diff --git a/site/profile/manifests/core/common.pp b/site/profile/manifests/core/common.pp
index debc57da4a..c59babd1c3 100644
--- a/site/profile/manifests/core/common.pp
+++ b/site/profile/manifests/core/common.pp
@@ -85,6 +85,8 @@
   include timezone
   include tuned
 
+  Class['easy_ipa'] -> Class['ssh']
+
   if fact('os.family') == 'RedHat' {
     include epel
     include profile::core::yum
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 02a6fe074c..43977ee0b1 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -159,6 +159,8 @@ def node_files
     include_examples 'krb5.conf.d files', facts: facts
     include_examples 'sssd services'
 
+    it { is_expected.to contain_class('ssh').that_requires('Class[easy_ipa]') }
+
     it do
       # XXX dev is using ls ipa servers
       next if site == 'dev'