internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-25 00:44:42 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #975 from t-woerner/fix_ipareplica_role_for_ansible_test

Browse Source 
Fix ipareplica role for ansible test
This commit is contained in:
Rafael Guterres Jeffman
2022-11-18 11:21:15 -03:00
committed by GitHub
parent ef11e75944 7627c57c4a
commit 9423eb81b7
25 changed files with 1515 additions and 966 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
roles/ipareplica/library/ipareplica_add_to_ipaservers.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,21 +40,26 @@ description:
options: options:
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
installer_ccache: installer_ccache:
description: The installer ccache setting description: The installer ccache setting
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -67,7 +72,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, paths, check_imports, AnsibleModuleLog, setup_logging, installer, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_remote_api, api gen_remote_api, api
) )
@@ -84,15 +89,16 @@ def main():
# server # server
setup_kra=dict(required=True, type='bool'), setup_kra=dict(required=True, type='bool'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
installer_ccache=dict(required=True), installer_ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

133
roles/ipareplica/library/ipareplica_create_ipa_conf.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,92 +40,123 @@ description:
options: options:
dm_password: dm_password:
description: Directory Manager password description: Directory Manager password
required: yes type: str
required: no
password: password:
description: Admin user kerberos password description: Admin user kerberos password
required: yes type: str
required: no
ip_addresses: ip_addresses:
description: List of Master Server IP Addresses description: List of Master Server IP Addresses
required: yes type: list
elements: str
required: no
domain: domain:
description: Primary DNS domain of the IPA deployment description: Primary DNS domain of the IPA deployment
required: yes type: str
required: no
realm: realm:
description: Kerberos realm name of the IPA deployment description: Kerberos realm name of the IPA deployment
required: yes type: str
required: no
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
ca_cert_files: ca_cert_files:
description: description:
List of files containing CA certificates for the service certificate List of files containing CA certificates for the service certificate
files files
required: yes type: list
elements: str
required: no
no_host_dns: no_host_dns:
description: Do not use DNS for hostname lookup during installation description: Do not use DNS for hostname lookup during installation
required: yes type: bool
default: no
required: no
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
required: yes type: bool
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
required: no
dirsrv_cert_files: dirsrv_cert_files:
description: description:
Files containing the Directory Server SSL certificate and private key Files containing the Directory Server SSL certificate and private key
required: yes type: list
elements: str
required: no
force_join: force_join:
description: Force client enrollment even if already enrolled description: Force client enrollment even if already enrolled
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
server: server:
description: Fully qualified name of IPA server to enroll to description: Fully qualified name of IPA server to enroll to
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
config_ca_host_name: config_ca_host_name:
description: The config ca_host_name setting description: The config ca_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
installer_ccache: installer_ccache:
description: The installer ccache setting description: The installer ccache setting
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
_add_to_ipaservers: _add_to_ipaservers:
description: The installer _add_to_ipaservers setting description: The installer _add_to_ipaservers setting
required: no type: bool
required: yes
_ca_subject: _ca_subject:
description: The installer _ca_subject setting description: The installer _ca_subject setting
required: no type: str
required: yes
_subject_base: _subject_base:
description: The installer _subject_base setting description: The installer _subject_base setting
required: no type: str
required: yes
master: master:
description: Master host name description: Master host name
required: yes type: str
required: no
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -138,7 +169,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
ansible_module_get_parsed_ip_addresses, sysrestore, ansible_module_get_parsed_ip_addresses, sysrestore,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, create_ipa_conf gen_ReplicaConfig, gen_remote_api, create_ipa_conf
@@ -149,13 +180,15 @@ def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
dm_password=dict(required=False, no_log=True), dm_password=dict(required=False, type='str', no_log=True),
password=dict(required=False, no_log=True), password=dict(required=False, type='str', no_log=True),
ip_addresses=dict(required=False, type='list', default=[]), ip_addresses=dict(required=False, type='list', elements='str',
domain=dict(required=False), default=[]),
realm=dict(required=False), domain=dict(required=False, type='str'),
hostname=dict(required=False), realm=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', default=[]), hostname=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', elements='str',
default=[]),
no_host_dns=dict(required=False, type='bool', default=False), no_host_dns=dict(required=False, type='bool', default=False),
# server # server
setup_adtrust=dict(required=False, type='bool'), setup_adtrust=dict(required=False, type='bool'),
@@ -163,30 +196,32 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
setup_dns=dict(required=False, type='bool'), setup_dns=dict(required=False, type='bool'),
# ssl certificate # ssl certificate
dirsrv_cert_files=dict(required=False, type='list', default=[]), dirsrv_cert_files=dict(required=False, type='list', elements='str',
default=[]),
# client # client
force_join=dict(required=False, type='bool'), force_join=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
server=dict(required=True), server=dict(required=True, type='str'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
config_ca_host_name=dict(required=True), config_ca_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
installer_ccache=dict(required=True), installer_ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
_add_to_ipaservers=dict(required=True, type='bool'), _add_to_ipaservers=dict(required=True, type='bool'),
_ca_subject=dict(required=True), _ca_subject=dict(required=True, type='str'),
_subject_base=dict(required=True), _subject_base=dict(required=True, type='str'),
master=dict(required=False, default=None), master=dict(required=False, type='str', default=None),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

70
roles/ipareplica/library/ipareplica_custodia_import_dm_password.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,53 +40,68 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
no_ui_redirect: no_ui_redirect:
description: Do not automatically redirect to the Web UI description: Do not automatically redirect to the Web UI
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_kra_enabled: _kra_enabled:
description: The installer _kra_enabled setting description: The installer _kra_enabled setting
required: yes type: bool
required: no
_kra_host_name: _kra_host_name:
description: The installer _kra_host_name setting description: The installer _kra_host_name setting
required: yes type: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
config_setup_ca: config_setup_ca:
description: The config setup_ca setting description: The config setup_ca setting
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
config_ca_host_name: config_ca_host_name:
description: The config ca_host_name setting description: The config ca_host_name setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -99,7 +114,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, redirect_stdout, custodiainstance, gen_ReplicaConfig, gen_remote_api, redirect_stdout, custodiainstance,
getargspec getargspec
@@ -115,23 +130,24 @@ def main():
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
no_ui_redirect=dict(required=False, type='bool'), no_ui_redirect=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_kra_enabled=dict(required=False, type='bool'), _kra_enabled=dict(required=False, type='bool'),
_kra_host_name=dict(required=False), _kra_host_name=dict(required=False, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
config_setup_ca=dict(required=True, type='bool'), config_setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
config_ca_host_name=dict(required=True), config_ca_host_name=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

78
roles/ipareplica/library/ipareplica_ds_apply_updates.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,55 +40,72 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
no_ui_redirect: no_ui_redirect:
description: Do not automatically redirect to the Web UI description: Do not automatically redirect to the Web UI
required: yes type: bool
required: no
dirsrv_config_file: dirsrv_config_file:
description: description:
The path to LDIF file that will be used to modify configuration of The path to LDIF file that will be used to modify configuration of
dse.ldif during installation of the directory server instance dse.ldif during installation of the directory server instance
required: yes type: str
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_dirsrv_pkcs12_info: _dirsrv_pkcs12_info:
description: The installer _dirsrv_pkcs12_info setting description: The installer _dirsrv_pkcs12_info setting
required: yes type: list
elements: str
required: no
_pkinit_pkcs12_info: _pkinit_pkcs12_info:
description: The installer _pkinit_pkcs12_info setting description: The installer _pkinit_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
ds_ca_subject: ds_ca_subject:
description: The ds.ca_subject setting description: The ds.ca_subject setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -101,7 +118,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout,
replica_ds_init_info, dsinstance, upgradeinstance, installutils replica_ds_init_info, dsinstance, upgradeinstance, installutils
@@ -116,24 +133,27 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
no_ui_redirect=dict(required=False, type='bool'), no_ui_redirect=dict(required=False, type='bool'),
dirsrv_config_file=dict(required=False), dirsrv_config_file=dict(required=False, type='str'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_dirsrv_pkcs12_info=dict(required=False, type='list'), _dirsrv_pkcs12_info=dict(required=False, type='list',
_pkinit_pkcs12_info=dict(required=False, type='list'), elements='str'),
_top_dir=dict(required=True), _pkinit_pkcs12_info=dict(required=False, type='list',
dirman_password=dict(required=True, no_log=True), elements='str'),
ds_ca_subject=dict(required=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, type='str', no_log=True),
ds_ca_subject=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

75
roles/ipareplica/library/ipareplica_ds_enable_ssl.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,52 +40,68 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
dirsrv_config_file: dirsrv_config_file:
description: description:
The path to LDIF file that will be used to modify configuration of The path to LDIF file that will be used to modify configuration of
dse.ldif during installation of the directory server instance dse.ldif during installation of the directory server instance
required: yes type: str
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_dirsrv_pkcs12_info: _dirsrv_pkcs12_info:
description: The installer _dirsrv_pkcs12_info setting description: The installer _dirsrv_pkcs12_info setting
required: yes type: list
elements: str
required: no
_pkinit_pkcs12_info: _pkinit_pkcs12_info:
description: The installer _pkinit_pkcs12_info setting description: The installer _pkinit_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
ds_ca_subject: ds_ca_subject:
description: The ds.ca_subject setting description: The ds.ca_subject setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -98,7 +114,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout,
replica_ds_init_info replica_ds_init_info
@@ -112,24 +128,27 @@ def main():
setup_ca=dict(required=False, type='bool'), setup_ca=dict(required=False, type='bool'),
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
dirsrv_config_file=dict(required=False), dirsrv_config_file=dict(required=False, type='str'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_dirsrv_pkcs12_info=dict(required=False, type='list'), _dirsrv_pkcs12_info=dict(required=False, type='list',
_pkinit_pkcs12_info=dict(required=False, type='list'), elements='str'),
_top_dir=dict(required=True), _pkinit_pkcs12_info=dict(required=False, type='list',
dirman_password=dict(required=True, no_log=True), elements='str'),
ds_ca_subject=dict(required=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, type='str', no_log=True),
ds_ca_subject=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

44
roles/ipareplica/library/ipareplica_enable_ipa.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,32 +40,41 @@ description: Enable IPA
options: options:
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
hidden_replica: hidden_replica:
description: Install a hidden replica description: Install a hidden replica
required: yes type: bool
default: no
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: no type: bool
required: yes
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -78,7 +87,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, service, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, service,
find_providing_servers, services find_providing_servers, services
@@ -88,22 +97,23 @@ from ansible.module_utils.ansible_ipa_replica import (
def main(): def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
hostname=dict(required=False), hostname=dict(required=False, type='str'),
hidden_replica=dict(required=False, type='bool', default=False), hidden_replica=dict(required=False, type='bool', default=False),
# server # server
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
setup_ca=dict(required=True, type='bool'), setup_ca=dict(required=True, type='bool'),
setup_kra=dict(required=True, type='bool'), setup_kra=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

139
roles/ipareplica/library/ipareplica_install_ca_certs.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -33,99 +33,131 @@ ANSIBLE_METADATA = {
DOCUMENTATION = ''' DOCUMENTATION = '''
--- ---
module: ipareplica_install_ca_cert module: ipareplica_install_ca_certs
short_description: Install CA certs short_description: Install CA certs
description: description:
Install CA certs Install CA certs
options: options:
dm_password: dm_password:
description: Directory Manager password description: Directory Manager password
required: yes type: str
required: no
password: password:
description: Admin user kerberos password description: Admin user kerberos password
required: yes type: str
required: no
ip_addresses: ip_addresses:
description: List of Master Server IP Addresses description: List of Master Server IP Addresses
required: yes type: list
elements: str
required: no
domain: domain:
description: Primary DNS domain of the IPA deployment description: Primary DNS domain of the IPA deployment
required: yes type: str
required: no
realm: realm:
description: Kerberos realm name of the IPA deployment description: Kerberos realm name of the IPA deployment
required: yes type: str
required: no
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
ca_cert_files: ca_cert_files:
description: description:
List of files containing CA certificates for the service certificate List of files containing CA certificates for the service certificate
files files
required: yes type: list
elements: str
required: no
no_host_dns: no_host_dns:
description: Do not use DNS for hostname lookup during installation description: Do not use DNS for hostname lookup during installation
required: yes type: bool
default: no
required: no
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
required: yes type: bool
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
required: no
dirsrv_cert_files: dirsrv_cert_files:
description: description:
Files containing the Directory Server SSL certificate and private key Files containing the Directory Server SSL certificate and private key
required: yes type: list
elements: str
required: no
force_join: force_join:
description: Force client enrollment even if already enrolled description: Force client enrollment even if already enrolled
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
server: server:
description: Fully qualified name of IPA server to enroll to description: Fully qualified name of IPA server to enroll to
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
installer_ccache: installer_ccache:
description: The installer ccache setting description: The installer ccache setting
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
_add_to_ipaservers: _add_to_ipaservers:
description: The installer _add_to_ipaservers setting description: The installer _add_to_ipaservers setting
required: no type: bool
required: yes
_ca_subject: _ca_subject:
description: The installer _ca_subject setting description: The installer _ca_subject setting
required: no type: str
required: yes
_subject_base: _subject_base:
description: The installer _subject_base setting description: The installer _subject_base setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
config_setup_ca: config_setup_ca:
description: The config setup_ca setting description: The config setup_ca setting
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
config_ca_host_name: config_ca_host_name:
description: The config ca_host_name setting description: The config ca_host_name setting
required: no type: str
required: yes
config_ips: config_ips:
description: The config ips setting description: The config ips setting
required: yes type: list
elements: str
required: no
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -138,7 +170,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
ansible_module_get_parsed_ip_addresses, ansible_module_get_parsed_ip_addresses,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, ipaldap, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, ipaldap,
@@ -150,13 +182,15 @@ def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
dm_password=dict(required=False, no_log=True), dm_password=dict(required=False, type='str', no_log=True),
password=dict(required=False, no_log=True), password=dict(required=False, type='str', no_log=True),
ip_addresses=dict(required=False, type='list', default=[]), ip_addresses=dict(required=False, type='list', elements='str',
domain=dict(required=False), default=[]),
realm=dict(required=False), domain=dict(required=False, type='str'),
hostname=dict(required=False), realm=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', default=[]), hostname=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', elements='str',
default=[]),
no_host_dns=dict(required=False, type='bool', default=False), no_host_dns=dict(required=False, type='bool', default=False),
# server # server
setup_adtrust=dict(required=False, type='bool'), setup_adtrust=dict(required=False, type='bool'),
@@ -164,29 +198,32 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
setup_dns=dict(required=False, type='bool'), setup_dns=dict(required=False, type='bool'),
# ssl certificate # ssl certificate
dirsrv_cert_files=dict(required=False, type='list', default=[]), dirsrv_cert_files=dict(required=False, type='list', elements='str',
default=[]),
# client # client
force_join=dict(required=False, type='bool'), force_join=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
server=dict(required=True), server=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
installer_ccache=dict(required=True), installer_ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
_add_to_ipaservers=dict(required=True, type='bool'), _add_to_ipaservers=dict(required=True, type='bool'),
_ca_subject=dict(required=True), _ca_subject=dict(required=True, type='str'),
_subject_base=dict(required=True), _subject_base=dict(required=True, type='str'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
config_setup_ca=dict(required=True, type='bool'), config_setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
config_ca_host_name=dict(required=True), config_ca_host_name=dict(required=True, type='str'),
config_ips=dict(required=False, type='list', default=[]), config_ips=dict(required=False, type='list', elements='str',
default=[]),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

57
roles/ipareplica/library/ipareplica_krb_enable_ssl.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,41 +40,53 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_pkinit_pkcs12_info: _pkinit_pkcs12_info:
description: The installer _pkinit_pkcs12_info setting description: The installer _pkinit_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -87,6 +99,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
check_imports,
AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore, AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, krbinstance, redirect_stdout gen_ReplicaConfig, gen_remote_api, api, krbinstance, redirect_stdout
@@ -101,20 +114,22 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_pkinit_pkcs12_info=dict(required=False, type='list'), _pkinit_pkcs12_info=dict(required=False, type='list',
_top_dir=dict(required=True), elements='str'),
dirman_password=dict(required=True, no_log=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

15
roles/ipareplica/library/ipareplica_master_password.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-server-install code # Based on ipa-server-install code
# #
# Copyright (C) 2017 Red Hat # Copyright (C) 2017-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,9 +40,10 @@ description:
options: options:
master_password: master_password:
description: kerberos master password (normally autogenerated) description: kerberos master password (normally autogenerated)
required: yes type: str
required: no
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -51,12 +52,13 @@ EXAMPLES = '''
RETURN = ''' RETURN = '''
password: password:
description: The master password description: The master password
type: str
returned: always returned: always
''' '''
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
setup_logging, ipa_generate_password check_imports, setup_logging, ipa_generate_password
) )
@@ -64,12 +66,13 @@ def main():
module = AnsibleModule( module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
master_password=dict(required=False, no_log=True), master_password=dict(required=False, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
module._ansible_debug = True module._ansible_debug = True
check_imports(module)
setup_logging() setup_logging()
master_password = module.params.get('master_password') master_password = module.params.get('master_password')

220
roles/ipareplica/library/ipareplica_prepare.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -42,151 +42,216 @@ description: |
options: options:
dm_password: dm_password:
description: Directory Manager password description: Directory Manager password
required: yes type: str
required: no
password: password:
description: Admin user kerberos password description: Admin user kerberos password
required: yes type: str
required: no
ip_addresses: ip_addresses:
description: List of Master Server IP Addresses description: List of Master Server IP Addresses
required: yes type: list
elements: str
required: no
domain: domain:
description: Primary DNS domain of the IPA deployment description: Primary DNS domain of the IPA deployment
required: yes type: str
required: no
realm: realm:
description: Kerberos realm name of the IPA deployment description: Kerberos realm name of the IPA deployment
required: yes type: str
required: no
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
principal: principal:
description: description:
User Principal allowed to promote replicas and join IPA realm User Principal allowed to promote replicas and join IPA realm
required: no type: str
required: yes
ca_cert_files: ca_cert_files:
description: description:
List of files containing CA certificates for the service certificate List of files containing CA certificates for the service certificate
files files
required: yes type: list
elements: str
required: no
no_host_dns: no_host_dns:
description: Do not use DNS for hostname lookup during installation description: Do not use DNS for hostname lookup during installation
required: yes type: bool
default: no
required: no
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
required: yes type: bool
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
required: no
dirsrv_cert_files: dirsrv_cert_files:
description: description:
Files containing the Directory Server SSL certificate and private key Files containing the Directory Server SSL certificate and private key
required: yes type: list
elements: str
required: no
dirsrv_cert_name: dirsrv_cert_name:
description: Name of the Directory Server SSL certificate to install description: Name of the Directory Server SSL certificate to install
required: yes type: str
required: no
dirsrv_pin: dirsrv_pin:
description: The password to unlock the Directory Server private key description: The password to unlock the Directory Server private key
required: yes type: str
required: no
http_cert_files: http_cert_files:
description: description:
File containing the Apache Server SSL certificate and private key File containing the Apache Server SSL certificate and private key
required: yes type: list
elements: str
required: no
http_cert_name: http_cert_name:
description: Name of the Apache Server SSL certificate to install description: Name of the Apache Server SSL certificate to install
required: yes type: str
required: no
http_pin: http_pin:
description: The password to unlock the Apache Server private key description: The password to unlock the Apache Server private key
required: yes type: str
required: no
pkinit_cert_files: pkinit_cert_files:
description: description:
File containing the Kerberos KDC SSL certificate and private key File containing the Kerberos KDC SSL certificate and private key
required: yes type: list
elements: str
required: no
pkinit_cert_name: pkinit_cert_name:
description: Name of the Kerberos KDC SSL certificate to install description: Name of the Kerberos KDC SSL certificate to install
required: yes type: str
required: no
pkinit_pin: pkinit_pin:
description: The password to unlock the Kerberos KDC private key description: The password to unlock the Kerberos KDC private key
required: yes type: str
required: no
keytab: keytab:
description: Path to backed up keytab from previous enrollment description: Path to backed up keytab from previous enrollment
required: yes type: str
required: no
mkhomedir: mkhomedir:
description: Create home directories for users on their first login description: Create home directories for users on their first login
required: yes type: bool
required: no
force_join: force_join:
description: Force client enrollment even if already enrolled description: Force client enrollment even if already enrolled
required: yes type: bool
required: no
no_ntp: no_ntp:
description: Do not configure ntp description: Do not configure ntp
required: yes type: bool
required: no
ssh_trust_dns: ssh_trust_dns:
description: Configure OpenSSH client to trust DNS SSHFP records description: Configure OpenSSH client to trust DNS SSHFP records
required: yes type: bool
required: no
no_ssh: no_ssh:
description: Do not configure OpenSSH client description: Do not configure OpenSSH client
required: yes type: bool
required: no
no_sshd: no_sshd:
description: Do not configure OpenSSH server description: Do not configure OpenSSH server
required: yes type: bool
required: no
no_dns_sshfp: no_dns_sshfp:
description: Do not automatically create DNS SSHFP records description: Do not automatically create DNS SSHFP records
required: yes type: bool
required: no
allow_zone_overlap: allow_zone_overlap:
description: Create DNS zone even if it already exists description: Create DNS zone even if it already exists
required: yes type: bool
default: no
required: no
reverse_zones: reverse_zones:
description: The reverse DNS zones to use description: The reverse DNS zones to use
required: yes type: list
elements: str
required: no
no_reverse: no_reverse:
description: Do not create new reverse DNS zone description: Do not create new reverse DNS zone
required: yes type: bool
default: no
required: no
auto_reverse: auto_reverse:
description: Create necessary reverse zones description: Create necessary reverse zones
required: yes type: bool
default: no
required: no
forwarders: forwarders:
description: Add DNS forwarders description: Add DNS forwarders
required: yes type: list
elements: str
required: no
no_forwarders: no_forwarders:
description: Do not add any DNS forwarders, use root servers instead description: Do not add any DNS forwarders, use root servers instead
required: yes type: bool
default: no
required: no
auto_forwarders: auto_forwarders:
description: Use DNS forwarders configured in /etc/resolv.conf description: Use DNS forwarders configured in /etc/resolv.conf
required: yes type: bool
default: no
required: no
forward_policy: forward_policy:
description: DNS forwarding policy for global forwarders description: DNS forwarding policy for global forwarders
required: yes type: str
choices: ['first', 'only']
required: no
no_dnssec_validation: no_dnssec_validation:
description: Disable DNSSEC validation description: Disable DNSSEC validation
required: yes type: bool
default: no
required: no
enable_compat: enable_compat:
description: Enable support for trusted domains for old clients description: Enable support for trusted domains for old clients
required: yes type: bool
default: no
required: no
netbios_name: netbios_name:
description: NetBIOS name of the IPA domain description: NetBIOS name of the IPA domain
required: yes type: str
required: no
rid_base: rid_base:
description: Start value for mapping UIDs and GIDs to RIDs description: Start value for mapping UIDs and GIDs to RIDs
required: yes type: int
default: 1000
required: no
secondary_rid_base: secondary_rid_base:
description: description:
Start value of the secondary range for mapping UIDs and GIDs to RIDs Start value of the secondary range for mapping UIDs and GIDs to RIDs
required: yes type: int
default: 100000000
required: no
server: server:
description: Fully qualified name of IPA server to enroll to description: Fully qualified name of IPA server to enroll to
required: no type: str
required: yes
skip_conncheck: skip_conncheck:
description: Skip connection check to remote master description: Skip connection check to remote master
required: yes type: bool
required: no
sid_generation_always: sid_generation_always:
description: Enable SID generation always description: Enable SID generation always
required: yes type: bool
default: no
required: no
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -202,7 +267,7 @@ from shutil import copyfile
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, options, installer, DN, paths, sysrestore, check_imports, AnsibleModuleLog, options, installer, DN, paths, sysrestore,
ansible_module_get_parsed_ip_addresses, Env, ipautil, ipaldap, ansible_module_get_parsed_ip_addresses, Env, ipautil, ipaldap,
installutils, ReplicaConfig, load_pkcs12, kinit_keytab, create_api, installutils, ReplicaConfig, load_pkcs12, kinit_keytab, create_api,
rpc_client, check_remote_version, parse_version, check_remote_fips_mode, rpc_client, check_remote_version, parse_version, check_remote_fips_mode,
@@ -222,14 +287,16 @@ def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
dm_password=dict(required=False, no_log=True), dm_password=dict(required=False, type='str', no_log=True),
password=dict(required=False, no_log=True), password=dict(required=False, type='str', no_log=True),
ip_addresses=dict(required=False, type='list', default=[]), ip_addresses=dict(required=False, type='list', elements='str',
domain=dict(required=False), default=[]),
realm=dict(required=False), domain=dict(required=False, type='str'),
hostname=dict(required=False), realm=dict(required=False, type='str'),
principal=dict(required=True), hostname=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', default=[]), principal=dict(required=True, type='str'),
ca_cert_files=dict(required=False, type='list', elements='str',
default=[]),
no_host_dns=dict(required=False, type='bool', default=False), no_host_dns=dict(required=False, type='bool', default=False),
# server # server
setup_adtrust=dict(required=False, type='bool'), setup_adtrust=dict(required=False, type='bool'),
@@ -237,17 +304,20 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
setup_dns=dict(required=False, type='bool'), setup_dns=dict(required=False, type='bool'),
# ssl certificate # ssl certificate
dirsrv_cert_files=dict(required=False, type='list', default=[]), dirsrv_cert_files=dict(required=False, type='list', elements='str',
dirsrv_cert_name=dict(required=False), default=[]),
dirsrv_pin=dict(required=False), dirsrv_cert_name=dict(required=False, type='str'),
http_cert_files=dict(required=False, type='list', default=[]), dirsrv_pin=dict(required=False, type='str'),
http_cert_name=dict(required=False), http_cert_files=dict(required=False, type='list', elements='str',
http_pin=dict(required=False), default=[]),
pkinit_cert_files=dict(required=False, type='list', default=[]), http_cert_name=dict(required=False, type='str'),
pkinit_cert_name=dict(required=False), http_pin=dict(required=False, type='str'),
pkinit_pin=dict(required=False), pkinit_cert_files=dict(required=False, type='list', elements='str',
default=[]),
pkinit_cert_name=dict(required=False, type='str'),
pkinit_pin=dict(required=False, type='str'),
# client # client
keytab=dict(required=False), keytab=dict(required=False, type='str', no_log=False),
mkhomedir=dict(required=False, type='bool'), mkhomedir=dict(required=False, type='bool'),
force_join=dict(required=False, type='bool'), force_join=dict(required=False, type='bool'),
no_ntp=dict(required=False, type='bool'), no_ntp=dict(required=False, type='bool'),
@@ -260,31 +330,35 @@ def main():
# dns # dns
allow_zone_overlap=dict(required=False, type='bool', allow_zone_overlap=dict(required=False, type='bool',
default=False), default=False),
reverse_zones=dict(required=False, type='list', default=[]), reverse_zones=dict(required=False, type='list', elements='str',
default=[]),
no_reverse=dict(required=False, type='bool', default=False), no_reverse=dict(required=False, type='bool', default=False),
auto_reverse=dict(required=False, type='bool', default=False), auto_reverse=dict(required=False, type='bool', default=False),
forwarders=dict(required=False, type='list', default=[]), forwarders=dict(required=False, type='list', elements='str',
default=[]),
no_forwarders=dict(required=False, type='bool', default=False), no_forwarders=dict(required=False, type='bool', default=False),
auto_forwarders=dict(required=False, type='bool', default=False), auto_forwarders=dict(required=False, type='bool', default=False),
forward_policy=dict(default=None, choices=['first', 'only']), forward_policy=dict(required=False, type='str',
choices=['first', 'only'], default=None),
no_dnssec_validation=dict(required=False, type='bool', no_dnssec_validation=dict(required=False, type='bool',
default=False), default=False),
# ad trust # ad trust
enable_compat=dict(required=False, type='bool', default=False), enable_compat=dict(required=False, type='bool', default=False),
netbios_name=dict(required=False), netbios_name=dict(required=False, type='str'),
rid_base=dict(required=False, type='int', default=1000), rid_base=dict(required=False, type='int', default=1000),
secondary_rid_base=dict(required=False, type='int', secondary_rid_base=dict(required=False, type='int',
default=100000000), default=100000000),
# additional # additional
server=dict(required=True), server=dict(required=True, type='str'),
skip_conncheck=dict(required=False, type='bool'), skip_conncheck=dict(required=False, type='bool'),
sid_generation_always=dict(required=False, type='bool', sid_generation_always=dict(required=False, type='bool',
default=False), default=False),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

35
roles/ipareplica/library/ipareplica_promote_openldap_conf.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,26 +40,32 @@ description:
options: options:
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
config_setup_ca: config_setup_ca:
description: The config setup_ca setting description: The config setup_ca setting
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -72,7 +78,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, redirect_stdout, promote_openldap_conf gen_ReplicaConfig, gen_remote_api, redirect_stdout, promote_openldap_conf
) )
@@ -84,17 +90,18 @@ def main():
# server # server
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
config_setup_ca=dict(required=True, type='bool'), config_setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

35
roles/ipareplica/library/ipareplica_promote_sssd.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,26 +40,32 @@ description:
options: options:
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
config_setup_ca: config_setup_ca:
description: The config setup_ca setting description: The config setup_ca setting
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -72,7 +78,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, redirect_stdout, promote_sssd gen_ReplicaConfig, gen_remote_api, redirect_stdout, promote_sssd
) )
@@ -84,17 +90,18 @@ def main():
# server # server
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
config_setup_ca=dict(required=True, type='bool'), config_setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

50
roles/ipareplica/library/ipareplica_restart_kdc.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,38 +40,48 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
no_ui_redirect: no_ui_redirect:
description: Do not automatically redirect to the Web UI description: Do not automatically redirect to the Web UI
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -84,6 +94,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
check_imports,
AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore, AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, service, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, service,
@@ -100,18 +111,19 @@ def main():
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
no_ui_redirect=dict(required=False, type='bool'), no_ui_redirect=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

55
roles/ipareplica/library/ipareplica_setup_adtrust.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,45 +40,58 @@ description:
options: options:
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
enable_compat: enable_compat:
description: Enable support for trusted domains for old clients description: Enable support for trusted domains for old clients
required: yes type: bool
default: no
required: no
rid_base: rid_base:
description: Start value for mapping UIDs and GIDs to RIDs description: Start value for mapping UIDs and GIDs to RIDs
required: yes type: int
required: no
secondary_rid_base: secondary_rid_base:
description: description:
Start value of the secondary range for mapping UIDs and GIDs to RIDs Start value of the secondary range for mapping UIDs and GIDs to RIDs
required: yes type: int
required: no
adtrust_netbios_name: adtrust_netbios_name:
description: The adtrust netbios_name setting description: The adtrust netbios_name setting
required: no type: str
required: yes
adtrust_reset_netbios_name: adtrust_reset_netbios_name:
description: The adtrust reset_netbios_name setting description: The adtrust reset_netbios_name setting
required: no type: bool
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: no type: bool
required: yes
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
type: bool
required: yes required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -93,7 +106,8 @@ from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore, AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, adtrust gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, adtrust,
check_imports
) )
@@ -103,25 +117,26 @@ def main():
# server # server
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# ad trust # ad trust
enable_compat=dict(required=False, type='bool', default=False), enable_compat=dict(required=False, type='bool', default=False),
rid_base=dict(required=False, type='int'), rid_base=dict(required=False, type='int'),
secondary_rid_base=dict(required=False, type='int'), secondary_rid_base=dict(required=False, type='int'),
# additional # additional
adtrust_netbios_name=dict(required=True), adtrust_netbios_name=dict(required=True, type='str'),
adtrust_reset_netbios_name=dict(required=True, type='bool'), adtrust_reset_netbios_name=dict(required=True, type='bool'),
# additional # additional
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
setup_ca=dict(required=True, type='bool'), setup_ca=dict(required=True, type='bool'),
setup_adtrust=dict(required=True, type='bool'), setup_adtrust=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

104
roles/ipareplica/library/ipareplica_setup_ca.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,71 +40,95 @@ description:
options: options:
pki_config_override: pki_config_override:
description: Path to ini file with config overrides description: Path to ini file with config overrides
required: yes type: str
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_kra_enabled: _kra_enabled:
description: The installer _kra_enabled setting description: The installer _kra_enabled setting
required: yes type: bool
required: no
_kra_host_name: _kra_host_name:
description: The installer _kra_host_name setting description: The installer _kra_host_name setting
required: yes type: str
required: no
_dirsrv_pkcs12_info: _dirsrv_pkcs12_info:
description: The installer _dirsrv_pkcs12_info setting description: The installer _dirsrv_pkcs12_info setting
required: yes type: list
elements: str
required: no
_pkinit_pkcs12_info: _pkinit_pkcs12_info:
description: The installer _pkinit_pkcs12_info setting description: The installer _pkinit_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
_ca_subject: _ca_subject:
description: The installer _ca_subject setting description: The installer _ca_subject setting
required: no type: str
required: yes
_subject_base: _subject_base:
description: The installer _subject_base setting description: The installer _subject_base setting
required: no type: str
required: yes
_random_serial_numbers: _random_serial_numbers:
description: The installer _random_serial_numbers setting description: The installer _random_serial_numbers setting
type: bool
required: yes required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
config_setup_ca: config_setup_ca:
description: The config setup_ca setting description: The config setup_ca setting
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
config_ca_host_name: config_ca_host_name:
description: The config ca_host_name setting description: The config ca_host_name setting
required: no type: str
required: yes
config_ips: config_ips:
description: The config ips setting description: The config ips setting
required: yes type: list
elements: str
required: no
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -117,7 +141,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
ansible_module_get_parsed_ip_addresses, ansible_module_get_parsed_ip_addresses,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, ca, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, ca,
@@ -129,35 +153,39 @@ def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
pki_config_override=dict(required=False), pki_config_override=dict(required=False, type='str'),
# server # server
setup_ca=dict(required=False, type='bool'), setup_ca=dict(required=False, type='bool'),
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_kra_enabled=dict(required=False, type='bool'), _kra_enabled=dict(required=False, type='bool'),
_kra_host_name=dict(required=False), _kra_host_name=dict(required=False, type='str'),
_dirsrv_pkcs12_info=dict(required=False, type='list'), _dirsrv_pkcs12_info=dict(required=False, type='list',
_pkinit_pkcs12_info=dict(required=False, type='list'), elements='str'),
_top_dir=dict(required=True), _pkinit_pkcs12_info=dict(required=False, type='list',
_ca_subject=dict(required=True), elements='str'),
_subject_base=dict(required=True), _top_dir=dict(required=True, type='str'),
_ca_subject=dict(required=True, type='str'),
_subject_base=dict(required=True, type='str'),
_random_serial_numbers=dict(required=True, type='bool'), _random_serial_numbers=dict(required=True, type='bool'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
config_setup_ca=dict(required=True, type='bool'), config_setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
config_ca_host_name=dict(required=True), config_ca_host_name=dict(required=True, type='str'),
config_ips=dict(required=False, type='list', default=[]), config_ips=dict(required=False, type='list', elements='str',
default=[]),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

9
roles/ipareplica/library/ipareplica_setup_certmonger.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -37,9 +37,8 @@ module: ipareplica_setup_certmonger
short_description: Setup certmonger short_description: Setup certmonger
description: description:
Setup certmonger Setup certmonger
options:
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -50,6 +49,7 @@ RETURN = '''
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
check_imports,
AnsibleModuleLog, setup_logging, redirect_stdout, configure_certmonger AnsibleModuleLog, setup_logging, redirect_stdout, configure_certmonger
) )
@@ -57,10 +57,11 @@ from ansible.module_utils.ansible_ipa_replica import (
def main(): def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec={}, argument_spec={},
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

69
roles/ipareplica/library/ipareplica_setup_custodia.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,50 +40,65 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
no_ui_redirect: no_ui_redirect:
description: Do not automatically redirect to the Web UI description: Do not automatically redirect to the Web UI
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_kra_enabled: _kra_enabled:
description: The installer _kra_enabled setting description: The installer _kra_enabled setting
required: yes type: bool
required: no
_kra_host_name: _kra_host_name:
description: The installer _kra_host_name setting description: The installer _kra_host_name setting
required: yes type: str
required: no
_pkinit_pkcs12_info: _pkinit_pkcs12_info:
description: The installer _pkinit_pkcs12_info setting description: The installer _pkinit_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -96,7 +111,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, custodiainstance gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, custodiainstance
) )
@@ -111,22 +126,24 @@ def main():
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
no_ui_redirect=dict(required=False, type='bool'), no_ui_redirect=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_kra_enabled=dict(required=False, type='bool'), _kra_enabled=dict(required=False, type='bool'),
_kra_host_name=dict(required=False), _kra_host_name=dict(required=False, type='str'),
_pkinit_pkcs12_info=dict(required=False, type='list'), _pkinit_pkcs12_info=dict(required=False, type='list',
_top_dir=dict(required=True), elements='str'),
dirman_password=dict(required=True, no_log=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

73
roles/ipareplica/library/ipareplica_setup_dns.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,47 +40,65 @@ description:
options: options:
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
zonemgr: zonemgr:
description: DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN description: DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN
required: yes type: str
required: no
forwarders: forwarders:
description: Add DNS forwarders description: Add DNS forwarders
required: yes type: list
elements: str
required: no
forward_policy: forward_policy:
description: DNS forwarding policy for global forwarders description: DNS forwarding policy for global forwarders
required: yes type: str
choices: ['first', 'only']
required: no
no_dnssec_validation: no_dnssec_validation:
description: Disable DNSSEC validation description: Disable DNSSEC validation
required: yes type: bool
default: no
required: no
dns_ip_addresses: dns_ip_addresses:
description: The dns ip_addresses setting description: The dns ip_addresses setting
required: no type: list
elements: str
required: yes
dns_reverse_zones: dns_reverse_zones:
description: The dns reverse_zones setting description: The dns reverse_zones setting
required: no type: list
elements: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -93,7 +111,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, dns, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, dns,
ansible_module_get_parsed_ip_addresses ansible_module_get_parsed_ip_addresses
@@ -107,25 +125,28 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
setup_dns=dict(required=False, type='bool'), setup_dns=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# dns # dns
zonemgr=dict(required=False), zonemgr=dict(required=False, type='str'),
forwarders=dict(required=False, type='list', default=[]), forwarders=dict(required=False, type='list', elements='str',
forward_policy=dict(default=None, choices=['first', 'only']), default=[]),
forward_policy=dict(required=False, type='str',
choices=['first', 'only'], default=None),
no_dnssec_validation=dict(required=False, type='bool', no_dnssec_validation=dict(required=False, type='bool',
default=False), default=False),
# additional # additional
dns_ip_addresses=dict(required=True, type='list'), dns_ip_addresses=dict(required=True, type='list', elements='str'),
dns_reverse_zones=dict(required=True, type='list'), dns_reverse_zones=dict(required=True, type='list', elements='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
setup_ca=dict(required=True, type='bool'), setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

158
roles/ipareplica/library/ipareplica_setup_ds.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,106 +40,144 @@ description:
options: options:
dm_password: dm_password:
description: Directory Manager password description: Directory Manager password
required: yes type: str
required: no
password: password:
description: Admin user kerberos password description: Admin user kerberos password
required: yes type: str
required: no
ip_addresses: ip_addresses:
description: List of Master Server IP Addresses description: List of Master Server IP Addresses
required: yes type: list
elements: str
required: no
domain: domain:
description: Primary DNS domain of the IPA deployment description: Primary DNS domain of the IPA deployment
required: yes type: str
required: no
realm: realm:
description: Kerberos realm name of the IPA deployment description: Kerberos realm name of the IPA deployment
required: yes type: str
required: no
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
ca_cert_files: ca_cert_files:
description: description:
List of files containing CA certificates for the service certificate List of files containing CA certificates for the service certificate
files files
required: yes type: list
elements: str
required: no
no_host_dns: no_host_dns:
description: Do not use DNS for hostname lookup during installation description: Do not use DNS for hostname lookup during installation
required: yes type: bool
default: no
required: no
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
required: yes type: bool
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
default: no
required: no
dirsrv_config_file: dirsrv_config_file:
description: description:
The path to LDIF file that will be used to modify configuration of The path to LDIF file that will be used to modify configuration of
dse.ldif during installation of the directory server instance dse.ldif during installation of the directory server instance
required: yes type: str
required: no
dirsrv_cert_files: dirsrv_cert_files:
description: description:
Files containing the Directory Server SSL certificate and private key Files containing the Directory Server SSL certificate and private key
required: yes type: list
elements: str
required: no
force_join: force_join:
description: Force client enrollment even if already enrolled description: Force client enrollment even if already enrolled
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
server: server:
description: Fully qualified name of IPA server to enroll to description: Fully qualified name of IPA server to enroll to
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
installer_ccache: installer_ccache:
description: The installer ccache setting description: The installer ccache setting
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_dirsrv_pkcs12_info: _dirsrv_pkcs12_info:
description: The installer _dirsrv_pkcs12_info setting description: The installer _dirsrv_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
_add_to_ipaservers: _add_to_ipaservers:
description: The installer _add_to_ipaservers setting description: The installer _add_to_ipaservers setting
required: no type: bool
required: yes
_ca_subject: _ca_subject:
description: The installer _ca_subject setting description: The installer _ca_subject setting
required: no type: str
required: yes
_subject_base: _subject_base:
description: The installer _subject_base setting description: The installer _subject_base setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
config_setup_ca: config_setup_ca:
description: The config setup_ca setting description: The config setup_ca setting
required: no type: bool
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
config_ca_host_name: config_ca_host_name:
description: The config ca_host_name setting description: The config ca_host_name setting
required: no type: str
required: yes
config_ips: config_ips:
description: The config ips setting description: The config ips setting
required: yes type: list
elements: str
required: no
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -152,8 +190,8 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
ansible_module_get_parsed_ip_addresses, sysrestore, ansible_module_get_parsed_ip_addresses,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, redirect_stdout, ipaldap, gen_ReplicaConfig, gen_remote_api, redirect_stdout, ipaldap,
install_replica_ds, install_dns_records, ntpinstance, ScriptError, install_replica_ds, install_dns_records, ntpinstance, ScriptError,
@@ -165,13 +203,15 @@ def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
dm_password=dict(required=False, no_log=True), dm_password=dict(required=False, type='str', no_log=True),
password=dict(required=False, no_log=True), password=dict(required=False, type='str', no_log=True),
ip_addresses=dict(required=False, type='list', default=[]), ip_addresses=dict(required=False, type='list', elements='str',
domain=dict(required=False), default=[]),
realm=dict(required=False), domain=dict(required=False, type='str'),
hostname=dict(required=False), realm=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', default=[]), hostname=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', elements='str',
default=[]),
no_host_dns=dict(required=False, type='bool', default=False), no_host_dns=dict(required=False, type='bool', default=False),
# server # server
setup_adtrust=dict(required=False, type='bool'), setup_adtrust=dict(required=False, type='bool'),
@@ -179,33 +219,37 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
setup_dns=dict(required=False, type='bool'), setup_dns=dict(required=False, type='bool'),
no_pkinit=dict(required=False, type='bool', default=False), no_pkinit=dict(required=False, type='bool', default=False),
dirsrv_config_file=dict(required=False), dirsrv_config_file=dict(required=False, type='str'),
# ssl certificate # ssl certificate
dirsrv_cert_files=dict(required=False, type='list', default=[]), dirsrv_cert_files=dict(required=False, type='list', elements='str',
default=[]),
# client # client
force_join=dict(required=False, type='bool'), force_join=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
server=dict(required=True), server=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
installer_ccache=dict(required=True), installer_ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_dirsrv_pkcs12_info=dict(required=False, type='list'), _dirsrv_pkcs12_info=dict(required=False, type='list',
_top_dir=dict(required=True), elements='str'),
_top_dir=dict(required=True, type='str'),
_add_to_ipaservers=dict(required=True, type='bool'), _add_to_ipaservers=dict(required=True, type='bool'),
_ca_subject=dict(required=True), _ca_subject=dict(required=True, type='str'),
_subject_base=dict(required=True), _subject_base=dict(required=True, type='str'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
config_setup_ca=dict(required=True, type='bool'), config_setup_ca=dict(required=True, type='bool'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
config_ca_host_name=dict(required=True), config_ca_host_name=dict(required=True, type='str'),
config_ips=dict(required=False, type='list', default=[]), config_ips=dict(required=False, type='list', elements='str',
default=[]),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

65
roles/ipareplica/library/ipareplica_setup_http.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,47 +40,61 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
no_ui_redirect: no_ui_redirect:
description: Do not automatically redirect to the Web UI description: Do not automatically redirect to the Web UI
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
config_ca_host_name: config_ca_host_name:
description: The config ca_host_name setting description: The config ca_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_http_pkcs12_info: _http_pkcs12_info:
description: The installer _http_pkcs12_info setting description: The installer _http_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -93,6 +107,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
check_imports,
AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore, AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, create_ipa_conf, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, create_ipa_conf,
@@ -109,20 +124,22 @@ def main():
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
no_ui_redirect=dict(required=False, type='bool'), no_ui_redirect=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
config_ca_host_name=dict(required=True), config_ca_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_http_pkcs12_info=dict(required=False, type='list'), _http_pkcs12_info=dict(required=False, type='list',
_top_dir=dict(required=True), elements='str'),
dirman_password=dict(required=True, no_log=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

139
roles/ipareplica/library/ipareplica_setup_kra.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,92 +40,127 @@ description:
options: options:
dm_password: dm_password:
description: Directory Manager password description: Directory Manager password
required: yes type: str
required: no
password: password:
description: Admin user kerberos password description: Admin user kerberos password
required: yes type: str
required: no
ip_addresses: ip_addresses:
description: List of Master Server IP Addresses description: List of Master Server IP Addresses
required: yes type: list
elements: str
required: no
domain: domain:
description: Primary DNS domain of the IPA deployment description: Primary DNS domain of the IPA deployment
required: yes type: str
required: no
realm: realm:
description: Kerberos realm name of the IPA deployment description: Kerberos realm name of the IPA deployment
required: yes type: str
required: no
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
ca_cert_files: ca_cert_files:
description: description:
List of files containing CA certificates for the service certificate List of files containing CA certificates for the service certificate
files files
required: yes type: list
elements: str
required: no
no_host_dns: no_host_dns:
description: Do not use DNS for hostname lookup during installation description: Do not use DNS for hostname lookup during installation
required: yes type: bool
default: no
required: no
pki_config_override: pki_config_override:
description: Path to ini file with config overrides description: Path to ini file with config overrides
required: yes type: str
required: no
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
required: yes type: bool
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
required: no
dirsrv_cert_files: dirsrv_cert_files:
description: description:
Files containing the Directory Server SSL certificate and private key Files containing the Directory Server SSL certificate and private key
required: yes type: list
elements: str
required: no
force_join: force_join:
description: Force client enrollment even if already enrolled description: Force client enrollment even if already enrolled
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
server: server:
description: Fully qualified name of IPA server to enroll to description: Fully qualified name of IPA server to enroll to
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
installer_ccache: installer_ccache:
description: The installer ccache setting description: The installer ccache setting
required: no type: str
required: yes
_ca_enabled: _ca_enabled:
description: The installer _ca_enabled setting description: The installer _ca_enabled setting
required: yes type: bool
required: no
_kra_enabled: _kra_enabled:
description: The installer _kra_enabled setting description: The installer _kra_enabled setting
required: yes type: bool
required: no
_kra_host_name: _kra_host_name:
description: The installer _kra_host_name setting description: The installer _kra_host_name setting
required: yes type: str
required: no
_ca_host_name:
description: The installer _ca_host_name setting
type: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
_add_to_ipaservers: _add_to_ipaservers:
description: The installer _add_to_ipaservers setting description: The installer _add_to_ipaservers setting
required: no type: bool
required: yes
_ca_subject: _ca_subject:
description: The installer _ca_subject setting description: The installer _ca_subject setting
required: no type: str
required: yes
_subject_base: _subject_base:
description: The installer _subject_base setting description: The installer _subject_base setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -138,7 +173,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
ansible_module_get_parsed_ip_addresses, ansible_module_get_parsed_ip_addresses,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, custodiainstance, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, custodiainstance,
@@ -150,44 +185,48 @@ def main():
ansible_module = AnsibleModule( ansible_module = AnsibleModule(
argument_spec=dict( argument_spec=dict(
# basic # basic
dm_password=dict(required=False, no_log=True), dm_password=dict(required=False, type='str', no_log=True),
password=dict(required=False, no_log=True), password=dict(required=False, type='str', no_log=True),
ip_addresses=dict(required=False, type='list', default=[]), ip_addresses=dict(required=False, type='list', elements='str',
domain=dict(required=False), default=[]),
realm=dict(required=False), domain=dict(required=False, type='str'),
hostname=dict(required=False), realm=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', default=[]), hostname=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', elements='str',
default=[]),
no_host_dns=dict(required=False, type='bool', default=False), no_host_dns=dict(required=False, type='bool', default=False),
pki_config_override=dict(required=False), pki_config_override=dict(required=False, type='str'),
# server # server
setup_adtrust=dict(required=False, type='bool'), setup_adtrust=dict(required=False, type='bool'),
setup_ca=dict(required=False, type='bool'), setup_ca=dict(required=False, type='bool'),
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
setup_dns=dict(required=False, type='bool'), setup_dns=dict(required=False, type='bool'),
# ssl certificate # ssl certificate
dirsrv_cert_files=dict(required=False, type='list', default=[]), dirsrv_cert_files=dict(required=False, type='list', elements='str',
default=[]),
# client # client
force_join=dict(required=False, type='bool'), force_join=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
server=dict(required=True), server=dict(required=True, type='str'),
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
installer_ccache=dict(required=True), installer_ccache=dict(required=True, type='str'),
_ca_enabled=dict(required=False, type='bool'), _ca_enabled=dict(required=False, type='bool'),
_kra_enabled=dict(required=False, type='bool'), _kra_enabled=dict(required=False, type='bool'),
_kra_host_name=dict(required=False), _kra_host_name=dict(required=False, type='str'),
_ca_host_name=dict(required=False), _ca_host_name=dict(required=False, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
_add_to_ipaservers=dict(required=True, type='bool'), _add_to_ipaservers=dict(required=True, type='bool'),
_ca_subject=dict(required=True), _ca_subject=dict(required=True, type='str'),
_subject_base=dict(required=True), _subject_base=dict(required=True, type='str'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

49
roles/ipareplica/library/ipareplica_setup_krb.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,35 +40,45 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_pkinit_pkcs12_info: _pkinit_pkcs12_info:
description: The installer _pkinit_pkcs12_info setting description: The installer _pkinit_pkcs12_info setting
required: yes type: list
elements: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -81,6 +91,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
check_imports,
AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore, AnsibleModuleLog, setup_logging, installer, DN, paths, sysrestore,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, api, redirect_stdout, install_krb, getargspec gen_ReplicaConfig, api, redirect_stdout, install_krb, getargspec
@@ -95,18 +106,20 @@ def main():
setup_kra=dict(required=False, type='bool'), setup_kra=dict(required=False, type='bool'),
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_pkinit_pkcs12_info=dict(required=False, type='list'), _pkinit_pkcs12_info=dict(required=False, type='list',
_top_dir=dict(required=True), elements='str'),
dirman_password=dict(required=True, no_log=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

51
roles/ipareplica/library/ipareplica_setup_otpd.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -40,38 +40,48 @@ description:
options: options:
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
required: no
no_ui_redirect: no_ui_redirect:
description: Do not automatically redirect to the Web UI description: Do not automatically redirect to the Web UI
required: yes type: bool
required: no
subject_base: subject_base:
description: description:
The certificate subject base (default O=<realm-name>). The certificate subject base (default O=<realm-name>).
RDNs are in LDAP order (most specific RDN first). RDNs are in LDAP order (most specific RDN first).
required: no type: str
required: yes
config_master_host_name: config_master_host_name:
description: The config master_host_name setting description: The config master_host_name setting
required: no type: str
required: yes
ccache: ccache:
description: The local ccache description: The local ccache
required: no type: str
required: yes
_ca_file: _ca_file:
description: The installer _ca_file setting description: The installer _ca_file setting
required: yes type: str
required: no
_top_dir: _top_dir:
description: The installer _top_dir setting description: The installer _top_dir setting
required: no type: str
required: yes
dirman_password: dirman_password:
description: Directory Manager (master) password description: Directory Manager (master) password
required: no type: str
required: yes
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -84,7 +94,7 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, installer, DN, paths, check_imports, AnsibleModuleLog, setup_logging, installer, DN, paths,
gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize, gen_env_boostrap_finalize_core, constants, api_bootstrap_finalize,
gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, otpdinstance, gen_ReplicaConfig, gen_remote_api, api, redirect_stdout, otpdinstance,
ipautil ipautil
@@ -100,18 +110,19 @@ def main():
no_pkinit=dict(required=False, type='bool'), no_pkinit=dict(required=False, type='bool'),
no_ui_redirect=dict(required=False, type='bool'), no_ui_redirect=dict(required=False, type='bool'),
# certificate system # certificate system
subject_base=dict(required=True), subject_base=dict(required=True, type='str'),
# additional # additional
config_master_host_name=dict(required=True), config_master_host_name=dict(required=True, type='str'),
ccache=dict(required=True), ccache=dict(required=True, type='str'),
_ca_file=dict(required=False), _ca_file=dict(required=False, type='str'),
_top_dir=dict(required=True), _top_dir=dict(required=True, type='str'),
dirman_password=dict(required=True, no_log=True), dirman_password=dict(required=True, type='str', no_log=True),
), ),
supports_check_mode=True, supports_check_mode=False,
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

148
roles/ipareplica/library/ipareplica_test.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -39,94 +39,142 @@ description: IPA replica deployment tests
options: options:
ip_addresses: ip_addresses:
description: List of Master Server IP Addresses description: List of Master Server IP Addresses
required: yes type: list
elements: str
required: no
domain: domain:
description: Primary DNS domain of the IPA deployment description: Primary DNS domain of the IPA deployment
required: yes type: str
required: no
servers: servers:
description: Fully qualified name of IPA servers to enroll to description: Fully qualified name of IPA servers to enroll to
required: yes type: list
elements: str
required: no
realm: realm:
description: Kerberos realm name of the IPA deployment description: Kerberos realm name of the IPA deployment
required: yes type: str
required: no
hostname: hostname:
description: Fully qualified name of this host description: Fully qualified name of this host
required: yes type: str
required: no
ca_cert_files: ca_cert_files:
description: description:
List of files containing CA certificates for the service certificate List of files containing CA certificates for the service certificate
files files
required: yes type: list
elements: str
required: no
hidden_replica: hidden_replica:
description: Install a hidden replica description: Install a hidden replica
required: yes type: bool
default: no
required: no
skip_mem_check: skip_mem_check:
description: Skip checking for minimum required memory description: Skip checking for minimum required memory
required: yes type: bool
default: no
required: no
setup_adtrust: setup_adtrust:
description: Configure AD trust capability description: Configure AD trust capability
required: yes type: bool
default: no
required: no
setup_ca: setup_ca:
description: Configure a dogtag CA description: Configure a dogtag CA
required: yes type: bool
required: no
setup_kra: setup_kra:
description: Configure a dogtag KRA description: Configure a dogtag KRA
required: yes type: bool
default: no
required: no
setup_dns: setup_dns:
description: Configure bind with our zone description: Configure bind with our zone
required: yes type: bool
default: no
required: no
no_pkinit: no_pkinit:
description: Disable pkinit setup steps description: Disable pkinit setup steps
required: yes type: bool
default: no
required: no
dirsrv_config_file: dirsrv_config_file:
description: description:
The path to LDIF file that will be used to modify configuration of The path to LDIF file that will be used to modify configuration of
dse.ldif during installation of the directory server instance dse.ldif during installation of the directory server instance
required: yes type: str
required: no
dirsrv_cert_files: dirsrv_cert_files:
description: description:
Files containing the Directory Server SSL certificate and private key Files containing the Directory Server SSL certificate and private key
required: yes type: list
elements: str
required: no
http_cert_files: http_cert_files:
description: description:
File containing the Apache Server SSL certificate and private key File containing the Apache Server SSL certificate and private key
required: yes type: list
elements: str
required: no
pkinit_cert_files: pkinit_cert_files:
description: description:
File containing the Kerberos KDC SSL certificate and private key File containing the Kerberos KDC SSL certificate and private key
required: yes type: list
elements: str
required: no
no_ntp: no_ntp:
description: Do not configure ntp description: Do not configure ntp
required: yes type: bool
default: no
required: no
ntp_servers: ntp_servers:
description: ntp servers to use description: ntp servers to use
required: yes type: list
elements: str
required: no
ntp_pool: ntp_pool:
description: ntp server pool to use description: ntp server pool to use
required: yes type: str
required: no
no_reverse: no_reverse:
description: Do not create new reverse DNS zone description: Do not create new reverse DNS zone
required: yes type: bool
default: no
required: no
auto_reverse: auto_reverse:
description: Create necessary reverse zones description: Create necessary reverse zones
required: yes type: bool
default: no
required: no
forwarders: forwarders:
description: Add DNS forwarders description: Add DNS forwarders
required: yes type: list
elements: str
required: no
no_forwarders: no_forwarders:
description: Do not add any DNS forwarders, use root servers instead description: Do not add any DNS forwarders, use root servers instead
required: yes type: bool
default: no
required: no
auto_forwarders: auto_forwarders:
description: Use DNS forwarders configured in /etc/resolv.conf description: Use DNS forwarders configured in /etc/resolv.conf
required: yes type: bool
default: no
required: no
forward_policy: forward_policy:
description: DNS forwarding policy for global forwarders description: DNS forwarding policy for global forwarders
required: yes type: str
choices: ['first', 'only']
required: no
no_dnssec_validation: no_dnssec_validation:
description: Disable DNSSEC validation description: Disable DNSSEC validation
required: yes type: bool
default: no
required: no
author: author:
- Thomas Woerner - Thomas Woerner (@t-woerner)
''' '''
EXAMPLES = ''' EXAMPLES = '''
@@ -139,8 +187,8 @@ import os
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.ansible_ipa_replica import ( from ansible.module_utils.ansible_ipa_replica import (
AnsibleModuleLog, setup_logging, options, installer, paths, sysrestore, check_imports, AnsibleModuleLog, setup_logging, options, installer,
ansible_module_get_parsed_ip_addresses, service, paths, sysrestore, ansible_module_get_parsed_ip_addresses, service,
redirect_stdout, create_ipa_conf, ipautil, redirect_stdout, create_ipa_conf, ipautil,
x509, validate_domain_name, common_check, x509, validate_domain_name, common_check,
IPA_PYTHON_VERSION, getargspec, adtrustinstance IPA_PYTHON_VERSION, getargspec, adtrustinstance
@@ -153,12 +201,15 @@ def main():
# basic # basic
# dm_password=dict(required=False, no_log=True), # dm_password=dict(required=False, no_log=True),
# password=dict(required=False, no_log=True), # password=dict(required=False, no_log=True),
ip_addresses=dict(required=False, type='list', default=[]), ip_addresses=dict(required=False, type='list', elements='str',
domain=dict(required=False), default=[]),
servers=dict(required=False, type='list', default=[]), domain=dict(required=False, type='str'),
realm=dict(required=False), servers=dict(required=False, type='list', elements='str',
hostname=dict(required=False), default=[]),
ca_cert_files=dict(required=False, type='list', default=[]), realm=dict(required=False, type='str'),
hostname=dict(required=False, type='str'),
ca_cert_files=dict(required=False, type='list', elements='str',
default=[]),
hidden_replica=dict(required=False, type='bool', default=False), hidden_replica=dict(required=False, type='bool', default=False),
skip_mem_check=dict(required=False, type='bool', default=False), skip_mem_check=dict(required=False, type='bool', default=False),
# server # server
@@ -167,28 +218,35 @@ def main():
setup_kra=dict(required=False, type='bool', default=False), setup_kra=dict(required=False, type='bool', default=False),
setup_dns=dict(required=False, type='bool', default=False), setup_dns=dict(required=False, type='bool', default=False),
no_pkinit=dict(required=False, type='bool', default=False), no_pkinit=dict(required=False, type='bool', default=False),
dirsrv_config_file=dict(required=False), dirsrv_config_file=dict(required=False, type='str'),
# ssl certificate # ssl certificate
dirsrv_cert_files=dict(required=False, type='list', default=[]), dirsrv_cert_files=dict(required=False, type='list', elements='str',
http_cert_files=dict(required=False, type='list', default=[]), default=[]),
pkinit_cert_files=dict(required=False, type='list', default=[]), http_cert_files=dict(required=False, type='list', elements='str',
default=[]),
pkinit_cert_files=dict(required=False, type='list', elements='str',
default=[]),
# client # client
no_ntp=dict(required=False, type='bool', default=False), no_ntp=dict(required=False, type='bool', default=False),
ntp_servers=dict(required=False, type='list', default=[]), ntp_servers=dict(required=False, type='list', elements='str',
ntp_pool=dict(required=False), default=[]),
ntp_pool=dict(required=False, type='str'),
# dns # dns
no_reverse=dict(required=False, type='bool', default=False), no_reverse=dict(required=False, type='bool', default=False),
auto_reverse=dict(required=False, type='bool', default=False), auto_reverse=dict(required=False, type='bool', default=False),
forwarders=dict(required=False, type='list', default=[]), forwarders=dict(required=False, type='list', elements='str',
default=[]),
no_forwarders=dict(required=False, type='bool', default=False), no_forwarders=dict(required=False, type='bool', default=False),
auto_forwarders=dict(required=False, type='bool', default=False), auto_forwarders=dict(required=False, type='bool', default=False),
forward_policy=dict(default=None, choices=['first', 'only']), forward_policy=dict(required=False, type='str',
choices=['first', 'only'], default=None),
no_dnssec_validation=dict(required=False, type='bool', no_dnssec_validation=dict(required=False, type='bool',
default=False), default=False),
), ),
) )
ansible_module._ansible_debug = True ansible_module._ansible_debug = True
check_imports(ansible_module)
setup_logging() setup_logging()
ansible_log = AnsibleModuleLog(ansible_module) ansible_log = AnsibleModuleLog(ansible_module)

578
roles/ipareplica/module_utils/ansible_ipa_replica.py
View File

@@ -5,7 +5,7 @@
# #
# Based on ipa-replica-install code # Based on ipa-replica-install code
# #
# Copyright (C) 2018 Red Hat # Copyright (C) 2018-2022 Red Hat
# see file 'COPYING' for use and warranty information # see file 'COPYING' for use and warranty information
# #
# This program is free software; you can redistribute it and/or modify # This program is free software; you can redistribute it and/or modify
@@ -47,41 +47,38 @@ __all__ = ["contextlib", "dnsexception", "dnsresolver", "dnsreversename",
"check_domain_level_is_supported", "promotion_check_ipa_domain", "check_domain_level_is_supported", "promotion_check_ipa_domain",
"SSSDConfig", "CalledProcessError", "timeconf", "ntpinstance", "SSSDConfig", "CalledProcessError", "timeconf", "ntpinstance",
"dnsname", "kernel_keyring", "krbinstance", "getargspec", "dnsname", "kernel_keyring", "krbinstance", "getargspec",
"adtrustinstance"] "adtrustinstance", "paths", "api", "dsinstance", "ipaldap", "Env",
"ipautil", "installutils", "IPA_PYTHON_VERSION", "NUM_VERSION",
"ReplicaConfig", "create_api"]
import sys import sys
import logging
# HACK: workaround for Ansible 2.9 # Import getargspec from inspect or provide own getargspec for
# https://github.com/ansible/ansible/issues/68361 # Python 2 compatibility with Python 3.11+.
if 'ansible.executor' in sys.modules: try:
for attr in __all__: from inspect import getargspec
setattr(sys.modules[__name__], attr, None) except ImportError:
else: from collections import namedtuple
import logging from inspect import getfullargspec
# The code is copied from Python 3.10 inspect.py
# Authors: Ka-Ping Yee <ping@lfw.org>
# Yury Selivanov <yselivanov@sprymix.com>
ArgSpec = namedtuple('ArgSpec', 'args varargs keywords defaults')
def getargspec(func):
args, varargs, varkw, defaults, kwonlyargs, _kwonlydefaults, \
ann = getfullargspec(func)
if kwonlyargs or ann:
raise ValueError(
"Function has keyword-only parameters or annotations"
", use inspect.signature() API which can support them")
return ArgSpec(args, varargs, varkw, defaults)
try:
from contextlib import contextmanager as contextlib_contextmanager from contextlib import contextmanager as contextlib_contextmanager
# Import getargspec from inspect or provide own getargspec for
# Python 2 compatibility with Python 3.11+.
try:
from inspect import getargspec
except ImportError:
from collections import namedtuple
from inspect import getfullargspec
# The code is copied from Python 3.10 inspect.py
# Authors: Ka-Ping Yee <ping@lfw.org>
# Yury Selivanov <yselivanov@sprymix.com>
ArgSpec = namedtuple('ArgSpec', 'args varargs keywords defaults')
def getargspec(func):
args, varargs, varkw, defaults, kwonlyargs, _kwonlydefaults, \
ann = getfullargspec(func)
if kwonlyargs or ann:
raise ValueError(
"Function has keyword-only parameters or annotations"
", use inspect.signature() API which can support them")
return ArgSpec(args, varargs, varkw, defaults)
from ipapython.version import NUM_VERSION, VERSION from ipapython.version import NUM_VERSION, VERSION
if NUM_VERSION < 30201: if NUM_VERSION < 30201:
@@ -177,296 +174,323 @@ else:
raise Exception("freeipa version '%s' is too old" % VERSION) raise Exception("freeipa version '%s' is too old" % VERSION)
logger = logging.getLogger("ipa-server-install") except ImportError as _err:
ANSIBLE_IPA_REPLICA_MODULE_IMPORT_ERROR = str(_err)
def setup_logging(): for attr in __all__:
# logger.setLevel(logging.DEBUG) setattr(sys.modules[__name__], attr, None)
standard_logging_setup(
paths.IPAREPLICA_INSTALL_LOG, verbose=False, debug=False,
filemode='a', console_format='%(message)s')
@contextlib_contextmanager else:
def redirect_stdout(stream): ANSIBLE_IPA_REPLICA_MODULE_IMPORT_ERROR = None
sys.stdout = stream
try:
yield stream
finally:
sys.stdout = sys.__stdout__
class AnsibleModuleLog():
def __init__(self, module):
self.module = module
_ansible_module_log = self
class AnsibleLoggingHandler(logging.Handler): logger = logging.getLogger("ipa-server-install")
def emit(self, record):
_ansible_module_log.write(self.format(record))
self.logging_handler = AnsibleLoggingHandler()
logger.setLevel(logging.DEBUG)
logger.root.addHandler(self.logging_handler)
def close(self): def setup_logging():
self.flush() # logger.setLevel(logging.DEBUG)
standard_logging_setup(
paths.IPAREPLICA_INSTALL_LOG, verbose=False, debug=False,
filemode='a', console_format='%(message)s')
def flush(self):
pass
def log(self, msg): @contextlib_contextmanager
# self.write(msg+"\n") def redirect_stdout(stream):
self.write(msg) sys.stdout = stream
try:
yield stream
finally:
sys.stdout = sys.__stdout__
def debug(self, msg):
self.module.debug(msg)
def info(self, msg): class AnsibleModuleLog():
self.module.debug(msg) def __init__(self, module):
self.module = module
_ansible_module_log = self
@staticmethod class AnsibleLoggingHandler(logging.Handler):
def isatty(): def emit(self, record):
return False _ansible_module_log.write(self.format(record))
def write(self, msg): self.logging_handler = AnsibleLoggingHandler()
self.module.debug(msg) logger.setLevel(logging.DEBUG)
# self.module.warn(msg) logger.root.addHandler(self.logging_handler)
# pylint: disable=too-many-instance-attributes, useless-object-inheritance def close(self):
class installer_obj(object): # pylint: disable=invalid-name self.flush()
def __init__(self):
# CompatServerReplicaInstall def flush(self):
self.ca_cert_files = None pass
self.all_ip_addresses = False
self.no_wait_for_dns = True def log(self, msg):
self.nisdomain = None # self.write(msg+"\n")
self.no_nisdomain = False self.write(msg)
self.no_sudo = False
self.request_cert = False def debug(self, msg):
self.ca_file = None self.module.debug(msg)
self.zonemgr = None
self.replica_file = None def info(self, msg):
# ServerReplicaInstall self.module.debug(msg)
self.subject_base = None
self.ca_subject = None @staticmethod
# others def isatty():
self._ccache = None return False
self.password = None
self.reverse_zones = [] def write(self, msg):
# def _is_promote(self): self.module.debug(msg)
# return self.replica_file is None # self.module.warn(msg)
# self.skip_conncheck = False
self._replica_install = False
# self.dnssec_master = False # future unknown # pylint: disable=too-many-instance-attributes, useless-object-inheritance
# self.disable_dnssec_master = False # future unknown class installer_obj(object): # pylint: disable=invalid-name
# self.domainlevel = MAX_DOMAIN_LEVEL # deprecated def __init__(self):
# self.domain_level = self.domainlevel # deprecated # CompatServerReplicaInstall
self.interactive = False self.ca_cert_files = None
self.unattended = not self.interactive self.all_ip_addresses = False
# self.promote = self.replica_file is None self.no_wait_for_dns = True
self.promote = True self.nisdomain = None
self.skip_schema_check = None self.no_nisdomain = False
self.no_sudo = False
self.request_cert = False
self.ca_file = None
self.zonemgr = None
self.replica_file = None
# ServerReplicaInstall
self.subject_base = None
self.ca_subject = None
# others
self._ccache = None
self.password = None
self.reverse_zones = []
# def _is_promote(self):
# return self.replica_file is None
# self.skip_conncheck = False
self._replica_install = False
# self.dnssec_master = False # future unknown
# self.disable_dnssec_master = False # future unknown
# self.domainlevel = MAX_DOMAIN_LEVEL # deprecated
# self.domain_level = self.domainlevel # deprecated
self.interactive = False
self.unattended = not self.interactive
# self.promote = self.replica_file is None
self.promote = True
self.skip_schema_check = None
# def __getattribute__(self, attr):
# value = super(installer_obj, self).__getattribute__(attr)
# if not attr.startswith("--") and not attr.endswith("--"):
# logger.debug(
# " <-- Accessing installer.%s (%s)" %
# (attr, repr(value)))
# return value
def __getattr__(self, attrname):
logger.info(" --> ADDING missing installer.%s", attrname)
setattr(self, attrname, None)
return getattr(self, attrname)
# def __setattr__(self, attr, value):
# logger.debug(" --> Setting installer.%s to %s" %
# (attr, repr(value)))
# return super(installer_obj, self).__setattr__(attr, value)
def knobs(self):
for name in self.__dict__:
yield self, name
# pylint: enable=too-many-instance-attributes, useless-object-inheritance
# pylint: disable=attribute-defined-outside-init
installer = installer_obj()
options = installer
# DNSInstallInterface
options.dnssec_master = False
options.disable_dnssec_master = False
options.kasp_db_file = None
options.force = False
# ServerMasterInstall
options.add_sids = False
options.add_agents = False
# ServerReplicaInstall
options.subject_base = None
options.ca_subject = None
# pylint: enable=attribute-defined-outside-init
def gen_env_boostrap_finalize_core(etc_ipa, default_config):
env = Env()
# env._bootstrap(context='installer', confdir=paths.ETC_IPA, log=None)
# env._finalize_core(**dict(constants.DEFAULT_CONFIG))
env._bootstrap(context='installer', confdir=etc_ipa, log=None)
env._finalize_core(**dict(default_config))
return env
def api_bootstrap_finalize(env):
# pylint: disable=no-member
xmlrpc_uri = \
'https://{}/ipa/xml'.format(ipautil.format_netloc(env.host))
api.bootstrap(in_server=True,
context='installer',
confdir=paths.ETC_IPA,
ldap_uri=installutils.realm_to_ldapi_uri(env.realm),
xmlrpc_uri=xmlrpc_uri)
# pylint: enable=no-member
api.finalize()
def gen_ReplicaConfig(): # pylint: disable=invalid-name
# pylint: disable=too-many-instance-attributes
class ExtendedReplicaConfig(ReplicaConfig):
# pylint: disable=useless-super-delegation
def __init__(self, top_dir=None):
# pylint: disable=super-with-arguments
super(ExtendedReplicaConfig, self).__init__(top_dir)
# def __getattribute__(self, attr): # def __getattribute__(self, attr):
# value = super(installer_obj, self).__getattribute__(attr) # value = super(ExtendedReplicaConfig, self).__getattribute__(
# if not attr.startswith("--") and not attr.endswith("--"): # attr)
# logger.debug( # if attr not in ["__dict__", "knobs"]:
# " <-- Accessing installer.%s (%s)" % # logger.debug(" <== Accessing config.%s (%s)" %
# (attr, repr(value))) # (attr, repr(value)))
# return value # return value\
# pylint: enable=useless-super-delegation
def __getattr__(self, attrname): def __getattr__(self, attrname):
logger.info(" --> ADDING missing installer.%s", attrname) logger.info(" ==> ADDING missing config.%s", attrname)
setattr(self, attrname, None) setattr(self, attrname, None)
return getattr(self, attrname) return getattr(self, attrname)
# def __setattr__(self, attr, value): # def __setattr__(self, attr, value):
# logger.debug(" --> Setting installer.%s to %s" % # logger.debug(" ==> Setting config.%s to %s" %
# (attr, repr(value))) # (attr, repr(value)))
# return super(installer_obj, self).__setattr__(attr, value) # return super(ExtendedReplicaConfig, self).__setattr__(attr,
# value)
def knobs(self): def knobs(self):
for name in self.__dict__: for name in self.__dict__:
yield self, name yield self, name
# pylint: enable=too-many-instance-attributes
# pylint: enable=too-many-instance-attributes, useless-object-inheritance
# pylint: disable=attribute-defined-outside-init # pylint: disable=attribute-defined-outside-init
installer = installer_obj() # config = ReplicaConfig()
options = installer config = ExtendedReplicaConfig()
config.realm_name = api.env.realm
config.host_name = api.env.host
config.domain_name = api.env.domain
config.master_host_name = api.env.server
config.ca_host_name = api.env.ca_host
config.kra_host_name = config.ca_host_name
config.ca_ds_port = 389
config.setup_ca = options.setup_ca
config.setup_kra = options.setup_kra
config.dir = options._top_dir
config.basedn = api.env.basedn
# config.subject_base = options.subject_base
# DNSInstallInterface
options.dnssec_master = False
options.disable_dnssec_master = False
options.kasp_db_file = None
options.force = False
# ServerMasterInstall
options.add_sids = False
options.add_agents = False
# ServerReplicaInstall
options.subject_base = None
options.ca_subject = None
# pylint: enable=attribute-defined-outside-init # pylint: enable=attribute-defined-outside-init
def gen_env_boostrap_finalize_core(etc_ipa, default_config): return config
env = Env()
# env._bootstrap(context='installer', confdir=paths.ETC_IPA, log=None)
# env._finalize_core(**dict(constants.DEFAULT_CONFIG))
env._bootstrap(context='installer', confdir=etc_ipa, log=None)
env._finalize_core(**dict(default_config))
return env
def api_bootstrap_finalize(env):
# pylint: disable=no-member
xmlrpc_uri = \
'https://{}/ipa/xml'.format(ipautil.format_netloc(env.host))
api.bootstrap(in_server=True,
context='installer',
confdir=paths.ETC_IPA,
ldap_uri=installutils.realm_to_ldapi_uri(env.realm),
xmlrpc_uri=xmlrpc_uri)
# pylint: enable=no-member
api.finalize()
def gen_ReplicaConfig(): # pylint: disable=invalid-name def replica_ds_init_info(ansible_log,
# pylint: disable=too-many-instance-attributes config, options_, ca_is_configured, remote_api,
class ExtendedReplicaConfig(ReplicaConfig): ds_ca_subject, ca_file,
# pylint: disable=useless-super-delegation promote=False, pkcs12_info=None):
def __init__(self, top_dir=None):
# pylint: disable=super-with-arguments
super(ExtendedReplicaConfig, self).__init__(top_dir)
# def __getattribute__(self, attr): dsinstance.check_ports()
# value = super(ExtendedReplicaConfig, self).__getattribute__(
# attr)
# if attr not in ["__dict__", "knobs"]:
# logger.debug(" <== Accessing config.%s (%s)" %
# (attr, repr(value)))
# return value\
# pylint: enable=useless-super-delegation
def __getattr__(self, attrname): # if we have a pkcs12 file, create the cert db from
logger.info(" ==> ADDING missing config.%s", attrname) # that. Otherwise the ds setup will create the CA
setattr(self, attrname, None) # cert
return getattr(self, attrname) if pkcs12_info is None:
pkcs12_info = make_pkcs12_info(config.dir, "dscert.p12",
"dirsrv_pin.txt")
# def __setattr__(self, attr, value): # during replica install, this gets invoked before local DS is
# logger.debug(" ==> Setting config.%s to %s" % # available, so use the remote api.
# (attr, repr(value))) # if ca_is_configured:
# return super(ExtendedReplicaConfig, self).__setattr__(attr, # ca_subject = ca.lookup_ca_subject(_api, config.subject_base)
# value) # else:
# ca_subject = installutils.default_ca_subject_dn(
# config.subject_base)
ca_subject = ds_ca_subject
def knobs(self): ds = dsinstance.DsInstance(
for name in self.__dict__: config_ldif=options_.dirsrv_config_file)
yield self, name ds.set_output(ansible_log)
# pylint: enable=too-many-instance-attributes
# pylint: disable=attribute-defined-outside-init # Source: ipaserver/install/dsinstance.py
# config = ReplicaConfig()
config = ExtendedReplicaConfig()
config.realm_name = api.env.realm
config.host_name = api.env.host
config.domain_name = api.env.domain
config.master_host_name = api.env.server
config.ca_host_name = api.env.ca_host
config.kra_host_name = config.ca_host_name
config.ca_ds_port = 389
config.setup_ca = options.setup_ca
config.setup_kra = options.setup_kra
config.dir = options._top_dir
config.basedn = api.env.basedn
# config.subject_base = options.subject_base
# pylint: enable=attribute-defined-outside-init # idstart and idmax are configured so that the range is seen as
# depleted by the DNA plugin and the replica will go and get a
# new range from the master.
# This way all servers use the initially defined range by default.
idstart = 1101
idmax = 1100
return config with redirect_stdout(ansible_log):
ds.init_info(
realm_name=config.realm_name,
fqdn=config.host_name,
domain_name=config.domain_name,
dm_password=config.dirman_password,
subject_base=config.subject_base,
ca_subject=ca_subject,
idstart=idstart,
idmax=idmax,
pkcs12_info=pkcs12_info,
ca_file=ca_file,
setup_pkinit=not options.no_pkinit,
)
ds.master_fqdn = config.master_host_name
if ca_is_configured is not None:
ds.ca_is_configured = ca_is_configured
ds.promote = promote
ds.api = remote_api
def replica_ds_init_info(ansible_log, # from __setup_replica
config, options_, ca_is_configured, remote_api,
ds_ca_subject, ca_file,
promote=False, pkcs12_info=None):
dsinstance.check_ports() # Always connect to ds over ldapi
ldap_uri = ipaldap.get_ldap_uri(protocol='ldapi', realm=ds.realm)
conn = ipaldap.LDAPClient(ldap_uri)
conn.external_bind()
# if we have a pkcs12 file, create the cert db from return ds
# that. Otherwise the ds setup will create the CA
# cert
if pkcs12_info is None:
pkcs12_info = make_pkcs12_info(config.dir, "dscert.p12",
"dirsrv_pin.txt")
# during replica install, this gets invoked before local DS is
# available, so use the remote api.
# if ca_is_configured:
# ca_subject = ca.lookup_ca_subject(_api, config.subject_base)
# else:
# ca_subject = installutils.default_ca_subject_dn(
# config.subject_base)
ca_subject = ds_ca_subject
ds = dsinstance.DsInstance( def ansible_module_get_parsed_ip_addresses(ansible_module,
config_ldif=options_.dirsrv_config_file) param='ip_addresses'):
ds.set_output(ansible_log) ip_addrs = []
for ip in ansible_module.params.get(param):
try:
ip_parsed = ipautil.CheckedIPAddress(ip)
except Exception as e:
ansible_module.fail_json(
msg="Invalid IP Address %s: %s" % (ip, e))
ip_addrs.append(ip_parsed)
return ip_addrs
# Source: ipaserver/install/dsinstance.py
# idstart and idmax are configured so that the range is seen as def gen_remote_api(master_host_name, etc_ipa):
# depleted by the DNA plugin and the replica will go and get a ldapuri = 'ldaps://%s' % ipautil.format_netloc(master_host_name)
# new range from the master. xmlrpc_uri = 'https://{}/ipa/xml'.format(
# This way all servers use the initially defined range by default. ipautil.format_netloc(master_host_name))
idstart = 1101 remote_api = create_api(mode=None)
idmax = 1100 remote_api.bootstrap(in_server=True,
context='installer',
confdir=etc_ipa,
ldap_uri=ldapuri,
xmlrpc_uri=xmlrpc_uri)
remote_api.finalize()
return remote_api
with redirect_stdout(ansible_log):
ds.init_info(
realm_name=config.realm_name,
fqdn=config.host_name,
domain_name=config.domain_name,
dm_password=config.dirman_password,
subject_base=config.subject_base,
ca_subject=ca_subject,
idstart=idstart,
idmax=idmax,
pkcs12_info=pkcs12_info,
ca_file=ca_file,
setup_pkinit=not options.no_pkinit,
)
ds.master_fqdn = config.master_host_name
if ca_is_configured is not None:
ds.ca_is_configured = ca_is_configured
ds.promote = promote
ds.api = remote_api
# from __setup_replica def check_imports(module):
if ANSIBLE_IPA_REPLICA_MODULE_IMPORT_ERROR is not None:
# Always connect to ds over ldapi module.fail_json(msg=ANSIBLE_IPA_REPLICA_MODULE_IMPORT_ERROR)
ldap_uri = ipaldap.get_ldap_uri(protocol='ldapi', realm=ds.realm)
conn = ipaldap.LDAPClient(ldap_uri)
conn.external_bind()
return ds
def ansible_module_get_parsed_ip_addresses(ansible_module,
param='ip_addresses'):
ip_addrs = []
for ip in ansible_module.params.get(param):
try:
ip_parsed = ipautil.CheckedIPAddress(ip)
except Exception as e:
ansible_module.fail_json(
msg="Invalid IP Address %s: %s" % (ip, e))
ip_addrs.append(ip_parsed)
return ip_addrs
def gen_remote_api(master_host_name, etc_ipa):
ldapuri = 'ldaps://%s' % ipautil.format_netloc(master_host_name)
xmlrpc_uri = 'https://{}/ipa/xml'.format(
ipautil.format_netloc(master_host_name))
remote_api = create_api(mode=None)
remote_api.bootstrap(in_server=True,
context='installer',
confdir=etc_ipa,
ldap_uri=ldapuri,
xmlrpc_uri=xmlrpc_uri)
remote_api.finalize()
return remote_api