.3 is out)

[martbhell]

https://github.com/mhakala/ansible-role-adauth/blob/master/tasks/redhat.yml#L42

From RHEL7.3 beta release notes:

SSSD configuration file validation

Previously, the System Security Services Daemon (SSSD) did not provide a tool to manually check the /etc/sssd/sssd.conf file. As a consequence, the administrator had to find the problem in the configuration file if the service failed to start. This update provides the config-check option of the sssctl command to locate problems in the configuration file.