mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-06-23 09:14:43 +00:00
Merge pull request #4 from flo-renaud/simplify_uninstall
Simplify ipaclient uninstall
This commit is contained in:
Thomas Woerner
GitHub
@@ -1,341 +0,0 @@
|
|||||||
#!/usr/bin/python
|
|
||||||
# -*- coding: utf-8 -*-
|
|
||||||
|
|
||||||
# Authors:
|
|
||||||
# Florence Blanc-Renaud <frenaud@redhat.com>
|
|
||||||
#
|
|
||||||
# Copyright (C) 2017 Red Hat
|
|
||||||
# see file 'COPYING' for use and warranty information
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify
|
|
||||||
# it under the terms of the GNU General Public License as published by
|
|
||||||
# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
# (at your option) any later version.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful,
|
|
||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
# GNU General Public License for more details.
|
|
||||||
#
|
|
||||||
# You should have received a copy of the GNU General Public License
|
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
|
|
||||||
ANSIBLE_METADATA = {'metadata_version': '1.0',
|
|
||||||
'status': ['preview'],
|
|
||||||
'supported_by': 'community'}
|
|
||||||
|
|
||||||
DOCUMENTATION = '''
|
|
||||||
---
|
|
||||||
module: ipaclient
|
|
||||||
short description: Configures a client machine as IPA client
|
|
||||||
description:
|
|
||||||
Configures a client machine to use IPA for authentication and
|
|
||||||
identity services.
|
|
||||||
The enrollment requires one authentication method among the 3 following:
|
|
||||||
- Kerberos principal and password (principal/password)
|
|
||||||
- Kerberos keytab file (keytab)
|
|
||||||
- One-Time-Password (otp)
|
|
||||||
options:
|
|
||||||
state:
|
|
||||||
description: the client state
|
|
||||||
required: false
|
|
||||||
default: present
|
|
||||||
choices: [ "present", "absent" ]
|
|
||||||
domain:
|
|
||||||
description: The primary DNS domain of an existing IPA deployment.
|
|
||||||
required: false
|
|
||||||
realm:
|
|
||||||
description: The Kerberos realm of an existing IPA deployment.
|
|
||||||
required: false
|
|
||||||
servers:
|
|
||||||
description: The FQDN of the IPA servers to connect to.
|
|
||||||
required: false
|
|
||||||
principal:
|
|
||||||
description: The authorized kerberos principal used to join the IPA realm.
|
|
||||||
required: false
|
|
||||||
default: admin
|
|
||||||
password:
|
|
||||||
description: The password for the kerberos principal.
|
|
||||||
required: false
|
|
||||||
keytab:
|
|
||||||
description: The path to a backed-up host keytab from previous enrollment.
|
|
||||||
required: false
|
|
||||||
otp:
|
|
||||||
description: The One-Time-Password used to join the IPA realm.
|
|
||||||
required: false
|
|
||||||
force_join:
|
|
||||||
description: Set force_join to yes to join the host even if it is already enrolled.
|
|
||||||
required: false
|
|
||||||
choices: [ "yes", "force" ]
|
|
||||||
default: yes
|
|
||||||
kinit_attempts:
|
|
||||||
description: Repeat the request for host Kerberos ticket X times.
|
|
||||||
required: false
|
|
||||||
ntp:
|
|
||||||
description: Set to no to not configure and enable NTP
|
|
||||||
required: false
|
|
||||||
default: yes
|
|
||||||
mkhomedir:
|
|
||||||
description: Set to yes to configure PAM to create a users home directory if it does not exist.
|
|
||||||
required: false
|
|
||||||
default: no
|
|
||||||
extr_args:
|
|
||||||
description: The list of extra arguments to provide to ipa-client-install.
|
|
||||||
required: false
|
|
||||||
type: list
|
|
||||||
author:
|
|
||||||
- Florence Blanc-Renaud
|
|
||||||
- Thomas Woerner
|
|
||||||
'''
|
|
||||||
|
|
||||||
EXAMPLES = '''
|
|
||||||
# Example from Ansible Playbooks
|
|
||||||
# Unenroll client
|
|
||||||
- ipaclient:
|
|
||||||
state: absent
|
|
||||||
|
|
||||||
# Enroll client using admin credentials, with auto-discovery
|
|
||||||
- ipaclient:
|
|
||||||
principal: admin
|
|
||||||
password: MySecretPassword
|
|
||||||
ntp: no
|
|
||||||
kinit_attempts: 5
|
|
||||||
|
|
||||||
# Enroll client using admin credentials, with specified domain and
|
|
||||||
# autodiscovery of the IPA server
|
|
||||||
- ipaclient:
|
|
||||||
principal: admin
|
|
||||||
password: MySecretPassword
|
|
||||||
domain: ipa.domain.com
|
|
||||||
ntp: no
|
|
||||||
kinit_attempts: 5
|
|
||||||
|
|
||||||
# Enroll client using admin credentials, with specified server
|
|
||||||
- ipaclient:
|
|
||||||
principal: admin
|
|
||||||
password: MySecretPassword
|
|
||||||
domain: ipa.domain.com
|
|
||||||
servers: ipaserver.ipa.domain.com
|
|
||||||
ntp: no
|
|
||||||
kinit_attempts: 5
|
|
||||||
|
|
||||||
# Enroll client using One-Time-Password, with specified domain and realm
|
|
||||||
- ipaclient:
|
|
||||||
domain: ipa.domain.com
|
|
||||||
realm: IPA.DOMAIN.com
|
|
||||||
otp: 9Mn*Jm8z[%n]|:CJeu>Y~K
|
|
||||||
|
|
||||||
# Re-enroll client using keytab stored on the managed node
|
|
||||||
- ipaclient:
|
|
||||||
domain: ipa.domain.com
|
|
||||||
realm: IPA.DOMAIN.com
|
|
||||||
keytab: /path/to/host.keytab
|
|
||||||
'''
|
|
||||||
|
|
||||||
RETURN = '''
|
|
||||||
tbd
|
|
||||||
'''
|
|
||||||
|
|
||||||
import os
|
|
||||||
from six.moves.configparser import RawConfigParser
|
|
||||||
from ansible.module_utils.basic import AnsibleModule
|
|
||||||
try:
|
|
||||||
from ipalib.install.sysrestore import SYSRESTORE_STATEFILE
|
|
||||||
except ImportError:
|
|
||||||
from ipapython.sysrestore import SYSRESTORE_STATEFILE
|
|
||||||
from ipaplatform.paths import paths
|
|
||||||
|
|
||||||
|
|
||||||
def is_client_configured():
|
|
||||||
"""
|
|
||||||
Check if ipa client is configured.
|
|
||||||
|
|
||||||
IPA client is configured when /etc/ipa/default.conf exists and
|
|
||||||
/var/lib/ipa-client/sysrestore/sysrestore.state exists.
|
|
||||||
|
|
||||||
:returns: boolean
|
|
||||||
"""
|
|
||||||
|
|
||||||
return (os.path.isfile(paths.IPA_DEFAULT_CONF) and
|
|
||||||
os.path.isfile(os.path.join(paths.IPA_CLIENT_SYSRESTORE,
|
|
||||||
SYSRESTORE_STATEFILE)))
|
|
||||||
|
|
||||||
|
|
||||||
def get_ipa_conf():
|
|
||||||
"""
|
|
||||||
Return IPA configuration read from /etc/ipa/default.conf
|
|
||||||
|
|
||||||
:returns: dict containing key,value
|
|
||||||
"""
|
|
||||||
|
|
||||||
parser = RawConfigParser()
|
|
||||||
parser.read(paths.IPA_DEFAULT_CONF)
|
|
||||||
result = dict()
|
|
||||||
for item in ['basedn', 'realm', 'domain', 'server', 'host', 'xmlrpc_uri']:
|
|
||||||
if parser.has_option('global', item):
|
|
||||||
value = parser.get('global', item)
|
|
||||||
else:
|
|
||||||
value = None
|
|
||||||
if value:
|
|
||||||
result[item] = value
|
|
||||||
|
|
||||||
return result
|
|
||||||
|
|
||||||
|
|
||||||
def ensure_not_ipa_client(module):
|
|
||||||
"""
|
|
||||||
Module for client uninstallation
|
|
||||||
|
|
||||||
If IPA client is installed, calls ipa-client-install --uninstall -U
|
|
||||||
:param module: AnsibleModule
|
|
||||||
"""
|
|
||||||
|
|
||||||
# Check if IPA client is already configured
|
|
||||||
if not is_client_configured():
|
|
||||||
# Nothing to do
|
|
||||||
module.exit_json(changed=False)
|
|
||||||
|
|
||||||
# Client is configured
|
|
||||||
# If in check mode, do nothing but return changed=True
|
|
||||||
if module.check_mode:
|
|
||||||
module.exit_json(changed=True)
|
|
||||||
|
|
||||||
# Client is configured and we want to remove it
|
|
||||||
cmd = [
|
|
||||||
module.get_bin_path('ipa-client-install'),
|
|
||||||
"--uninstall",
|
|
||||||
"-U",
|
|
||||||
]
|
|
||||||
retcode, stdout, stderr = module.run_command(cmd)
|
|
||||||
if retcode != 0:
|
|
||||||
module.fail_json(msg="Failed to uninstall IPA client: %s" % stderr)
|
|
||||||
|
|
||||||
module.exit_json(changed=True)
|
|
||||||
|
|
||||||
|
|
||||||
def ensure_ipa_client(module):
|
|
||||||
"""
|
|
||||||
Module for client installation
|
|
||||||
|
|
||||||
If IPA client is not installed, calls ipa-client-install
|
|
||||||
:param module: AnsibleModule
|
|
||||||
"""
|
|
||||||
|
|
||||||
domain = module.params.get('domain')
|
|
||||||
realm = module.params.get('realm')
|
|
||||||
servers = module.params.get('servers')
|
|
||||||
principal = module.params.get('principal')
|
|
||||||
password = module.params.get('password')
|
|
||||||
keytab = module.params.get('keytab')
|
|
||||||
otp = module.params.get('otp')
|
|
||||||
force_join = module.params.get('force_join')
|
|
||||||
kinit_attempts = module.params.get('kinit_attempts')
|
|
||||||
ntp = module.params.get('ntp')
|
|
||||||
mkhomedir = module.params.get('mkhomedir')
|
|
||||||
extra_args = module.params.get('extra_args')
|
|
||||||
|
|
||||||
# Ensure that at least one auth method is specified
|
|
||||||
if not (password or keytab or otp):
|
|
||||||
module.fail_json(msg="At least one of password, keytab or otp "
|
|
||||||
"must be specified")
|
|
||||||
|
|
||||||
# Check if ipa client is already configured
|
|
||||||
if is_client_configured():
|
|
||||||
# Check that realm and domain match
|
|
||||||
current_config = get_ipa_conf()
|
|
||||||
if domain and domain != current_config.get('domain'):
|
|
||||||
return module.fail_json(msg="IPA client already installed "
|
|
||||||
"with a conflicting domain")
|
|
||||||
if realm and realm != current_config.get('realm'):
|
|
||||||
return module.fail_json(msg="IPA client already installed "
|
|
||||||
"with a conflicting realm")
|
|
||||||
|
|
||||||
# client is already configured and no inconsistency detected
|
|
||||||
return module.exit_json(changed=False, domain=domain, realm=realm)
|
|
||||||
|
|
||||||
# ipa client not installed
|
|
||||||
if module.check_mode:
|
|
||||||
# Do nothing, just return changed=True
|
|
||||||
return module.exit_json(changed=True)
|
|
||||||
|
|
||||||
cmd = [
|
|
||||||
module.get_bin_path("ipa-client-install"),
|
|
||||||
"-U",
|
|
||||||
]
|
|
||||||
if domain:
|
|
||||||
cmd.append("--domain")
|
|
||||||
cmd.append(domain)
|
|
||||||
if realm:
|
|
||||||
cmd.append("--realm")
|
|
||||||
cmd.append(realm)
|
|
||||||
if servers:
|
|
||||||
for server in servers:
|
|
||||||
cmd.append("--server")
|
|
||||||
cmd.append(server)
|
|
||||||
if password:
|
|
||||||
cmd.append("--password")
|
|
||||||
cmd.append(password)
|
|
||||||
cmd.append("--principal")
|
|
||||||
cmd.append(principal)
|
|
||||||
if keytab:
|
|
||||||
cmd.append("--keytab")
|
|
||||||
cmd.append(keytab)
|
|
||||||
cmd.append("-d")
|
|
||||||
if otp:
|
|
||||||
cmd.append("--password")
|
|
||||||
cmd.append(otp)
|
|
||||||
if force_join:
|
|
||||||
cmd.append("--force-join")
|
|
||||||
if kinit_attempts:
|
|
||||||
cmd.append("--kinit-attempts")
|
|
||||||
cmd.append(str(kinit_attempts))
|
|
||||||
if not ntp:
|
|
||||||
cmd.append("--no-ntp")
|
|
||||||
if mkhomedir:
|
|
||||||
cmd.append("--mkhomedir")
|
|
||||||
if extra_args:
|
|
||||||
for extra_arg in extra_args:
|
|
||||||
cmd.append(extra_arg)
|
|
||||||
|
|
||||||
retcode, stdout, stderr = module.run_command(cmd)
|
|
||||||
if retcode != 0:
|
|
||||||
module.fail_json(msg="Failed to install IPA client: %s" % stderr)
|
|
||||||
|
|
||||||
# If autodiscovery was used, need to read /etc/ipa/default.conf to
|
|
||||||
# find domain and realm
|
|
||||||
new_config = get_ipa_conf()
|
|
||||||
module.exit_json(changed=True,
|
|
||||||
domain=new_config.get('domain'),
|
|
||||||
realm=new_config.get('realm'))
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
module = AnsibleModule(
|
|
||||||
supports_check_mode=True,
|
|
||||||
argument_spec=dict(
|
|
||||||
state=dict(default='present', choices=['present', 'absent']),
|
|
||||||
domain=dict(required=False),
|
|
||||||
realm=dict(required=False),
|
|
||||||
servers=dict(required=False, type='list'),
|
|
||||||
principal=dict(default='admin'),
|
|
||||||
password=dict(required=False, no_log=True),
|
|
||||||
keytab=dict(required=False, type='path'),
|
|
||||||
otp=dict(required=False),
|
|
||||||
force_join=dict(required=False, type='bool', default=False),
|
|
||||||
kinit_attempts=dict(required=False, type='int'),
|
|
||||||
ntp=dict(required=False, type='bool', default=True),
|
|
||||||
mkhomedir=dict(required=False, type='bool', default=False),
|
|
||||||
extra_args=dict(default=None, type='list')
|
|
||||||
),
|
|
||||||
)
|
|
||||||
|
|
||||||
module._ansible_debug = True
|
|
||||||
state = module.params.get('state')
|
|
||||||
|
|
||||||
if state == 'present':
|
|
||||||
ensure_ipa_client(module)
|
|
||||||
else:
|
|
||||||
ensure_not_ipa_client(module)
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
main()
|
|
||||||
@@ -6,8 +6,11 @@
|
|||||||
static: yes
|
static: yes
|
||||||
|
|
||||||
- name: Uninstall - Uninstall IPA client
|
- name: Uninstall - Uninstall IPA client
|
||||||
ipaclient:
|
command: /usr/sbin/ipa-client-install --uninstall -U
|
||||||
state: absent
|
register: uninstall
|
||||||
|
# 2 means that uninstall failed because IPA client was not configured
|
||||||
|
failed_when: uninstall.rc != 0 and uninstall.rc != 2
|
||||||
|
changed_when: uninstall.rc == 0
|
||||||
|
|
||||||
#- name: Remove IPA client package
|
#- name: Remove IPA client package
|
||||||
# package:
|
# package:
|
||||||
|
|||||||
Reference in New Issue
Block a user