mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-03-29 14:53:06 +00:00
Compare commits
1 Commits
0.4
...
fix-role-r
| Author | SHA1 | Date | |
|---|---|---|---|
|
d01848d820 |
@@ -1,30 +0,0 @@
|
||||
---
|
||||
exclude_paths:
|
||||
- .ansible-freeipa-tests/
|
||||
- .cache/
|
||||
- .github/
|
||||
- .pre-commit-config.yaml
|
||||
- .tox/
|
||||
- .venv/
|
||||
- .yamllint
|
||||
- molecule/
|
||||
- tests/azure/
|
||||
- meta/runtime.yml
|
||||
|
||||
kinds:
|
||||
- playbook: '**/tests/**/test_*.yml'
|
||||
- playbook: '**/playbooks/**/*.yml'
|
||||
|
||||
parseable: true
|
||||
|
||||
quiet: false
|
||||
|
||||
skip_list:
|
||||
- '301' # Commands should not change things if nothing needs doing'
|
||||
- '305' # Use shell only when shell functionality is required
|
||||
- '306' # risky-shell-pipe
|
||||
- yaml # yamllint should be executed separately.
|
||||
|
||||
use_default_rules: true
|
||||
|
||||
verbosity: 1
|
||||
@@ -1,9 +0,0 @@
|
||||
srpm:
|
||||
# Setup development environment
|
||||
echo "Installing base development environment"
|
||||
dnf install -y dnf-plugins-core git-all
|
||||
echo "Call SRPM build Script"
|
||||
./utils/build-srpm.sh
|
||||
if [[ "${outdir}" != "" ]]; then \
|
||||
mv /builddir/build/SRPMS/* ${outdir}; \
|
||||
fi
|
||||
44
.github/workflows/docs.yml
vendored
44
.github/workflows/docs.yml
vendored
@@ -1,44 +0,0 @@
|
||||
---
|
||||
name: Verify Ansible documentation.
|
||||
on:
|
||||
- push
|
||||
- pull_request
|
||||
jobs:
|
||||
check_docs_29:
|
||||
name: Check Ansible Documentation with Ansible 2.9.
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
- name: Run ansible-doc-test
|
||||
run: |
|
||||
python -m pip install "ansible < 2.10"
|
||||
ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
|
||||
|
||||
check_docs_2_11:
|
||||
name: Check Ansible Documentation with ansible-core 2.11.
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
- name: Run ansible-doc-test
|
||||
run: |
|
||||
python -m pip install "ansible-core >=2.11,<2.12"
|
||||
ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
|
||||
|
||||
check_docs_latest:
|
||||
name: Check Ansible Documentation with latest Ansible version.
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
- name: Run ansible-doc-test
|
||||
run: |
|
||||
python -m pip install ansible
|
||||
ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
|
||||
78
.github/workflows/lint.yml
vendored
78
.github/workflows/lint.yml
vendored
@@ -1,78 +0,0 @@
|
||||
---
|
||||
name: Run Linters
|
||||
on:
|
||||
- push
|
||||
- pull_request
|
||||
jobs:
|
||||
ansible_lint:
|
||||
name: Verify ansible-lint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
- name: Run ansible-lint
|
||||
uses: ansible/ansible-lint-action@master
|
||||
with:
|
||||
targets: |
|
||||
tests/*.yml
|
||||
tests/*/*.yml
|
||||
tests/*/*/*.yml
|
||||
playbooks/*.yml
|
||||
playbooks/*/*.yml
|
||||
roles/*/*/*.yml
|
||||
env:
|
||||
ANSIBLE_MODULE_UTILS: plugins/module_utils
|
||||
ANSIBLE_LIBRARY: plugins/modules
|
||||
ANSIBLE_DOC_FRAGMENT_PLUGINS: plugins/doc_fragments
|
||||
|
||||
yamllint:
|
||||
name: Verify yamllint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
- name: Run yaml-lint
|
||||
uses: ibiqlik/action-yamllint@v1
|
||||
|
||||
pydocstyle:
|
||||
name: Verify pydocstyle
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
- name: Run pydocstyle
|
||||
run: |
|
||||
pip install pydocstyle
|
||||
pydocstyle
|
||||
|
||||
flake8:
|
||||
name: Verify flake8
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
- name: Run flake8
|
||||
run: |
|
||||
pip install flake8
|
||||
flake8
|
||||
|
||||
pylint:
|
||||
name: Verify pylint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: "3.x"
|
||||
- name: Run pylint
|
||||
run: |
|
||||
pip install pylint==2.10.2
|
||||
pylint plugins --disable=import-error
|
||||
6
.gitignore
vendored
6
.gitignore
vendored
@@ -1,8 +1,2 @@
|
||||
*.pyc
|
||||
*.retry
|
||||
|
||||
# ignore virtual environments
|
||||
/.tox/
|
||||
/.venv/
|
||||
|
||||
tests/logs/
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
---
|
||||
repos:
|
||||
- repo: https://github.com/ansible/ansible-lint.git
|
||||
rev: v5.1.2
|
||||
hooks:
|
||||
- id: ansible-lint
|
||||
always_run: false
|
||||
pass_filenames: true
|
||||
files: \.(yaml|yml)$
|
||||
exclude: /env[^/]*.(yaml|yml)$
|
||||
entry: |
|
||||
env ANSIBLE_LIBRARY=./plugins/modules ANSIBLE_MODULE_UTILS=./plugins/module_utils ANSIBLE_DOC_FRAGMENT_PLUGINS=./plugins/doc_fragments ansible-lint
|
||||
- repo: https://github.com/adrienverge/yamllint.git
|
||||
rev: v1.26.1
|
||||
hooks:
|
||||
- id: yamllint
|
||||
files: \.(yaml|yml)$
|
||||
- repo: https://gitlab.com/pycqa/flake8
|
||||
rev: 3.9.2
|
||||
hooks:
|
||||
- id: flake8
|
||||
- repo: https://gitlab.com/pycqa/pydocstyle
|
||||
rev: 6.1.1
|
||||
hooks:
|
||||
- id: pydocstyle
|
||||
- repo: https://github.com/pycqa/pylint
|
||||
rev: v2.10.2
|
||||
hooks:
|
||||
- id: pylint
|
||||
args:
|
||||
- --disable=import-error
|
||||
files: \.py$
|
||||
- repo: local
|
||||
hooks:
|
||||
- id: ansible-doc-test
|
||||
name: Verify Ansible roles and module documentation.
|
||||
language: python
|
||||
entry: utils/ansible-doc-test
|
||||
# args: ['-v', 'roles', 'plugins']
|
||||
files: ^.*.py$
|
||||
23
.yamllint
23
.yamllint
@@ -1,23 +0,0 @@
|
||||
---
|
||||
ignore: |
|
||||
/.tox/
|
||||
/.venv/
|
||||
/.github/
|
||||
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
braces:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
brackets:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
truthy:
|
||||
allowed-values: ["yes", "no", "true", "false", "True", "False"]
|
||||
level: error
|
||||
line-length:
|
||||
max: 160
|
||||
# Disabled rules
|
||||
indentation: disable
|
||||
comments: disable
|
||||
121
CONTRIBUTING.md
121
CONTRIBUTING.md
@@ -1,121 +0,0 @@
|
||||
Contributing to ansible-freeipa
|
||||
===============================
|
||||
|
||||
As part of the [FreeIPA] project, ansible-freeipa follows
|
||||
[FreeIPA's Code of Conduct].
|
||||
|
||||
|
||||
Reporting bugs or Features
|
||||
--------------------------
|
||||
|
||||
ansible-freeipa uses [Github issues] for the upstream development, so all RFEs
|
||||
and bug reports should be added there.
|
||||
|
||||
If you have questions about the usage of ansible-freeipa modules and roles,
|
||||
you should also submit an issue, so that anyone that knows an answer can help.
|
||||
|
||||
|
||||
Development
|
||||
-----------
|
||||
|
||||
Contribute code by submitting a [pull request]. All pull requests should be
|
||||
created against the `master` branch. If your PR fixes an open issue, please,
|
||||
add this information to the commit message, like _"Fix issue #num"_.
|
||||
|
||||
Every PR will have to pass some automatic checks and be reviewed by another
|
||||
developer(s). Once they are approved, they will be merged.
|
||||
|
||||
In your commits, use clear messages that include intent, summary of changes,
|
||||
and expected result. Use a template commit message [for modules] and
|
||||
[for roles].
|
||||
|
||||
Upon review, it is fine to `force push` the changes.
|
||||
|
||||
**Preparing the development environment**
|
||||
|
||||
There are some useful tools that will help you develop for ansible-freeipa,
|
||||
and you should install, at least, the modules in `requirements.txt`. You
|
||||
can install the modules with your distribution package manager, or use pip,
|
||||
as in the example:
|
||||
|
||||
```
|
||||
python3 -m pip install --user -r requirements-dev.txt
|
||||
```
|
||||
|
||||
We recommend using [pre-commit] so that the basic checks that will be executed
|
||||
for your PR are executed locally, on your commits. To setup the pre-commit
|
||||
hooks, issue the command:
|
||||
|
||||
```
|
||||
pre-commit install
|
||||
```
|
||||
|
||||
**Developing new modules**
|
||||
|
||||
When developing new modules use the script `utils/new_module`. If the module
|
||||
should have `action: member` support, use the flag `-m`.
|
||||
|
||||
This script will create the basic structure for the module, the required files
|
||||
for tests, playbooks, documentation and source code, all at the appropriate
|
||||
places.
|
||||
|
||||
|
||||
**Other helpfull tools**
|
||||
|
||||
Under directory `utils`, you will find other useful tools, like
|
||||
**lint-check.sh**, which will run the Python and YAML linters on your code,
|
||||
and **ansible-doc-test** which will verify if the documentation added to the
|
||||
roles and modules source code has the right format.
|
||||
|
||||
|
||||
Testing
|
||||
-------
|
||||
|
||||
When testing ansible-freeipa's roles and modules, we aim to check if they
|
||||
do what they intend to do, report the results correctly, and if they are
|
||||
idempotent (although, sometimes the operation performed is not, like when
|
||||
renaming items). To achieve this, we use Ansible playbooks.
|
||||
|
||||
The Ansible playbooks test can be found under the [tests] directory. They
|
||||
should test the behavior of the module or role, and, if possible, provide
|
||||
test cases for all attributes.
|
||||
|
||||
There might be some limitation on the testing environment, as some attributes
|
||||
or operations are only available in some circumstances, like specific FreeIPA
|
||||
versions, or some more elaborate scenarios (for example, requiring a
|
||||
configured trust to an AD domain). For these cases, there are some `facts`
|
||||
available that will only enable the tests if the testing environment is
|
||||
enabled.
|
||||
|
||||
The tests run automatically on every pull request, using Fedora, CentOS 7,
|
||||
and CentOS 8 environments.
|
||||
|
||||
See the document [Running the tests] and also the section `Preparing the
|
||||
development environment`, to prepare your environment.
|
||||
|
||||
|
||||
Documentation
|
||||
-------------
|
||||
|
||||
We do our best to provide a correct and complete documentation for the modules
|
||||
and roles we provide, but we sometimes miss something that users find it
|
||||
important to be documented.
|
||||
|
||||
If you think something could be made easier to understand, or found an error
|
||||
or omission in the documentation, fixing it will help other users and make
|
||||
the experience on using the project much better.
|
||||
|
||||
Also, the [playbooks] can be seen as part of the documentation, as they are
|
||||
examples of commonly performed tasks.
|
||||
|
||||
---
|
||||
[FreeIPA]: https://freeipa.org
|
||||
[FreeIPA's Code of Conduct]: https://github.com/freeipa/freeipa/blob/master/CODE_OF_CONDUCT.md
|
||||
[for modules]: https://github.com/freeipa/ansible-freeipa/pull/357
|
||||
[for roles]: https://github.com/freeipa/ansible-freeipa/pull/430
|
||||
[Github issues]: https://github.com/freeipa/ansible-freeipa/issues
|
||||
[pull request]: https://github.com/freeipa/ansible-freeipa/pulls
|
||||
[playbooks]: playbooks
|
||||
[pre-commit]: https://pre-commit.com
|
||||
[Running the tests]: tests/README.md
|
||||
[tests]: tests/
|
||||
@@ -1,139 +0,0 @@
|
||||
Automember module
|
||||
===========
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The automember module allows to ensure presence or absence of automember rules and manage automember rule conditions.
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Automember management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaautomember module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
Example playbook to make sure group automember rule is present with no conditions.
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to ensure a group automember rule is present with no conditions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
gather_facts: no
|
||||
tasks:
|
||||
- ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: admins
|
||||
description: "my automember rule"
|
||||
automember_type: group
|
||||
```
|
||||
|
||||
Example playbook to make sure group automember rule is present with conditions:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to add a group automember rule with two conditions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
gather_facts: no
|
||||
tasks:
|
||||
- ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: admins
|
||||
description: "my automember rule"
|
||||
automember_type: group
|
||||
inclusive:
|
||||
- key: mail
|
||||
expression: '@example.com$'
|
||||
exclusive:
|
||||
- key: uid
|
||||
expression: "1234"
|
||||
```
|
||||
|
||||
Example playbook to delete a group automember rule:
|
||||
|
||||
```yaml
|
||||
- name: Playbook to delete a group automember rule
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
gather_facts: no
|
||||
tasks:
|
||||
- ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: admins
|
||||
description: "my automember rule"
|
||||
automember_type: group
|
||||
state: absent
|
||||
```
|
||||
|
||||
Example playbook to add an inclusive condition to an existing rule
|
||||
|
||||
```yaml
|
||||
- name: Playbook to add an inclusive condition to an existing rule
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
gather_facts: no
|
||||
tasks:
|
||||
- ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "My domain hosts"
|
||||
description: "my automember condition"
|
||||
automember_tye: hostgroup
|
||||
action: member
|
||||
inclusive:
|
||||
- key: fqdn
|
||||
expression: ".*.mydomain.com"
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipaautomember
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | Automember rule. | yes
|
||||
`description` | A description of this auto member rule. | no
|
||||
`automember_type` | Grouping to which the rule applies. It can be one of `group`, `hostgroup`. | yes
|
||||
`inclusive` | List of dictionaries in the format of `{'key': attribute, 'expression': inclusive_regex}` | no
|
||||
`exclusive` | List of dictionaries in the format of `{'key': attribute, 'expression': exclusive_regex}` | no
|
||||
`action` | Work on automember or member level. It can be one of `member` or `automember` and defaults to `automember`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Mark Hahl
|
||||
@@ -1,116 +0,0 @@
|
||||
Automountlocation module
|
||||
=====================
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The automountlocation module allows the addition and removal of locations for automount maps
|
||||
|
||||
It is desgined to follow the IPA api as closely as possible while ensuring ease of use.
|
||||
|
||||
|
||||
Features
|
||||
--------
|
||||
* Automount location management
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaautomountlocation module.
|
||||
|
||||
Requirements
|
||||
------------
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure presence of an automount location:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to add an automount location
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure a automount location named DMZ exists
|
||||
ipaautomountlocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: DMZ
|
||||
state: present
|
||||
|
||||
```
|
||||
|
||||
Example playbook to ensure presence of multiple automount locations:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to add an automount location
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure a automount location named DMZ exists
|
||||
ipaautomountlocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name:
|
||||
- DMZ
|
||||
- PROD
|
||||
- development
|
||||
- test
|
||||
state: present
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure absence of an automount location:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to ensure an automount location is absent
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure automount locations LOCATION1 and LOCATION2 do not exist
|
||||
ipaautomountlocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name:
|
||||
- LOCATION1
|
||||
- LOCATION2
|
||||
state: absent
|
||||
```
|
||||
|
||||
Variables
|
||||
=========
|
||||
|
||||
ipaautomountlocation
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` \| `location` | List of one or more automountlocation names. | yes
|
||||
`state` | The state to ensure. It can be one of `present`, or `absent`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Chris Procter
|
||||
@@ -19,7 +19,6 @@ Supported FreeIPA Versions
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaconfig module.
|
||||
|
||||
Some variables are only supported on newer versions of FreeIPA. Check `Variables` section for details.
|
||||
|
||||
Requirements
|
||||
------------
|
||||
@@ -56,7 +55,7 @@ Example playbook to read config options:
|
||||
register: result
|
||||
- name: display default login shell
|
||||
debug:
|
||||
msg: '{{ result.config.defaultlogin }}'
|
||||
msg: '{{result.config.defaultlogin }}'
|
||||
|
||||
- name: ensure defaultloginshell and maxusernamelength are set as required
|
||||
ipaconfig:
|
||||
@@ -91,10 +90,8 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`maxusername` \| `ipamaxusernamelength` | Set the maximum username length (1 to 255) | no
|
||||
`maxhostname` \| `ipamaxhostnamelength` | Set the maximum hostname length between 64-255. Only usable with IPA versions 4.8.0 and up. | no
|
||||
`maxhostname` \| `ipamaxhostnamelength` | Set the maximum hostname length between 64-255 | no
|
||||
`homedirectory` \| `ipahomesrootdir` | Set the default location of home directories | no
|
||||
`defaultshell` \| `ipadefaultloginshell` | Set the default shell for new users | no
|
||||
`defaultgroup` \| `ipadefaultprimarygroup` | Set the default group for new users | no
|
||||
|
||||
@@ -1,159 +0,0 @@
|
||||
Delegation module
|
||||
=================
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The delegation module allows to ensure presence, absence of delegations and delegation attributes.
|
||||
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Delegation management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipadelegation module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure delegation "basic manager attributes" is present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA delegation.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
permission: read
|
||||
attribute:
|
||||
- businesscategory
|
||||
- employeetype
|
||||
group: managers
|
||||
membergroup: employees
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure delegation "basic manager attributes" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA delegation.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure "basic manager attributes" member attributes employeetype and employeenumber are present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA delegation.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
attribute:
|
||||
- employeenumber
|
||||
- employeetype
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure "basic manager attributes" member attributes employeetype and employeenumber are absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA delegation.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
attribute:
|
||||
- employeenumber
|
||||
- employeetype
|
||||
action: member
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure delegation "basic manager attributes" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA delegation.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipadelegation
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `aciname` | The list of delegation name strings. | yes
|
||||
`permission` \| `permissions` | The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no
|
||||
`attribute` \| `attrs` | The attribute list to which the delegation applies. | no
|
||||
`membergroup` \| `memberof` | The user group to apply delegation to. | no
|
||||
`group` | User group ACI grants access to. | no
|
||||
`action` | Work on delegation or member level. It can be on of `member` or `delegation` and defaults to `delegation`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Thomas Woerner
|
||||
@@ -126,8 +126,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`forwarders` | The list of forwarders dicts. Each `forwarders` dict entry has:| no
|
||||
| `ip_address` - The IPv4 or IPv6 address of the DNS server. | yes
|
||||
| `port` - The custom port that should be used on this server. | no
|
||||
|
||||
@@ -47,13 +47,13 @@ Example playbook to ensure presence of a forwardzone to ipa DNS:
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure presence of forwardzone with a single forwarder DNS server
|
||||
- name: ensure presence of forwardzone for DNS requests for example.com to 8.8.8.8
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
state: present
|
||||
name: example.com
|
||||
forwarders:
|
||||
- ip_address: 8.8.8.8
|
||||
- 8.8.8.8
|
||||
forwardpolicy: first
|
||||
skip_overlap_check: true
|
||||
|
||||
@@ -63,14 +63,14 @@ Example playbook to ensure presence of a forwardzone to ipa DNS:
|
||||
name: example.com
|
||||
state: disabled
|
||||
|
||||
- name: ensure presence of forwardzone with multiple forwarder DNS server
|
||||
- name: ensure presence of multiple upstream DNS servers for example.com
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
state: present
|
||||
name: example.com
|
||||
forwarders:
|
||||
- ip_address: 8.8.8.8
|
||||
- ip_address: 4.4.4.4
|
||||
- 8.8.8.8
|
||||
- 4.4.4.4
|
||||
|
||||
- name: ensure presence of another forwarder to any existing ones for example.com
|
||||
ipadnsforwardzone:
|
||||
@@ -78,19 +78,10 @@ Example playbook to ensure presence of a forwardzone to ipa DNS:
|
||||
state: present
|
||||
name: example.com
|
||||
forwarders:
|
||||
- ip_address: 1.1.1.1
|
||||
- 1.1.1.1
|
||||
action: member
|
||||
|
||||
- name: ensure presence of forwardzone with single forwarder DNS server on non-stardard port
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
state: present
|
||||
name: example.com
|
||||
forwarders:
|
||||
- ip_address: 4.4.4.4
|
||||
port: 8053
|
||||
|
||||
- name: ensure the forward zone is absent
|
||||
- name: ensure the forwarder for example.com does not exists (delete it if needed)
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: example.com
|
||||
@@ -107,8 +98,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | Zone name (FQDN). | yes if `state` == `present`
|
||||
`forwarders` \| `idnsforwarders` | Per-zone forwarders. A custom port can be specified for each forwarder. Options | no
|
||||
| `ip_address`: The forwarder IP address. | yes
|
||||
|
||||
@@ -249,8 +249,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`zone_name` \| `dnszone` | The DNS zone name to which DNS record needs to be managed. You can use one global zone name for multiple records. | no
|
||||
required: true
|
||||
`records` | The list of dns records dicts. Each `records` dict entry can contain **record variables**. | no
|
||||
|
||||
@@ -84,6 +84,7 @@ Example playbook to create a DNS zone with all currently supported variables:
|
||||
- ip_address: 8.8.8.8
|
||||
- ip_address: 8.8.4.4
|
||||
port: 52
|
||||
serial: 1234
|
||||
refresh: 3600
|
||||
retry: 900
|
||||
expire: 1209600
|
||||
@@ -151,46 +152,6 @@ Example playbook to remove a zone:
|
||||
|
||||
```
|
||||
|
||||
Example playbook to create a zone for reverse DNS lookup, from an IP address:
|
||||
|
||||
```yaml
|
||||
|
||||
---
|
||||
- name: dnszone present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure zone for reverse DNS lookup is present.
|
||||
ipadnszone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name_from_ip: 192.168.1.2
|
||||
state: present
|
||||
```
|
||||
|
||||
Note that, on the previous example the zone created with `name_from_ip` might be "1.168.192.in-addr.arpa.", "168.192.in-addr.arpa.", or "192.in-addr.arpa.", depending on the DNS response the system get while querying for zones, and for this reason, when creating a zone using `name_from_ip`, the inferred zone name is returned to the controller, in the attribute `dnszone.name`. Since the zone inferred might not be what a user expects, `name_from_ip` can only be used with `state: present`. To have more control over the zone name, the prefix length for the IP address can be provided.
|
||||
|
||||
Example playbook to create a zone for reverse DNS lookup, from an IP address, given the prefix length and displaying the resulting zone name:
|
||||
|
||||
```yaml
|
||||
|
||||
---
|
||||
- name: dnszone present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure zone for reverse DNS lookup is present.
|
||||
ipadnszone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name_from_ip: 192.168.1.2/24
|
||||
state: present
|
||||
register: result
|
||||
- name: Display inferred zone name.
|
||||
debug:
|
||||
msg: "Zone name: {{ result.dnszone.name }}"
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
=========
|
||||
@@ -202,10 +163,7 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `zone_name` | The zone name string or list of strings. | no
|
||||
`name_from_ip` | Derive zone name from reverse of IP (PTR). Can only be used with `state: present`. | no
|
||||
`name` \| `zone_name` | The zone name string. | yes
|
||||
`forwarders` | The list of forwarders dicts. Each `forwarders` dict entry has:| no
|
||||
| `ip_address` - The IPv4 or IPv6 address of the DNS server. | yes
|
||||
| `port` - The custom port that should be used on this server. | no
|
||||
@@ -219,6 +177,7 @@ Variable | Description | Required
|
||||
`dnssec`| Allow inline DNSSEC signing of records in the zone | no
|
||||
`allow_transfer`| List of IP addresses or networks which are allowed to transfer the zone | no
|
||||
`allow_query`| List of IP addresses or networks which are allowed to issue queries | no
|
||||
`serial`| SOA record serial number | no
|
||||
`refresh`| SOA record refresh time | no
|
||||
`retry`| SOA record retry time | no
|
||||
`expire`| SOA record expire time | no
|
||||
@@ -230,17 +189,6 @@ Variable | Description | Required
|
||||
`skip_nameserver_check` | Force DNS zone creation even if nameserver is not resolvable | no
|
||||
|
||||
|
||||
Return Values
|
||||
=============
|
||||
|
||||
ipadnszone
|
||||
----------
|
||||
|
||||
Variable | Description | Returned When
|
||||
-------- | ----------- | -------------
|
||||
`dnszone` | DNS Zone dict with zone name infered from `name_from_ip`. <br>Options: | If `state` is `present`, `name_from_ip` is used, and a zone was created.
|
||||
| `name` - The name of the zone created, inferred from `name_from_ip`. | Always
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
|
||||
@@ -19,8 +19,6 @@ Supported FreeIPA Versions
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipagroup module.
|
||||
|
||||
Some variables are only supported on newer versions of FreeIPA. Check `Variables` section for details.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
@@ -109,24 +107,6 @@ Example playbook to add group members to a group:
|
||||
- appops
|
||||
```
|
||||
|
||||
Example playbook to add members from a trusted realm to an external group:
|
||||
|
||||
```yaml
|
||||
--
|
||||
- name: Playbook to handle groups.
|
||||
hosts: ipaserver
|
||||
became: true
|
||||
|
||||
- name: Create an external group and add members from a trust to it.
|
||||
ipagroup:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: extgroup
|
||||
external: yes
|
||||
externalmember:
|
||||
- WINIPA\\Web Users
|
||||
- WINIPA\\Developers
|
||||
```
|
||||
|
||||
Example playbook to remove groups:
|
||||
|
||||
```yaml
|
||||
@@ -154,21 +134,18 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of group name strings. | no
|
||||
`description` | The group description string. | no
|
||||
`gid` \| `gidnumber` | The GID integer. | no
|
||||
`posix` | Create a non-POSIX group or change a non-POSIX to a posix group. `nonposix`, `posix` and `external` are mutually exclusive. (bool) | no
|
||||
`nonposix` | Create as a non-POSIX group. `nonposix`, `posix` and `external` are mutually exclusive. (bool) | no
|
||||
`external` | Allow adding external non-IPA members from trusted domains. `nonposix`, `posix` and `external` are mutually exclusive. (bool) | no
|
||||
`posix` | Create a non-POSIX group or change a non-POSIX to a posix group. (bool) | no
|
||||
`nonposix` | Create as a non-POSIX group. (bool) | no
|
||||
`external` | Allow adding external non-IPA members from trusted domains. (bool) | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
`user` | List of user name strings assigned to this group. | no
|
||||
`group` | List of group name strings assigned to this group. | no
|
||||
`service` | List of service name strings assigned to this group. Only usable with IPA versions 4.7 and up. | no
|
||||
`membermanager_user` | List of member manager users assigned to this group. Only usable with IPA versions 4.8.4 and up. | no
|
||||
`membermanager_group` | List of member manager groups assigned to this group. Only usable with IPA versions 4.8.4 and up. | no
|
||||
`externalmember` \| `ipaexternalmember` \| `external_member`| List of members of a trusted domain in DOM\\name or name@domain form. | no
|
||||
`action` | Work on group or member level. It can be on of `member` or `group` and defaults to `group`. | no
|
||||
`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes
|
||||
|
||||
|
||||
@@ -136,8 +136,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of hbacrule name strings. | yes
|
||||
`description` | The hbacrule description string. | no
|
||||
`usercategory` \| `usercat` | User category the rule applies to. Choices: ["all", ""] | no
|
||||
|
||||
@@ -98,8 +98,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` \| `service` | The list of hbacsvc name strings. | no
|
||||
`description` | The hbacsvc description string. | no
|
||||
`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | no
|
||||
|
||||
@@ -136,8 +136,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of hbacsvcgroup name strings. | no
|
||||
`description` | The hbacsvcgroup description string. | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
|
||||
@@ -266,10 +266,10 @@ Example playbook to ensure presence of member managedby_host for serveral hosts:
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
hosts:
|
||||
- name: host01.example.com
|
||||
managedby_host: server.example.com
|
||||
- name: host02.example.com
|
||||
managedby_host: server.example.com
|
||||
- name: host01.exmaple.com
|
||||
managedby_host: server.exmaple.com
|
||||
- name: host02.exmaple.com
|
||||
managedby_host: server.exmaple.com
|
||||
action: member
|
||||
```
|
||||
|
||||
@@ -320,8 +320,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `fqdn` | The list of host name strings. `name` with *host variables* or `hosts` containing *host variables* need to be used. | no
|
||||
**Host variables** | Only used with `name` variable in the first level. | no
|
||||
`hosts` | The list of host dicts. Each `hosts` dict entry can contain **host variables**.<br>There is one required option in the `hosts` dict:| no
|
||||
|
||||
@@ -19,8 +19,6 @@ Supported FreeIPA Versions
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipahostgroup module.
|
||||
|
||||
Some variables are only supported on newer versions of FreeIPA. Check `Variables` section for details.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
@@ -107,23 +105,6 @@ Example playbook to make sure hosts and hostgroups are absent in databases hostg
|
||||
state: absent
|
||||
```
|
||||
|
||||
Example playbook to rename an existing playbook:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle hostgroups
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
# Ensure host-group databases is absent
|
||||
- ipahostgroup:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: databases
|
||||
rename: datalake
|
||||
state: renamed
|
||||
```
|
||||
|
||||
Example playbook to make sure host-group databases is absent:
|
||||
|
||||
```yaml
|
||||
@@ -140,6 +121,7 @@ Example playbook to make sure host-group databases is absent:
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
=========
|
||||
|
||||
@@ -150,8 +132,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of hostgroup name strings. | no
|
||||
`description` | The hostgroup description string. | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
@@ -159,9 +139,8 @@ Variable | Description | Required
|
||||
`hostgroup` | List of hostgroup name strings assigned to this hostgroup. | no
|
||||
`membermanager_user` | List of member manager users assigned to this hostgroup. Only usable with IPA versions 4.8.4 and up. | no
|
||||
`membermanager_group` | List of member manager groups assigned to this hostgroup. Only usable with IPA versions 4.8.4 and up. | no
|
||||
`rename` \| `new_name` | Rename hostgroup to the provided name. Only usable with IPA versions 4.8.7 and up. | no
|
||||
`action` | Work on hostgroup or member level. It can be on of `member` or `hostgroup` and defaults to `hostgroup`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent` or `renamed`, default: `present`. | no
|
||||
`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
|
||||
@@ -1,94 +0,0 @@
|
||||
Location module
|
||||
===============
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The location module allows to ensure presence and absence of locations.
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Location management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipalocation module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure location "my_location1" is present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA location.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipalocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: my_location1
|
||||
description: My Location 1
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure location "my_location1" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA location.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipalocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: my_location1
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipalocation
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `idnsname` | The list of location name strings. | yes
|
||||
`description` | The IPA location string | false
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Thomas Woerner
|
||||
@@ -1,190 +0,0 @@
|
||||
Permission module
|
||||
============
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The permission module allows to ensure presence and absence of permissions and permission members.
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Permission management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipapermission module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure permission "MyPermission" is present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle IPA permissions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Ensure permission MyPermission is present
|
||||
ipapermission:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: MyPermission
|
||||
object_type: host
|
||||
right: all
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure permission "MyPermission" is present with attr carlicense:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle IPA permissions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Ensure permission "MyPermission" is present with attr carlicense
|
||||
ipapermission:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: MyPermission
|
||||
object_type: host
|
||||
right: all
|
||||
attrs:
|
||||
- carlicense
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure attr gecos is present in permission "MyPermission":
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle IPA permissions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Ensure attr gecos is present in permission "MyPermission"
|
||||
ipapermission:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: MyPermission
|
||||
attrs:
|
||||
- gecos
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to ensure attr gecos is absent in permission "MyPermission":
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle IPA permissions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Ensure attr gecos is present in permission "MyPermission"
|
||||
ipapermission:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: MyPermission
|
||||
attrs:
|
||||
- gecos
|
||||
action: member
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure permission "MyPermission" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle IPA permissions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Ensure permission "MyPermission" is absent
|
||||
ipapermission:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: MyPermission
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure permission "MyPermission" is renamed to "MyNewPermission":
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to handle IPA permissions
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- name: Ensure permission "MyPermission" is renamed to "MyNewPermission
|
||||
ipapermission:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: MyPermission
|
||||
rename: MyNewPermission
|
||||
state: renamed
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipapermission
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The permission name string. | yes
|
||||
`right` \| `ipapermright` | Rights to grant. It can be a list of one or more of `read`, `search`, `compare`, `write`, `add`, `delete`, and `all` default: `all` | no
|
||||
`attrs` | All attributes to which the permission applies. | no
|
||||
`bindtype` \| `ipapermbindruletype` | Bind rule type. It can be one of `permission`, `all`, `self`, or `anonymous` defaults to `permission` for new permissions. Bind rule type `self` can only be used on IPA versions 4.8.7 or up.| no
|
||||
`subtree` \| `ipapermlocation` | Subtree to apply permissions to | no
|
||||
`filter` \| `extratargetfilter` | Extra target filter | no
|
||||
`rawfilter` \| `ipapermtargetfilter` | All target filters | no
|
||||
`target` \| `ipapermtarget` | Optional DN to apply the permission to | no
|
||||
`targetto` \| `ipapermtargetto` | Optional DN subtree where an entry can be moved to | no
|
||||
`targetfrom` \| `ipapermtargetfrom` | Optional DN subtree from where an entry can be moved | no
|
||||
`memberof` | Target members of a group (sets memberOf targetfilter) | no
|
||||
`targetgroup` | User group to apply permissions to (sets target) | no
|
||||
`object_type` | Type of IPA object (sets subtree and objectClass targetfilter) | no
|
||||
`no_members` | Suppress processing of membership | no
|
||||
`rename` \| `new_name` | Rename the permission object | no
|
||||
`action` | Work on permission or member level. It can be on of `member` or `permission` and defaults to `permission`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, or `renamed` default: `present`. | no
|
||||
|
||||
The `includedattrs` and `excludedattrs` variables are only usable for managed permisions and are not exposed by the module. Using `attrs` for managed permissions will result in the automatic generation of `includedattrs` and `excludedattrs` in the IPA server.
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Seth Kress
|
||||
@@ -1,149 +0,0 @@
|
||||
Privilege module
|
||||
================
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The privilege module allows to ensure presence and absence of privileges and privilege members.
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Privilege management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaprivilege module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure privilege "Broad Privilege" is present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA privilege.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaprivilege:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: Broad Privilege
|
||||
description: Broad Privilege
|
||||
```
|
||||
|
||||
Example playbook to make sure privilege "Broad Privilege" member permission has multiple values:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA privilege permission member.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaprivilege:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: Broad Privilege
|
||||
permission:
|
||||
- "Write IPA Configuration"
|
||||
- "System: Write DNS Configuration"
|
||||
- "System: Update DNS Entries"
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure privilege "Broad Privilege" member permission 'Write IPA Configuration' is absent:
|
||||
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA privilege permission member.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaprivilege:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: Broad Privilege
|
||||
permission:
|
||||
- "Write IPA Configuration"
|
||||
action: member
|
||||
state: absent
|
||||
```
|
||||
|
||||
Example playbook to rename privilege "Broad Privilege" to "DNS Special Privilege":
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA privilege.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaprivilege:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: Broad Privilege
|
||||
rename: DNS Special Privilege
|
||||
state: renamed
|
||||
```
|
||||
|
||||
Example playbook to make sure privilege "DNS Special Privilege" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA privilege.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
- name: Ensure privilege Broad Privilege is absent
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: DNS Special Privilege
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipaprivilege
|
||||
------------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin`. | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node. | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of privilege name strings. | yes
|
||||
`description` | Privilege description. | no
|
||||
`rename` \| `new_name` | Rename the privilege object. | no
|
||||
`permission` | Permissions to be added to the privilege. | no
|
||||
`action` | Work on privilege or member level. It can be one of `member` or `privilege` and defaults to `privilege`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent` or `renamed`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Rafael Guterres Jeffman
|
||||
@@ -98,8 +98,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of pwpolicy name strings. If name is not given, `global_policy` will be used automatically. | no
|
||||
`maxlife` \| `krbmaxpwdlife` | Maximum password lifetime in days. (int) | no
|
||||
`minlife` \| `krbminpwdlife` | Minimum password lifetime in hours. (int) | no
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
Role module
|
||||
"
|
||||
===========
|
||||
|
||||
Description
|
||||
@@ -245,12 +245,10 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of role name strings. | yes
|
||||
`description` | A description for the role. | no
|
||||
`rename` \| `new_name` | Rename the role object. | no
|
||||
`privilege` | Privileges associated to this role. | no
|
||||
`rename` | Rename the role object. | no
|
||||
`privileges` | Privileges associated to this role. | no
|
||||
`user` | List of users to be assigned or not assigned to the role. | no
|
||||
`group` | List of groups to be assigned or not assigned to the role. | no
|
||||
`host` | List of hosts to be assigned or not assigned to the role. | no
|
||||
|
||||
@@ -1,153 +0,0 @@
|
||||
Selfservice module
|
||||
=================
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The selfservice module allows to ensure presence, absence of selfservices and selfservice attributes.
|
||||
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Selfservice management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaselfservice module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure selfservice "Users can manage their own name details" is present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA selfservice.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaselfservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "Users can manage their own name details"
|
||||
permission: read
|
||||
attribute:
|
||||
- title
|
||||
- initials
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure selfservice "Users can manage their own name details" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA selfservice.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaselfservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "Users can manage their own name details"
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure "Users can manage their own name details" member attribute initials is present:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA selfservice.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaselfservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "Users can manage their own name details"
|
||||
attribute:
|
||||
- initials
|
||||
action: member
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure "Users can manage their own name details" member attribute initials is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA selfservice.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaselfservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "Users can manage their own name details"
|
||||
attribute:
|
||||
- initials
|
||||
action: member
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure selfservice "Users can manage their own name details" is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA selfservice.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaselfservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "Users can manage their own name details"
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipaselfservice
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `aciname` | The list of selfservice name strings. | yes
|
||||
`permission` \| `permissions` | The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no
|
||||
`attribute` \| `attrs` | The attribute list to which the selfservice applies. | no
|
||||
`action` | Work on selfservice or member level. It can be on of `member` or `selfservice` and defaults to `selfservice`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Thomas Woerner
|
||||
269
README-server.md
269
README-server.md
@@ -1,269 +0,0 @@
|
||||
Server module
|
||||
============
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The server module allows to ensure presence and absence of servers. The module requires an existing server, the deployment of a new server can not be done with the module.
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Server management
|
||||
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaserver module.
|
||||
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
* Supported FreeIPA version (see above)
|
||||
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is already present in the topology:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
```
|
||||
|
||||
This task is not deploying a new server, it is only checking if the server eists. It will therefore fail if the server does not exist.
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" has location mylocation:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
location: mylocation
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" does not have a location:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
location: ""
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" has service weight 1:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
service_weight: 1
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" does not have a service weight:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
service_weight: -1
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is hidden:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
hidden: yes
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is not hidden:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
hidden: no
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is absent from the topology:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is absent from the topology in continuous mode to ignore errors:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
continue: yes
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is absent from the topology with skipping the last of role check:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
ignore_last_of_role: yes
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is absent from the topology with skipping the topology disconnect check:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
ignore_topology_disconnect: yes
|
||||
state: absent
|
||||
```
|
||||
|
||||
|
||||
Example playbook to make sure server "server.example.com" is absent from the domain in force mode even if it does not exist:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to manage IPA server.
|
||||
hosts: ipaserver
|
||||
become: yes
|
||||
|
||||
tasks:
|
||||
- ipaserver:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: server.example.com
|
||||
force: yes
|
||||
state: absent
|
||||
```
|
||||
|
||||
This task will always report a change.
|
||||
|
||||
|
||||
|
||||
Variables
|
||||
---------
|
||||
|
||||
ipaserver
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of server name strings. | yes
|
||||
`location` \| `ipalocation_location` | The server location string. Only in state: present. "" for location reset. | no
|
||||
`service_weight` \| `ipaserviceweight` | Weight for server services. Type Values 0 to 65535, -1 for weight reset. Only in state: present. (int) | no
|
||||
`hidden` | Set hidden state of a server. Only in state: present. (bool) | no
|
||||
`no_members` | Suppress processing of membership attributes. Only in state: present. (bool) | no
|
||||
`delete_continue` \| `continue` | Continuous mode: Don't stop on errors. Only in state: absent. (bool) | no
|
||||
`ignore_last_of_role` | Skip a check whether the last CA master or DNS server is removed. Only in state: absent. (bool) | no
|
||||
`ignore_topology_disconnect` | Ignore topology connectivity problems after removal. Only in state: absent. (bool) | no
|
||||
`force` | Force server removal even if it does not exist. Will always result in changed. Only in state: absent. (bool) | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. `present` is only working with existing servers. | no
|
||||
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Thomas Woerner
|
||||
@@ -18,7 +18,7 @@ Supported FreeIPA Versions
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipaservice module.
|
||||
|
||||
Some variables are only supported on newer versions of FreeIPA. Check `Variables` section for details.
|
||||
Option `skip_host_check` requires FreeIPA version 4.7.0 or later.
|
||||
|
||||
|
||||
Requirements
|
||||
@@ -56,7 +56,7 @@ Example playbook to make sure service is present:
|
||||
- ipaservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: HTTP/www.example.com
|
||||
certificate: |
|
||||
certificate:
|
||||
- MIIC/zCCAeegAwIBAgIUMNHIbn+hhrOVew/2WbkteisV29QwDQYJKoZIhvcNAQELBQAw
|
||||
DzENMAsGA1UEAwwEdGVzdDAeFw0yMDAyMDQxNDQxMDhaFw0zMDAyMDExNDQxMDhaMA8xDT
|
||||
ALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+XVVGFYpH
|
||||
@@ -77,7 +77,7 @@ Example playbook to make sure service is present:
|
||||
requires_pre_auth: false
|
||||
ok_as_delegate: false
|
||||
ok_to_auth_as_delegate: false
|
||||
skip_host_check: true
|
||||
skip-host-check: true
|
||||
force: true
|
||||
```
|
||||
|
||||
@@ -167,7 +167,7 @@ Example playbook to ensure service has a certificate:
|
||||
- ipaservice:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: HTTP/www.example.com
|
||||
certificate: |
|
||||
certificate:
|
||||
- MIIC/zCCAeegAwIBAgIUMNHIbn+hhrOVew/2WbkteisV29QwDQYJKoZIhvcNAQELBQAw
|
||||
DzENMAsGA1UEAwwEdGVzdDAeFw0yMDAyMDQxNDQxMDhaFw0zMDAyMDExNDQxMDhaMA8xDT
|
||||
ALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+XVVGFYpH
|
||||
@@ -291,8 +291,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `service` | The list of service name strings. | yes
|
||||
`certificate` \| `usercertificate` | Base-64 encoded service certificate. | no
|
||||
`pac_type` \| `ipakrbauthzdata` | Supported PAC type. It can be one of `MS-PAC`, `PAD`, or `NONE`. | no
|
||||
@@ -300,7 +298,7 @@ Variable | Description | Required
|
||||
`requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service. Default to true. (bool) | no
|
||||
`ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service. Default to false. (bool) | no
|
||||
`ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client. Default to false. (bool) | no
|
||||
`skip_host_check` | Force service to be created even when host object does not exist to manage it. Only usable with IPA versions 4.7.0 and up. Default to false. (bool)| no
|
||||
`skip_host_check` | Force service to be created even when host object does not exist to manage it. Default to false. (bool)| no
|
||||
`force` | Force principal name even if host not in DNS. Default to false. (bool) | no
|
||||
`host` \| `managedby_host`| Hosts that can manage the service. | no
|
||||
`principal` \| `krbprincipalname` | List of principal aliases for the service. | no
|
||||
@@ -313,8 +311,6 @@ Variable | Description | Required
|
||||
`allow_retrieve_keytab_host` \| `ipaallowedtoperform_read_keys_host` | Hosts allowed to retrieve a keytab from of host. | no
|
||||
`allow_retrieve_keytab_hostgroup` \| `ipaallowedtoperform_read_keys_hostgroup` | Host groups allowed to retrieve a keytab of this host. | no
|
||||
`continue` | Continuous mode: don't stop on errors. Valid only if `state` is `absent`. Default: `no` (bool) | no
|
||||
`smb` | Service is an SMB service. If set, `cifs/` will be prefixed to the service name if needed. | no
|
||||
`netbiosname` | NETBIOS name for the SMB service. Only with `smb: yes`. | no
|
||||
`action` | Work on service or member level. It can be on of `member` or `service` and defaults to `service`. | no
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, or `disabled`, default: `present`. | no
|
||||
|
||||
|
||||
@@ -67,7 +67,7 @@ Example playbook to make sure sudocmd is absent:
|
||||
|
||||
tasks:
|
||||
# Ensure sudocmd are absent
|
||||
- ipasudocmd:
|
||||
- ipahostgroup:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: /usr/bin/su
|
||||
state: absent
|
||||
@@ -83,8 +83,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `sudocmd` | The sudo command strings. | yes
|
||||
`description` | The command description string. | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
|
||||
@@ -123,8 +123,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of sudocmdgroup name strings. | no
|
||||
`description` | The sudocmdgroup description string. | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
|
||||
@@ -120,14 +120,12 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of sudorule name strings. | yes
|
||||
`description` | The sudorule description string. | no
|
||||
`usercategory` \| `usercat` | User category the rule applies to. Choices: ["all", ""] | no
|
||||
`hostcategory` \| `hostcat` | Host category the rule applies to. Choices: ["all", ""] | no
|
||||
`cmdcategory` \| `cmdcat` | Command category the rule applies to. Choices: ["all", ""] | no
|
||||
`runasusercategory` \| `runasusercat` | RunAs User category the rule applies to. Choices: ["all", ""] | no
|
||||
`runasusercategory` \| `rusasusercat` | RunAs User category the rule applies to. Choices: ["all", ""] | no
|
||||
`runasgroupcategory` \| `runasgroupcat` | RunAs Group category the rule applies to. Choices: ["all", ""] | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
`host` | List of host name strings assigned to this sudorule. | no
|
||||
@@ -138,8 +136,8 @@ Variable | Description | Required
|
||||
`deny_sudocmd` | List of sudocmd name strings assigned to the deny group of this sudorule. | no
|
||||
`allow_sudocmdgroup` | List of sudocmd groups name strings assigned to the allow group of this sudorule. | no
|
||||
`deny_sudocmdgroup` | List of sudocmd groups name strings assigned to the deny group of this sudorule. | no
|
||||
`sudooption` \| `options` | List of options to the sudorule | no
|
||||
`order` \| `sudoorder` | Integer to order the sudorule | no
|
||||
`sudooption` \| `option` | List of options to the sudorule | no
|
||||
`order` | Integer to order the sudorule | no
|
||||
`runasuser` | List of users for Sudo to execute as. | no
|
||||
`runasgroup` | List of groups for Sudo to execute as. | no
|
||||
`action` | Work on sudorule or member level. It can be on of `member` or `sudorule` and defaults to `sudorule`. | no
|
||||
|
||||
@@ -159,13 +159,11 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`suffix` | The topology suffix to be used, this can either be `domain`, `ca` or `domain+ca` | yes
|
||||
`name` \| `cn` | The topology segment name (cn) is the unique identifier for a segment. | no
|
||||
`left` \| `leftnode` | The left replication node string - an IPA server | no
|
||||
`right` \| `rightnode` | The right replication node string - an IPA server | no
|
||||
`direction` | The direction a segment will be reinitialized. It can either be `left-to-right` or `right-to-left` and only used with `state: reinitialized` | no
|
||||
`direction` | The direction a segment will be reinitialized. It can either be `left-to-right` or `right-to-left` and only used with `state: reinitialized` |
|
||||
`state` | The state to ensure. It can be one of `present`, `absent`, `enabled`, `disabled`, `checked` or `reinitialized` | yes
|
||||
|
||||
|
||||
@@ -178,8 +176,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`suffix` | The topology suffix to be used, this can either be `domain` or `ca` | yes
|
||||
`state` | The state to ensure. It can only be `verified` | yes
|
||||
|
||||
|
||||
121
README-trust.md
121
README-trust.md
@@ -1,121 +0,0 @@
|
||||
Trust module
|
||||
============
|
||||
|
||||
Description
|
||||
-----------
|
||||
|
||||
The trust module allows to ensure presence and absence of a domain trust.
|
||||
|
||||
Features
|
||||
--------
|
||||
|
||||
* Trust management
|
||||
|
||||
Supported FreeIPA Versions
|
||||
--------------------------
|
||||
|
||||
FreeIPA versions 4.4.0 and up are supported by the ipatrust module.
|
||||
|
||||
Requirements
|
||||
------------
|
||||
|
||||
**Controller**
|
||||
|
||||
* Ansible version: 2.8+
|
||||
|
||||
**Node**
|
||||
|
||||
* Supported FreeIPA version (see above)
|
||||
* samba-4
|
||||
* ipa-server-trust-ad
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Example inventory file
|
||||
|
||||
```ini
|
||||
[ipaserver]
|
||||
ipaserver.test.local
|
||||
```
|
||||
|
||||
Example playbook to ensure a one-way trust is present:
|
||||
Omitting the two_way option implies the default of one-way
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to ensure a one-way trust is present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure the one-way trust present
|
||||
ipatrust:
|
||||
realm: ad.example.test
|
||||
admin: Administrator
|
||||
password: secret_password
|
||||
state: present
|
||||
```
|
||||
|
||||
Example playbook to ensure a two-way trust is present using a shared-secret:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to ensure a two-way trust is present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure the two-way trust is present
|
||||
ipatrust:
|
||||
realm: ad.example.test
|
||||
trust_secret: my_share_Secret
|
||||
two_way: True
|
||||
state: present
|
||||
```
|
||||
|
||||
Example playbook to ensure a trust is absent:
|
||||
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to ensure a trust is absent
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: ensure the trust is absent
|
||||
ipatrust:
|
||||
realm: ad.example.test
|
||||
state: absent
|
||||
```
|
||||
|
||||
This will only delete the ipa-side of the trust and it does NOT delete the id-range that matches the trust,
|
||||
|
||||
Variables
|
||||
=========
|
||||
|
||||
ipatrust
|
||||
-------
|
||||
|
||||
Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`realm` | The realm name string. | yes
|
||||
`admin` | Active Directory domain administrator string. | no
|
||||
`password` | Active Directory domain administrator's password string. | no
|
||||
`server` | Domain controller for the Active Directory domain string. | no
|
||||
`trust_secret` | Shared secret for the trust string. | no
|
||||
`base_id` | First posix id for the trusted domain integer. | no
|
||||
`range_size` | Size of the ID range reserved for the trusted domain integer. | no
|
||||
`range_type` | Type of trusted domain ID range, It can be one of `ipa-ad-trust` or `ipa-ad-trust-posix`and defaults to `ipa-ad-trust`. | no
|
||||
`two_way` | Establish bi-directional trust. By default trust is inbound one-way only. (bool) | no
|
||||
`external` | Establish external trust to a domain in another forest. The trust is not transitive beyond the domain. (bool) | no
|
||||
`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes
|
||||
|
||||
Authors
|
||||
=======
|
||||
|
||||
Rob Verduijn
|
||||
@@ -365,8 +365,6 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` | The list of user name strings. `name` with *user variables* or `users` containing *user variables* need to be used. | no
|
||||
**User variables** | Only used with `name` variable in the first level. | no
|
||||
`users` | The list of user dicts. Each `users` dict entry can contain **user variables**.<br>There is one required option in the `users` dict:| no
|
||||
@@ -439,7 +437,7 @@ There are only return values if one or more random passwords have been generated
|
||||
|
||||
Variable | Description | Returned When
|
||||
-------- | ----------- | -------------
|
||||
`user` | User dict with random password. (dict) <br>Options: | If random is yes and user did not exist or update_password is yes
|
||||
`host` | Host dict with random password. (dict) <br>Options: | If random is yes and user did not exist or update_password is yes
|
||||
| `randompassword` - The generated random password | If only one user is handled by the module
|
||||
| `name` - The user name of the user that got a new random password. (dict) <br> Options: <br> `randompassword` - The generated random password | If several users are handled by the module
|
||||
|
||||
|
||||
@@ -130,7 +130,7 @@ Example playbook to make sure vault data is present in a symmetric vault:
|
||||
action: member
|
||||
```
|
||||
|
||||
When retrieving data from a vault, it is recommended that `no_log: yes` is used, so that sensitive data stored in a vault is not logged by Ansible. The data is returned in a dict `vault`, in the field `data` (e.g. `result.vault.data`). An example playbook to retrieve data from a symmetric vault:
|
||||
Example playbook to retrieve vault data from a symmetric vault:
|
||||
|
||||
```yaml
|
||||
---
|
||||
@@ -139,19 +139,12 @@ When retrieving data from a vault, it is recommended that `no_log: yes` is used,
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Retrieve data from vault and register it in 'ipavault'
|
||||
ipavault:
|
||||
- ipavault:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: symvault
|
||||
username: admin
|
||||
password: SomeVAULTpassword
|
||||
state: retrieved
|
||||
no_log: yes
|
||||
register: ipavault
|
||||
|
||||
- name: Print retrieved data from vault
|
||||
debug:
|
||||
var: ipavault.vault.data
|
||||
```
|
||||
|
||||
Example playbook to make sure vault data is absent in a symmetric vault:
|
||||
@@ -204,7 +197,7 @@ Example playbook to make sure vault is absent:
|
||||
state: absent
|
||||
register: result
|
||||
- debug:
|
||||
msg: "{{ result.vault.data }}"
|
||||
msg: "{{ result.data }}"
|
||||
```
|
||||
|
||||
Variables
|
||||
@@ -217,29 +210,25 @@ Variable | Description | Required
|
||||
-------- | ----------- | --------
|
||||
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
|
||||
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
|
||||
`ipaapi_context` | The context in which the module will execute. Currently only `client` is supported by this module, and use of `server` will raise a failure. | no
|
||||
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
|
||||
`name` \| `cn` | The list of vault name strings. | yes
|
||||
`description` | The vault description string. | no
|
||||
`nomembers` | Suppress processing of membership attributes. (bool) | no
|
||||
`password` \| `vault_password` \| `ipavaultpassword` \| `old_password`| Vault password. | no
|
||||
`password_file` \| `vault_password_file` \| `old_password_file`| File containing Base64 encoded Vault password. | no
|
||||
`new_password` | Vault new password. | no
|
||||
`new_password_file` | File containing Base64 encoded new Vault password. | no
|
||||
`public_key ` \| `vault_public_key` \| `ipavaultpublickey` | Base64 encoded vault public key. | no
|
||||
`public_key ` \| `vault_public_key` \| `old_password_file` | Base64 encoded vault public key. | no
|
||||
`public_key_file` \| `vault_public_key_file` | Path to file with public key. | no
|
||||
`private_key `\| `vault_private_key` \| `ipavaultprivatekey` | Base64 encoded vault private key. Used only to retrieve data. | no
|
||||
`private_key `\| `vault_private_key` | Base64 encoded vault private key. Used only to retrieve data. | no
|
||||
`private_key_file` \| `vault_private_key_file` | Path to file with private key. Used only to retrieve data. | no
|
||||
`salt` \| `vault_salt` \| `ipavaultsalt` | Vault salt. | no
|
||||
`vault_type` \| `ipavaulttype` | Vault types are based on security level. It can be one of `standard`, `symmetric` or `asymmetric`, default: `symmetric` | no
|
||||
`username` \| `user` | Any user can own one or more user vaults. | no
|
||||
`user` \| `username` | Any user can own one or more user vaults. | no
|
||||
`service` | Any service can own one or more service vaults. | no
|
||||
`shared` | Vault is shared. Default to false. (bool) | no
|
||||
`users` | List of users that are members of the vault. | no
|
||||
`groups` | List of groups that are member of the vault. | no
|
||||
`services` | List of services that are member of the vault. | no
|
||||
`owners` \| `ownerusers` | List of users that are owners of the vault. | no
|
||||
`ownergroups` | List of groups that are owners of the vault. | no
|
||||
`ownerservices` | List of services that are owners of the vault. | no
|
||||
`users` | Users that are members of the vault. | no
|
||||
`groups` | Groups that are member of the vault. | no
|
||||
`services` | Services that are member of the vault. | no
|
||||
`data` \|`vault_data` \| `ipavaultdata` | Data to be stored in the vault. | no
|
||||
`in` \| `datafile_in` | Path to file with data to be stored in the vault. | no
|
||||
`out` \| `datafile_out` | Path to file to store data retrieved from the vault. | no
|
||||
@@ -257,8 +246,7 @@ There is only a return value if `state` is `retrieved`.
|
||||
|
||||
Variable | Description | Returned When
|
||||
-------- | ----------- | -------------
|
||||
`vault` | Vault dict with archived data. (dict) <br>Options: | If `state` is `retrieved` and `out` is not defined.
|
||||
| `data` - The vault data. | Always
|
||||
`data` | The data stored in the vault. | If `state` is `retrieved`.
|
||||
|
||||
|
||||
Notes
|
||||
|
||||
35
README.md
35
README.md
@@ -3,7 +3,7 @@ FreeIPA Ansible collection
|
||||
|
||||
This repository contains [Ansible](https://www.ansible.com/) roles and playbooks to install and uninstall [FreeIPA](https://www.freeipa.org/) `servers`, `replicas` and `clients`. Also modules for group, host, topology and user management.
|
||||
|
||||
**Note**: The Ansible playbooks and roles require a configured Ansible environment where the Ansible nodes are reachable and are properly set up to have an IP address and a working package manager.
|
||||
**Note**: The ansible playbooks and roles require a configured ansible environment where the ansible nodes are reachable and are properly set up to have an IP address and a working package manager.
|
||||
|
||||
Features
|
||||
--------
|
||||
@@ -11,11 +11,6 @@ Features
|
||||
* Cluster deployments: Server, replicas and clients in one playbook
|
||||
* One-time-password (OTP) support for client installation
|
||||
* Repair mode for clients
|
||||
* Backup and restore, also to and from controller
|
||||
* Modules for automembership rule management
|
||||
* Modules for config management
|
||||
* Modules for delegation management
|
||||
* Modules for dns config management
|
||||
* Modules for dns forwarder management
|
||||
* Modules for dns record management
|
||||
* Modules for dns zone management
|
||||
@@ -25,19 +20,13 @@ Features
|
||||
* Modules for hbacsvcgroup management
|
||||
* Modules for host management
|
||||
* Modules for hostgroup management
|
||||
* Modules for location management
|
||||
* Modules for permission management
|
||||
* Modules for privilege management
|
||||
* Modules for pwpolicy management
|
||||
* Modules for role management
|
||||
* Modules for self service management
|
||||
* Modules for server management
|
||||
* Modules for service management
|
||||
* Modules for sudocmd management
|
||||
* Modules for sudocmdgroup management
|
||||
* Modules for sudorule management
|
||||
* Modules for topology management
|
||||
* Modules for trust management
|
||||
* Modules for user management
|
||||
* Modules for vault management
|
||||
|
||||
@@ -114,7 +103,7 @@ ansible-freeipa/plugins/module_utils to ~/.ansible/plugins/
|
||||
|
||||
There are RPM packages available for Fedora 29+. These are installing the roles and modules into the global Ansible directories for `roles`, `plugins/modules` and `plugins/module_utils` in the `/usr/share/ansible` directory. Therefore is it possible to use the roles and modules without adapting the names like it is done in the example playbooks.
|
||||
|
||||
**Ansible Galaxy**
|
||||
**Ansible galaxy**
|
||||
|
||||
This command will get the whole collection from galaxy:
|
||||
|
||||
@@ -138,7 +127,7 @@ The needed adaptions of collection prefixes for `modules` and `module_utils` wil
|
||||
Ansible inventory file
|
||||
----------------------
|
||||
|
||||
The most important parts of the inventory file is the definition of the nodes, settings and the management modules. Please remember to use [Ansible Vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html) for passwords. The examples here are not using vault for better readability.
|
||||
The most important parts of the inventory file is the definition of the nodes, settings and the management modules. Please remember to use [Ansible vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html) for passwords. The examples here are not using vault for better readability.
|
||||
|
||||
**Master server**
|
||||
|
||||
@@ -156,7 +145,7 @@ ipaserver_domain=test.local
|
||||
ipaserver_realm=TEST.LOCAL
|
||||
```
|
||||
|
||||
The admin principal is ```admin``` by default. Please set ```ipaadmin_principal``` if you need to change it.
|
||||
The admin principle is ```admin``` by default. Please set ```ipaadmin_principal``` if you need to change it.
|
||||
|
||||
You can also add more setting here, like for example to enable the DNS server or to set auto-forwarders:
|
||||
```yaml
|
||||
@@ -282,7 +271,7 @@ ipaserver_domain=test.local
|
||||
ipaserver_realm=TEST.LOCAL
|
||||
```
|
||||
|
||||
For enhanced security it is possible to use a auto-generated one-time-password (OTP). This will be generated on the controller using the (first) server. It is needed to have the python-gssapi bindings installed on the controller for this.
|
||||
For enhanced security it is possible to use a auto-generated one-time-password (OTP). This will be generated on the controller using the (first) server. It is needed to have the Python gssapi bindings installed on the controller for this.
|
||||
To enable the generation of the one-time-password:
|
||||
```yaml
|
||||
[ipaclients:vars]
|
||||
@@ -347,7 +336,7 @@ With this playbook it is possible to add a list of topology segments using the `
|
||||
Playbooks
|
||||
=========
|
||||
|
||||
The playbooks needed to deploy or undeploy servers, replicas and clients are part of the repository and placed in the playbooks folder. There are also playbooks to deploy and undeploy clusters. With them it is only needed to add an inventory file:
|
||||
The playbooks needed to deploy or undeploy server, replicas and clients are part of the repository and placed in the playbooks folder. There are also playbooks to deploy and undeploy clusters. With them it is only needed to add an inventory file:
|
||||
```
|
||||
playbooks\
|
||||
install-client.yml
|
||||
@@ -368,7 +357,7 @@ ansible-playbook -v -i inventory/hosts install-server.yml
|
||||
```
|
||||
This will deploy the master server defined in the inventory file.
|
||||
|
||||
If Ansible Vault is used for passwords, then it is needed to adapt the playbooks in this way:
|
||||
If Ansible vault is used for passwords, then it is needed to adapt the playbooks in this way:
|
||||
```yaml
|
||||
---
|
||||
- name: Playbook to configure IPA servers
|
||||
@@ -418,14 +407,10 @@ Roles
|
||||
* [Server](roles/ipaserver/README.md)
|
||||
* [Replica](roles/ipareplica/README.md)
|
||||
* [Client](roles/ipaclient/README.md)
|
||||
* [Backup](roles/ipabackup/README.md)
|
||||
|
||||
Modules in plugin/modules
|
||||
=========================
|
||||
|
||||
* [ipaautomember](README-automember.md)
|
||||
* [ipaconfig](README-config.md)
|
||||
* [ipadelegation](README-delegation.md)
|
||||
* [ipadnsconfig](README-dnsconfig.md)
|
||||
* [ipadnsforwardzone](README-dnsforwardzone.md)
|
||||
* [ipadnsrecord](README-dnsrecord.md)
|
||||
@@ -436,20 +421,14 @@ Modules in plugin/modules
|
||||
* [ipahbacsvcgroup](README-hbacsvc.md)
|
||||
* [ipahost](README-host.md)
|
||||
* [ipahostgroup](README-hostgroup.md)
|
||||
* [ipalocation](README-ipalocation.md)
|
||||
* [ipapermission](README-ipapermission.md)
|
||||
* [ipaprivilege](README-ipaprivilege.md)
|
||||
* [ipapwpolicy](README-pwpolicy.md)
|
||||
* [iparole](README-role.md)
|
||||
* [ipaselfservice](README-ipaselfservice.md)
|
||||
* [ipaserver](README-server.md)
|
||||
* [ipaservice](README-service.md)
|
||||
* [ipasudocmd](README-sudocmd.md)
|
||||
* [ipasudocmdgroup](README-sudocmdgroup.md)
|
||||
* [ipasudorule](README-sudorule.md)
|
||||
* [ipatopologysegment](README-topology.md)
|
||||
* [ipatopologysuffix](README-topology.md)
|
||||
* [ipatrust](README-trust.md)
|
||||
* [ipauser](README-user.md)
|
||||
* [ipavault](README-vault.md)
|
||||
|
||||
|
||||
22
azure-pipelines.yml
Normal file
22
azure-pipelines.yml
Normal file
@@ -0,0 +1,22 @@
|
||||
trigger:
|
||||
- master
|
||||
|
||||
pool:
|
||||
vmImage: 'ubuntu-18.04'
|
||||
|
||||
steps:
|
||||
- task: UsePythonVersion@0
|
||||
inputs:
|
||||
versionSpec: '3.6'
|
||||
|
||||
- script: python -m pip install --upgrade pip setuptools wheel
|
||||
displayName: Install tools
|
||||
|
||||
- script: pip install pydocstyle flake8
|
||||
displayName: Install dependencies
|
||||
|
||||
- script: flake8 .
|
||||
displayName: Run flake8 checks
|
||||
|
||||
- script: pydocstyle .
|
||||
displayName: Verify docstings
|
||||
@@ -1,4 +1,3 @@
|
||||
---
|
||||
namespace: "freeipa"
|
||||
name: "ansible_freeipa"
|
||||
version: "A.B.C"
|
||||
@@ -15,6 +14,8 @@ issues: "https://github.com/freeipa/ansible-freeipa/issues"
|
||||
readme: "README.md"
|
||||
license: "GPL-3.0-or-later"
|
||||
|
||||
dependencies:
|
||||
|
||||
tags:
|
||||
- "system"
|
||||
- "identity"
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
---
|
||||
requires_ansible: ">=2.9"
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: centos-7-build
|
||||
image: centos/systemd
|
||||
pre_build_image: true
|
||||
hostname: ipaserver.test.local
|
||||
dns_servers:
|
||||
- 8.8.8.8
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
command: /usr/sbin/init
|
||||
privileged: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
prepare: ../resources/playbooks/prepare-build.yml
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: centos-7
|
||||
image: quay.io/ansible-freeipa/upstream-tests:centos-7
|
||||
pre_build_image: true
|
||||
hostname: ipaserver.test.local
|
||||
dns_servers:
|
||||
- 127.0.0.1
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
command: /usr/sbin/init
|
||||
privileged: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
prepare: ../resources/playbooks/prepare.yml
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: centos-8-build
|
||||
image: "centos:centos8"
|
||||
pre_build_image: true
|
||||
hostname: ipaserver.test.local
|
||||
dns_servers:
|
||||
- 8.8.8.8
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
command: /usr/sbin/init
|
||||
privileged: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
prepare: ../resources/playbooks/prepare-build.yml
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: centos-8
|
||||
image: quay.io/ansible-freeipa/upstream-tests:centos-8
|
||||
pre_build_image: true
|
||||
hostname: ipaserver.test.local
|
||||
dns_servers:
|
||||
- 127.0.0.1
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
command: /usr/sbin/init
|
||||
privileged: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
prepare: ../resources/playbooks/prepare.yml
|
||||
@@ -1 +0,0 @@
|
||||
centos-8
|
||||
@@ -1,30 +0,0 @@
|
||||
FROM fedora:latest
|
||||
ENV container=docker
|
||||
|
||||
RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
|
||||
dnf makecache; \
|
||||
dnf --assumeyes install \
|
||||
/usr/bin/python3 \
|
||||
/usr/bin/python3-config \
|
||||
/usr/bin/dnf-3 \
|
||||
sudo \
|
||||
bash \
|
||||
systemd \
|
||||
procps-ng \
|
||||
iproute && \
|
||||
dnf clean all; \
|
||||
(cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \
|
||||
rm -f /lib/systemd/system/multi-user.target.wants/*;\
|
||||
rm -f /etc/systemd/system/*.wants/*;\
|
||||
rm -f /lib/systemd/system/local-fs.target.wants/*; \
|
||||
rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
|
||||
rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
|
||||
rm -f /lib/systemd/system/basic.target.wants/*;\
|
||||
rm -f /lib/systemd/system/anaconda.target.wants/*; \
|
||||
rm -rf /var/cache/dnf/;
|
||||
|
||||
STOPSIGNAL RTMIN+3
|
||||
|
||||
VOLUME ["/sys/fs/cgroup"]
|
||||
|
||||
CMD ["/usr/sbin/init"]
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: fedora-latest-build
|
||||
image: "fedora:latest"
|
||||
dockerfile: Dockerfile
|
||||
hostname: ipaserver.test.local
|
||||
dns_servers:
|
||||
- 8.8.8.8
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
command: /usr/sbin/init
|
||||
privileged: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
prepare: ../resources/playbooks/prepare-build.yml
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
driver:
|
||||
name: docker
|
||||
platforms:
|
||||
- name: fedora-latest
|
||||
image: quay.io/ansible-freeipa/upstream-tests:fedora-latest
|
||||
pre_build_image: true
|
||||
hostname: ipaserver.test.local
|
||||
dns_servers:
|
||||
- 127.0.0.1
|
||||
volumes:
|
||||
- /sys/fs/cgroup:/sys/fs/cgroup:ro
|
||||
command: /usr/sbin/init
|
||||
privileged: true
|
||||
provisioner:
|
||||
name: ansible
|
||||
playbooks:
|
||||
prepare: ../resources/playbooks/prepare.yml
|
||||
@@ -1 +0,0 @@
|
||||
../../../plugins/modules/
|
||||
@@ -1 +0,0 @@
|
||||
../../../plugins/module_utils/
|
||||
@@ -1,28 +0,0 @@
|
||||
---
|
||||
- name: Converge
|
||||
hosts: all
|
||||
tasks:
|
||||
- include_tasks: prepare-common.yml
|
||||
|
||||
- name: Ensure sudo package is installed
|
||||
package:
|
||||
name: sudo
|
||||
|
||||
- name: Ensure nss package is updated
|
||||
package:
|
||||
name: nss
|
||||
state: latest # noqa 403
|
||||
|
||||
- include_role:
|
||||
name: ipaserver
|
||||
vars:
|
||||
ipaserver_setup_dns: yes
|
||||
ipaserver_setup_kra: yes
|
||||
ipaserver_auto_forwarders: yes
|
||||
ipaserver_no_dnssec_validation: yes
|
||||
ipaserver_auto_reverse: yes
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
ipadm_password: SomeDMpassword
|
||||
ipaserver_domain: test.local
|
||||
ipaserver_realm: TEST.LOCAL
|
||||
ipaclient_no_ntp: yes
|
||||
@@ -1,33 +0,0 @@
|
||||
---
|
||||
# IPA depends on IPv6 and without it dirsrv service won't start.
|
||||
- name: Ensure IPv6 is ENABLED
|
||||
sysctl:
|
||||
name: "{{ item.name }}"
|
||||
value: "{{ item.value }}"
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
with_items:
|
||||
- name: net.ipv6.conf.all.disable_ipv6
|
||||
value: 0
|
||||
- name: net.ipv6.conf.lo.disable_ipv6
|
||||
value: 0
|
||||
- name: net.ipv6.conf.eth0.disable_ipv6
|
||||
value: 1
|
||||
|
||||
# Set fs.protected_regular to 0
|
||||
# This is needed in some IPA versions in order to get KRA enabled.
|
||||
# See https://pagure.io/freeipa/issue/7906 for more information.
|
||||
- name: stat protected_regular
|
||||
stat:
|
||||
path: /proc/sys/fs/protected_regular
|
||||
register: result
|
||||
|
||||
- name: Ensure fs.protected_regular is disabled
|
||||
sysctl:
|
||||
name: fs.protected_regular
|
||||
value: '0'
|
||||
sysctl_set: yes
|
||||
state: present
|
||||
reload: yes
|
||||
when: result.stat.exists
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
- name: Converge
|
||||
hosts: all
|
||||
tasks:
|
||||
- include_tasks: prepare-common.yml
|
||||
|
||||
# In some distros DS won't start up after reboot
|
||||
# This is due to a problem in 389-ds. See tickets:
|
||||
# * https://pagure.io/389-ds-base/issue/47429
|
||||
# * https://pagure.io/389-ds-base/issue/51039
|
||||
#
|
||||
# To avoid this problem we create the directories before starting IPA.
|
||||
- name: Ensure lock dirs for DS exists
|
||||
file:
|
||||
state: directory
|
||||
owner: dirsrv
|
||||
group: dirsrv
|
||||
path: "{{ item }}"
|
||||
mode: 0770
|
||||
loop:
|
||||
- /var/lock/dirsrv/
|
||||
- /var/lock/dirsrv/slapd-TEST-LOCAL/
|
||||
|
||||
- name: Ensure IPA server is up an running
|
||||
service:
|
||||
name: ipa
|
||||
state: started
|
||||
@@ -1 +0,0 @@
|
||||
../../../roles/
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Automember group absent example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure group automember rule admins is absent
|
||||
ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: admins
|
||||
automember_type: group
|
||||
state: absent
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Automember group present example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure group automember rule admins is present
|
||||
ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: admins
|
||||
automember_type: group
|
||||
state: present
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Automember hostgroup absent example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure hostgroup automember rule ipaservers is absent
|
||||
ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: ipaservers
|
||||
automember_type: hostgroup
|
||||
state: absent
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Automember hostgroup present example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure hostgroup automember rule ipaservers is absent
|
||||
ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: ipaservers
|
||||
automember_type: hostgroup
|
||||
state: present
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Automember hostgroup rule member absent example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure hostgroup automember condition is absent
|
||||
ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "My domain hosts"
|
||||
automember_type: hostgroup
|
||||
state: absent
|
||||
action: member
|
||||
inclusive:
|
||||
- key: fqdn
|
||||
expression: ".*.mydomain.com"
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Automember hostgroup rule member present example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure hostgroup automember condition is present
|
||||
ipaautomember:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "My domain hosts"
|
||||
automember_type: hostgroup
|
||||
state: present
|
||||
action: member
|
||||
inclusive:
|
||||
- key: fqdn
|
||||
expression: ".*.mydomain.com"
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Automount locations absnet example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure automount locations DMZ and internal are absent
|
||||
ipaautomountlocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name:
|
||||
- DMZ
|
||||
- internal
|
||||
state: absent
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Automount location present example
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
tasks:
|
||||
- name: Ensure automount locations DMZ and internal are present
|
||||
ipaautomountlocation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name:
|
||||
- DMZ
|
||||
- internal
|
||||
state: present
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Playbook to backup IPA server to controller
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
vars:
|
||||
ipabackup_to_controller: yes
|
||||
# ipabackup_keep_on_server: yes
|
||||
|
||||
roles:
|
||||
- role: ipabackup
|
||||
state: present
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
- name: Playbook to backup IPA server
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
roles:
|
||||
- role: ipabackup
|
||||
state: present
|
||||
@@ -10,6 +10,5 @@
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
register: serverconfig
|
||||
|
||||
- name: Display current configuration.
|
||||
debug:
|
||||
- debug:
|
||||
msg: "{{ serverconfig }}"
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Playbook to copy all backups from IPA server
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
vars:
|
||||
ipabackup_name: all
|
||||
ipabackup_to_controller: yes
|
||||
|
||||
roles:
|
||||
- role: ipabackup
|
||||
state: copied
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Playbook to copy a backup from controller to the IPA server
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
vars:
|
||||
ipabackup_name: ipaserver.test.local_ipa-full-2020-10-22-11-11-44
|
||||
ipabackup_from_controller: yes
|
||||
|
||||
roles:
|
||||
- role: ipabackup
|
||||
state: copied
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
- name: Playbook to copy backup from IPA server
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
vars:
|
||||
ipabackup_name: ipa-full-2020-10-22-11-11-44
|
||||
ipabackup_to_controller: yes
|
||||
|
||||
roles:
|
||||
- role: ipabackup
|
||||
state: copied
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Delegation absent
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure delegation "basic manager attributes" is absent
|
||||
ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
state: absent
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Delegation member absent
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent
|
||||
ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
attribute:
|
||||
- employeenumber
|
||||
- employeetype
|
||||
action: member
|
||||
state: absent
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
- name: Delegation member present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present
|
||||
ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
attribute:
|
||||
- departmentnumber
|
||||
action: member
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Delegation present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure delegation "basic manager attributes" is present
|
||||
ipadelegation:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: "basic manager attributes"
|
||||
permission: read
|
||||
attribute:
|
||||
- businesscategory
|
||||
group: managers
|
||||
membergroup: employees
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
- name: Playbook to manage DNS forward zone
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure DNS forward zone is absent
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
state: absent
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
- name: Playbook to manage DNS forward zone
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure DNS forward zone is present
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: example.com
|
||||
forwarders:
|
||||
- ip_address: 8.8.8.8
|
||||
forwardpolicy: first
|
||||
skip_overlap_check: true
|
||||
permission: yes
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
- name: Playbook to manage DNS forward zone
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure DNS forward zone is present with forwarder address and non-standard port.
|
||||
ipadnsforwardzone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: example.com
|
||||
forwarders:
|
||||
- ip_address: 192.168.100.123
|
||||
port: 8063
|
||||
@@ -1,11 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test PTR Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that 'host04' A and AAAA records are absent.
|
||||
# Ensure a PTR record is present
|
||||
- name: Ensure that 'host04' has A and AAAA records.
|
||||
ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
zone_name: ipatest.local
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test PTR Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that 'host04' A and AAAA records are present.
|
||||
# Ensure a PTR record is present
|
||||
- name: Ensure that 'host04' has A and AAAA records.
|
||||
ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
zone_name: ipatest.local
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test CNAME Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that 'host04' has CNAME, with cname_hostname, is absent
|
||||
ipadnsrecord:
|
||||
# Ensure that 'host04' has CNAME, with cname_hostname
|
||||
- ipadnsrecord:
|
||||
zone_name: example.com
|
||||
name: host04
|
||||
cname_hostname: host04.example.com
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test CNAME Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that 'host04' has CNAME, with cname_hostname, is present
|
||||
ipadnsrecord:
|
||||
# Ensure that 'host04' has CNAME, with cname_hostname
|
||||
- ipadnsrecord:
|
||||
zone_name: example.com
|
||||
name: host04
|
||||
cname_hostname: host04.example.com
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Ensure MX Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure an MX record is present
|
||||
ipadnsrecord:
|
||||
# Ensure an MX record is absent
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: '@'
|
||||
record_type: 'MX'
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test PTR Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure a PTR record is present
|
||||
ipadnsrecord:
|
||||
# Ensure a PTR record is present
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: 5
|
||||
record_type: 'PTR'
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test SRV Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure a SRV record is present
|
||||
ipadnsrecord:
|
||||
# Ensure a SRV record is present
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: _kerberos._udp.example.com
|
||||
record_type: 'SRV'
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test SSHFP Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
# Ensure a SSHFP record is present
|
||||
# SSHFP fingerprint generated with `ssh-keygen -r host04.testzone.local`
|
||||
- name: Ensure a SSHFP record is present
|
||||
ipadnsrecord:
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
zone_name: example.com
|
||||
name: host04
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test SSHFP Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure a TLSA record is present
|
||||
ipadnsrecord:
|
||||
# Ensure a SSHFP record is present
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
zone_name: example.com
|
||||
name: host04
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test TXT Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure a TXT record is present
|
||||
ipadnsrecord:
|
||||
# Ensure a TXT record is absent
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: _kerberos
|
||||
record_type: 'TXT'
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test URI Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure a URI record is present
|
||||
ipadnsrecord:
|
||||
# Ensure a URI record is absent
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: _ftp._tcp
|
||||
record_type: 'URI'
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test DNS Record is absent.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that dns localhost AAAA record is absent
|
||||
ipadnsrecord:
|
||||
# Ensure that dns record is absent
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01
|
||||
zone_name: example.com
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test DNS Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that dns record is present
|
||||
ipadnsrecord:
|
||||
# Ensure that dns record is present
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01
|
||||
zone_name: example.com
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test DNS Record is present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that dns record is present
|
||||
ipadnsrecord:
|
||||
# Ensure that dns record is present
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01
|
||||
zone_name: example.com
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
---
|
||||
- name: Playbook to manage DNS records.
|
||||
- name: Test multiple DNS Records are present.
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
gather_facts: false
|
||||
|
||||
tasks:
|
||||
- name: Ensure that multiple dns records are present
|
||||
ipadnsrecord:
|
||||
# Ensure that multiple dns records are present
|
||||
- ipadnsrecord:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
records:
|
||||
- name: host01
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
---
|
||||
- name: dnszone present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
---
|
||||
- name: dnszone present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
- name: Playbook to ensure DNS zone exist
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
|
||||
tasks:
|
||||
- name: Ensure zone exist, finding zone name from IP address.
|
||||
ipadnszone:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name_from_ip: 10.1.2.3/24
|
||||
register: result
|
||||
|
||||
- name: Zone name inferred from `name_from_ip`
|
||||
debug:
|
||||
msg: "Zone created: {{ result.dnszone.name }}"
|
||||
@@ -7,7 +7,7 @@
|
||||
- name: Host host1.example.com members allow_create_keytab absent for users, groups, hosts and hostgroups
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01.example.com
|
||||
name: host01.exmaple.com
|
||||
allow_create_keytab_user:
|
||||
- user01
|
||||
- user02
|
||||
@@ -15,8 +15,8 @@
|
||||
- group01
|
||||
- group02
|
||||
allow_create_keytab_host:
|
||||
- host02.example.com
|
||||
- host03.example.com
|
||||
- host02.exmaple.com
|
||||
- host03.exmaple.com
|
||||
allow_create_keytab_hostgroup:
|
||||
- hostgroup01
|
||||
- hostgroup02
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
- name: Host host1.example.com members allow_create_keytab present for users, groups, hosts and hostgroups
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01.example.com
|
||||
name: host01.exmaple.com
|
||||
allow_create_keytab_user:
|
||||
- user01
|
||||
- user02
|
||||
@@ -15,8 +15,8 @@
|
||||
- group01
|
||||
- group02
|
||||
allow_create_keytab_host:
|
||||
- host02.example.com
|
||||
- host03.example.com
|
||||
- host02.exmaple.com
|
||||
- host03.exmaple.com
|
||||
allow_create_keytab_hostgroup:
|
||||
- hostgroup01
|
||||
- hostgroup02
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
- name: Host host1.example.com members allow_retrieve_keytab absent for users, groups, hosts and hostgroups
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01.example.com
|
||||
name: host01.exmaple.com
|
||||
allow_retrieve_keytab_user:
|
||||
- user01
|
||||
- user02
|
||||
@@ -15,8 +15,8 @@
|
||||
- group01
|
||||
- group02
|
||||
allow_retrieve_keytab_host:
|
||||
- host02.example.com
|
||||
- host03.example.com
|
||||
- host02.exmaple.com
|
||||
- host03.exmaple.com
|
||||
allow_retrieve_keytab_hostgroup:
|
||||
- hostgroup01
|
||||
- hostgroup02
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
- name: Host host1.example.com members allow_retrieve_keytab present for users, groups, hosts and hostgroups
|
||||
ipahost:
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01.example.com
|
||||
name: host01.exmaple.com
|
||||
allow_retrieve_keytab_user:
|
||||
- user01
|
||||
- user02
|
||||
@@ -15,8 +15,8 @@
|
||||
- group01
|
||||
- group02
|
||||
allow_retrieve_keytab_host:
|
||||
- host02.example.com
|
||||
- host03.example.com
|
||||
- host02.exmaple.com
|
||||
- host03.exmaple.com
|
||||
allow_retrieve_keytab_hostgroup:
|
||||
- hostgroup01
|
||||
- hostgroup02
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
---
|
||||
- name: Host member certificate absent
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
@@ -9,24 +8,6 @@
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01.example.com
|
||||
certificate:
|
||||
- >
|
||||
MIIC/zCCAeegAwIBAgIUZGHLaSYg1myp6EI4VGWSC27vOrswDQYJKoZIhvc
|
||||
NAQELBQAwDzENMAsGA1UEAwwEdGVzdDAeFw0xOTEwMTQxNjI4MzVaFw0yMD
|
||||
EwMTMxNjI4MzVaMA8xDTALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBA
|
||||
QUAA4IBDwAwggEKAoIBAQDER/lB8wUAmPTSwSc/NOXNlzdpPOQDSwrhKH6X
|
||||
sqZF4KpQoSY/nmCjAhJmOVpOUo4K2fGRZ0yAH9fkGv6yJP6c7IAFjLeec7G
|
||||
PHVwN4bZrP1DXfTAmfmXhcRQbCYkV+wmq8Puzw/+xA9EJrrodnJPPsE6E8H
|
||||
nSVLF6Ys9+cJMJ7HuwOI+wYt3gkmspsir1tccmf4x1PP+yHJWdcXyetlFRc
|
||||
mZ8gspjqOR2jb89xSQsh8gcyDW6rPNlSTzYZ2FmNtjES6ZhCsYL31fQbF2Q
|
||||
glidlLGpAlvHUUS+xCigW73cvhFPMWXcfO51Mr15RcgYTckY+7QZ2nYqplR
|
||||
BoDlQl6DnAgMBAAGjUzBRMB0GA1UdDgQWBBTPG99XVRdxpOXMZo3Nhy+ldn
|
||||
f13TAfBgNVHSMEGDAWgBTPG99XVRdxpOXMZo3Nhy+ldnf13TAPBgNVHRMBA
|
||||
f8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAjWTcnIl2mpNbfHAN8DB4K
|
||||
k+RNRmhsH0y+r/47MXVTMMMToCfofeNY3Jeohu+2lIXMPQfTvXUbDTkNAGs
|
||||
GLv6LtQEUfSREqgk1eY7bT9BFfpH1uV2ZFhCO9jBA+E4bf55Kx7bgUNG31y
|
||||
kBshOsOblOJM1lS/0q4TWHAxrsU2PNwPi8X0ten+eGeB8aRshxS17Ij2cH0
|
||||
fdAMmSA+jMAvTIZl853Bxe0HuozauKwOFWL4qHm61c4O/j1mQCLqJKYfJ9m
|
||||
BDWFQLszd/tF+ePKiNhZCQly60F8Lumn2CDZj5UIkl8wk9Wls5n1BIQs+M8
|
||||
AN65NAdv7+js8jKUKCuyji8r3
|
||||
- MIIC/zCCAeegAwIBAgIUZGHLaSYg1myp6EI4VGWSC27vOrswDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEdGVzdDAeFw0xOTEwMTQxNjI4MzVaFw0yMDEwMTMxNjI4MzVaMA8xDTALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDER/lB8wUAmPTSwSc/NOXNlzdpPOQDSwrhKH6XsqZF4KpQoSY/nmCjAhJmOVpOUo4K2fGRZ0yAH9fkGv6yJP6c7IAFjLeec7GPHVwN4bZrP1DXfTAmfmXhcRQbCYkV+wmq8Puzw/+xA9EJrrodnJPPsE6E8HnSVLF6Ys9+cJMJ7HuwOI+wYt3gkmspsir1tccmf4x1PP+yHJWdcXyetlFRcmZ8gspjqOR2jb89xSQsh8gcyDW6rPNlSTzYZ2FmNtjES6ZhCsYL31fQbF2QglidlLGpAlvHUUS+xCigW73cvhFPMWXcfO51Mr15RcgYTckY+7QZ2nYqplRBoDlQl6DnAgMBAAGjUzBRMB0GA1UdDgQWBBTPG99XVRdxpOXMZo3Nhy+ldnf13TAfBgNVHSMEGDAWgBTPG99XVRdxpOXMZo3Nhy+ldnf13TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAjWTcnIl2mpNbfHAN8DB4Kk+RNRmhsH0y+r/47MXVTMMMToCfofeNY3Jeohu+2lIXMPQfTvXUbDTkNAGsGLv6LtQEUfSREqgk1eY7bT9BFfpH1uV2ZFhCO9jBA+E4bf55Kx7bgUNG31ykBshOsOblOJM1lS/0q4TWHAxrsU2PNwPi8X0ten+eGeB8aRshxS17Ij2cH0fdAMmSA+jMAvTIZl853Bxe0HuozauKwOFWL4qHm61c4O/j1mQCLqJKYfJ9mBDWFQLszd/tF+ePKiNhZCQly60F8Lumn2CDZj5UIkl8wk9Wls5n1BIQs+M8AN65NAdv7+js8jKUKCuyji8r3
|
||||
action: member
|
||||
state: absent
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
---
|
||||
- name: Host member certificate present
|
||||
hosts: ipaserver
|
||||
become: true
|
||||
@@ -9,23 +8,5 @@
|
||||
ipaadmin_password: SomeADMINpassword
|
||||
name: host01.example.com
|
||||
certificate:
|
||||
- >
|
||||
MIIC/zCCAeegAwIBAgIUZGHLaSYg1myp6EI4VGWSC27vOrswDQYJKoZIhvc
|
||||
NAQELBQAwDzENMAsGA1UEAwwEdGVzdDAeFw0xOTEwMTQxNjI4MzVaFw0yMD
|
||||
EwMTMxNjI4MzVaMA8xDTALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBA
|
||||
QUAA4IBDwAwggEKAoIBAQDER/lB8wUAmPTSwSc/NOXNlzdpPOQDSwrhKH6X
|
||||
sqZF4KpQoSY/nmCjAhJmOVpOUo4K2fGRZ0yAH9fkGv6yJP6c7IAFjLeec7G
|
||||
PHVwN4bZrP1DXfTAmfmXhcRQbCYkV+wmq8Puzw/+xA9EJrrodnJPPsE6E8H
|
||||
nSVLF6Ys9+cJMJ7HuwOI+wYt3gkmspsir1tccmf4x1PP+yHJWdcXyetlFRc
|
||||
mZ8gspjqOR2jb89xSQsh8gcyDW6rPNlSTzYZ2FmNtjES6ZhCsYL31fQbF2Q
|
||||
glidlLGpAlvHUUS+xCigW73cvhFPMWXcfO51Mr15RcgYTckY+7QZ2nYqplR
|
||||
BoDlQl6DnAgMBAAGjUzBRMB0GA1UdDgQWBBTPG99XVRdxpOXMZo3Nhy+ldn
|
||||
f13TAfBgNVHSMEGDAWgBTPG99XVRdxpOXMZo3Nhy+ldnf13TAPBgNVHRMBA
|
||||
f8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAjWTcnIl2mpNbfHAN8DB4K
|
||||
k+RNRmhsH0y+r/47MXVTMMMToCfofeNY3Jeohu+2lIXMPQfTvXUbDTkNAGs
|
||||
GLv6LtQEUfSREqgk1eY7bT9BFfpH1uV2ZFhCO9jBA+E4bf55Kx7bgUNG31y
|
||||
kBshOsOblOJM1lS/0q4TWHAxrsU2PNwPi8X0ten+eGeB8aRshxS17Ij2cH0
|
||||
fdAMmSA+jMAvTIZl853Bxe0HuozauKwOFWL4qHm61c4O/j1mQCLqJKYfJ9m
|
||||
BDWFQLszd/tF+ePKiNhZCQly60F8Lumn2CDZj5UIkl8wk9Wls5n1BIQs+M8
|
||||
AN65NAdv7+js8jKUKCuyji8r3
|
||||
- MIIC/zCCAeegAwIBAgIUZGHLaSYg1myp6EI4VGWSC27vOrswDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEdGVzdDAeFw0xOTEwMTQxNjI4MzVaFw0yMDEwMTMxNjI4MzVaMA8xDTALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDER/lB8wUAmPTSwSc/NOXNlzdpPOQDSwrhKH6XsqZF4KpQoSY/nmCjAhJmOVpOUo4K2fGRZ0yAH9fkGv6yJP6c7IAFjLeec7GPHVwN4bZrP1DXfTAmfmXhcRQbCYkV+wmq8Puzw/+xA9EJrrodnJPPsE6E8HnSVLF6Ys9+cJMJ7HuwOI+wYt3gkmspsir1tccmf4x1PP+yHJWdcXyetlFRcmZ8gspjqOR2jb89xSQsh8gcyDW6rPNlSTzYZ2FmNtjES6ZhCsYL31fQbF2QglidlLGpAlvHUUS+xCigW73cvhFPMWXcfO51Mr15RcgYTckY+7QZ2nYqplRBoDlQl6DnAgMBAAGjUzBRMB0GA1UdDgQWBBTPG99XVRdxpOXMZo3Nhy+ldnf13TAfBgNVHSMEGDAWgBTPG99XVRdxpOXMZo3Nhy+ldnf13TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAjWTcnIl2mpNbfHAN8DB4Kk+RNRmhsH0y+r/47MXVTMMMToCfofeNY3Jeohu+2lIXMPQfTvXUbDTkNAGsGLv6LtQEUfSREqgk1eY7bT9BFfpH1uV2ZFhCO9jBA+E4bf55Kx7bgUNG31ykBshOsOblOJM1lS/0q4TWHAxrsU2PNwPi8X0ten+eGeB8aRshxS17Ij2cH0fdAMmSA+jMAvTIZl853Bxe0HuozauKwOFWL4qHm61c4O/j1mQCLqJKYfJ9mBDWFQLszd/tF+ePKiNhZCQly60F8Lumn2CDZj5UIkl8wk9Wls5n1BIQs+M8AN65NAdv7+js8jKUKCuyji8r3
|
||||
action: member
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user