internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-31 20:04:45 +00:00
Code Issues Projects Releases Wiki Activity

roles/ipaclient/tasks/install.yml: Purge realm from keytab also needed for force_join

Browse Source 
For force_join it is also needed to purge the realm information from the
keytab, otherwise new entries will be added with every join.
This commit is contained in:
Thomas Woerner
2017-09-15 15:39:07 +02:00
parent 4b2b6751b2
commit f366fb5270
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
roles/ipaclient/tasks/install.yml
View File

@@ -47,14 +47,6 @@
set_fact: set_fact:
ipaclient_password: "{{ ipahost_output.host.randompassword if ipahost_output.host is defined }}" ipaclient_password: "{{ ipahost_output.host.randompassword if ipahost_output.host is defined }}"
- name: Install - Purge {{ ipadiscovery.realm }} from existing host keytab
command: /usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r "{{ ipadiscovery.realm }}"
register: iparmkeytab
# Do not fail on error codes 3 and 5:
# 3 - Unable to open keytab
# 5 - Principal name or realm not found in keytab
failed_when: iparmkeytab.rc != 0 and iparmkeytab.rc != 3 and iparmkeytab.rc != 5
when: ipaclient_use_otp | bool when: ipaclient_use_otp | bool
- name: Install - Check if principal and keytab are set - name: Install - Check if principal and keytab are set
@@ -65,6 +57,15 @@
fail: msg="At least one of password or keytab must be specified" fail: msg="At least one of password or keytab must be specified"
when: (ipaclient_password is undefined or ipaclient_password == "") and (ipaclient_keytab is undefined or ipaclient_keytab == "") when: (ipaclient_password is undefined or ipaclient_password == "") and (ipaclient_keytab is undefined or ipaclient_keytab == "")
- name: Install - Purge {{ ipadiscovery.realm }} from host keytab
command: /usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r "{{ ipadiscovery.realm }}"
register: iparmkeytab
# Do not fail on error codes 3 and 5:
# 3 - Unable to open keytab
# 5 - Principal name or realm not found in keytab
failed_when: iparmkeytab.rc != 0 and iparmkeytab.rc != 3 and iparmkeytab.rc != 5
when: ipaclient_use_otp | bool or ipaclient_force_join | bool
- name: Install - Join IPA - name: Install - Join IPA
ipajoin: ipajoin:
servers: "{{ ipadiscovery.servers }}" servers: "{{ ipadiscovery.servers }}"