ansible-freeipa/roles/ipaclient/tasks/install.yml

---
# tasks file for ipaclient

- name: Install - Ensure that IPA client packages are installed
  package:
    name: "{{ ipaclient_packages }}"
    state: present
  when: ipaclient_install_packages | bool

- name: Install - Set ipaclient_servers
  set_fact:
    ipaclient_servers: "{{ groups['ipaservers'] | list }}"
  when: groups.ipaservers is defined and ipaclient_servers is not defined

- name: Install - Set ipaclient_servers from cluster inventory
  set_fact:
    ipaclient_servers: "{{ groups['ipaserver'] | list }}"
  when: ipaclient_no_dns_lookup | bool and groups.ipaserver is defined and
        ipaclient_servers is not defined

- name: Install - Check that either principal or keytab is set
  fail: msg="ipaadmin_principal and ipaadmin_keytab cannot be used together"
  when: ipaadmin_keytab is defined and ipaadmin_principal is defined

- name: Install - Set default principal if no keytab is given
  set_fact:
    ipaadmin_principal: admin
  when: ipaadmin_principal is undefined and ipaclient_keytab is undefined

- name: Install - IPA client test
  ipaclient_test:
    ### basic ###
    domain: "{{ ipaserver_domain | default(ipaclient_domain) | default(omit) }}"
    servers: "{{ ipaclient_servers | default(omit) }}"
    realm: "{{ ipaserver_realm | default(ipaclient_realm) | default(omit) }}"
    hostname: "{{ ipaclient_hostname | default(ansible_facts['fqdn']) }}"
    ntp_servers: "{{ ipaclient_ntp_servers | default(omit) }}"
    ntp_pool: "{{ ipaclient_ntp_pool | default(omit) }}"
    no_ntp: "{{ ipaclient_no_ntp }}"
    force_ntpd: "{{ ipaclient_force_ntpd }}"
    nisdomain: "{{ ipaclient_nisdomain | default(omit) }}"
    no_nisdomain: "{{ ipaclient_no_nisdomain }}"
    kinit_attempts: "{{ ipaclient_kinit_attempts }}"
    ca_cert_files: "{{ ipaclient_ca_cert_file | default(omit) }}"
    configure_firefox: "{{ ipaclient_configure_firefox }}"
    firefox_dir: "{{ ipaclient_firefox_dir | default(omit) }}"
    ip_addresses: "{{ ipaclient_ip_addresses | default(omit) }}"
    all_ip_addresses: "{{ ipaclient_all_ip_addresses }}"
    on_master: "{{ ipaclient_on_master }}"
    ### sssd ###
    enable_dns_updates: "{{ ipassd_enable_dns_updates
                            | default(ipasssd_enable_dns_updates) }}"
  register: result_ipaclient_test

- block:
  - name: Install - Cleanup leftover ccache
    file:
      path: "/etc/ipa/.dns_ccache"
      state: absent

  - name: Install - Configure NTP
    ipaclient_setup_ntp:
      ### basic ###
      ntp_servers: "{{ result_ipaclient_test.ntp_servers | default(omit) }}"
      ntp_pool: "{{ result_ipaclient_test.ntp_pool | default(omit) }}"
      no_ntp: "{{ ipaclient_no_ntp }}"
      # force_ntpd: "{{ ipaclient_force_ntpd }}"
      on_master: "{{ ipaclient_on_master }}"
      ### additional ###
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"

  - name: Install - Make sure One-Time Password is enabled if it's already defined
    set_fact:
      ipaclient_use_otp: "yes"
    when: ipaclient_otp is defined

  - name: Install - Disable One-Time Password for on_master
    set_fact:
      ipaclient_use_otp: "no"
    when: ipaclient_use_otp | bool and ipaclient_on_master | bool

  - name: Install - Test if IPA client has working krb5.keytab
    ipaclient_test_keytab:
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"
      realm: "{{ result_ipaclient_test.realm }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      kdc: "{{ result_ipaclient_test.kdc }}"
      kinit_attempts: "{{ ipaclient_kinit_attempts | default(omit) }}"
    register: result_ipaclient_test_keytab

  - name: Install - Disable One-Time Password for client with working
          krb5.keytab
    set_fact:
      ipaclient_use_otp: "no"
    when: ipaclient_use_otp | bool and
          result_ipaclient_test_keytab.krb5_keytab_ok and
          not ipaclient_force_join | bool

  # The following block is executed when using OTP to enroll IPA client and
  # the OTP isn't predefined, ie when ipaclient_use_otp is set and ipaclient_otp
  # is not set.
  # It connects to ipaserver and add the host with --random option in order
  # to create a OneTime Password
  # If a keytab is specified in the hostent, then the hostent will be disabled
  # if ipaclient_use_otp is set.
  - block:
    - name: Install - Keytab or password is required for getting otp
      fail: msg="Keytab or password is required for getting otp"
      when: ipaadmin_keytab is undefined and ipaadmin_password is undefined

    - name: Install - Get One-Time Password for client enrollment
      no_log: yes
      ipaclient_get_otp:
        state: present
        principal: "{{ ipaadmin_principal | default(omit) }}"
        password: "{{ ipaadmin_password | default(omit) }}"
        keytab: "{{ ipaadmin_keytab | default(omit) }}"
        fqdn: "{{ result_ipaclient_test.hostname }}"
        lifetime: "{{ ipaclient_lifetime | default(omit) }}"
        random: True
      register: result_ipaclient_get_otp
      # If the host is already enrolled, this command will exit on error
      # The error can be ignored
      failed_when: result_ipaclient_get_otp is failed and
                   "Password cannot be set on enrolled host" not
                       in result_ipaclient_get_otp.msg
      delegate_to: "{{ result_ipaclient_test.servers[0] }}"
      ignore_errors: yes

    - name: Install - Report error for OTP generation
      debug:
        msg: "{{ result_ipaclient_get_otp.msg }}"
      when: result_ipaclient_get_otp is failed
      failed_when: yes

    - name: Install - Store the previously obtained OTP
      no_log: yes
      set_fact:
        ipaadmin_orig_password: "{{ ipaadmin_password | default(omit) }}"
        ipaadmin_password: "{{ result_ipaclient_get_otp.host.randompassword
                               if result_ipaclient_get_otp.host is defined }}"

    when: ipaclient_use_otp | bool and ipaclient_otp is not defined

  - name: Store predefined OTP in admin_password
    no_log: yes
    set_fact:
      ipaadmin_orig_password: "{{ ipaadmin_password | default(omit) }}"
      ipaadmin_password: "{{ ipaclient_otp }}"
    when: ipaclient_otp is defined

  - block:
    # This block is executed only when
    # not (not ipaclient_on_master | bool and
    #      not result_ipaclient_join.changed and
    #      not ipaclient_allow_repair | bool and
    #      (result_ipaclient_test_keytab.krb5_keytab_ok or
    #       (result_ipaclient_join.already_joined is defined and
    #        result_ipaclient_join.already_joined)))

    - name: Install - Check if principal and keytab are set
      fail: msg="Principal and keytab cannot be used together"
      when: ipaadmin_principal is defined and ipaclient_keytab is defined

    - name: Install - Check if one of password or keytabs are set
      fail: msg="At least one of password or keytabs must be specified"
      when: not result_ipaclient_test_keytab.krb5_keytab_ok
            and ipaadmin_password is undefined
            and ipaadmin_keytab is undefined
            and ipaclient_keytab is undefined
    when: not ipaclient_on_master | bool

  - name: Install - Purge {{ result_ipaclient_test.realm }} from host keytab
    command: >
      /usr/sbin/ipa-rmkeytab
      -k /etc/krb5.keytab
      -r "{{ result_ipaclient_test.realm }}"
    register: result_ipa_rmkeytab
    # Do not fail on error codes 3 and 5:
    #   3 - Unable to open keytab
    #   5 - Principal name or realm not found in keytab
    #   7 - Failed to set cursor, typically when errcode
    #       would be issued in past
    failed_when: result_ipa_rmkeytab.rc != 0 and
                 result_ipa_rmkeytab.rc != 3 and
                 result_ipa_rmkeytab.rc != 5 and
                 result_ipa_rmkeytab.rc != 7
    when: (ipaclient_use_otp | bool or ipaclient_force_join | bool) and not ipaclient_on_master | bool

  - name: Install - Backup and set hostname
    ipaclient_set_hostname:
      hostname: "{{ result_ipaclient_test.hostname }}"
    when: not ipaclient_on_master | bool

  - name: Install - Join IPA
    ipaclient_join:
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"
      realm: "{{ result_ipaclient_test.realm }}"
      kdc: "{{ result_ipaclient_test.kdc }}"
      basedn: "{{ result_ipaclient_test.basedn }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      force_join: "{{ ipaclient_force_join | default(omit) }}"
      principal: "{{ ipaadmin_principal if not ipaclient_use_otp | bool and
                     ipaclient_keytab is not defined else omit }}"
      password: "{{ ipaadmin_password | default(omit) }}"
      keytab: "{{ ipaclient_keytab | default(omit) }}"
      admin_keytab: "{{ ipaadmin_keytab if ipaadmin_keytab is defined and not ipaclient_use_otp | bool else omit }}"
      # ca_cert_file: "{{ ipaclient_ca_cert_file | default(omit) }}"
      kinit_attempts: "{{ ipaclient_kinit_attempts | default(omit) }}"
    register: result_ipaclient_join
    when: not ipaclient_on_master | bool and
          (not result_ipaclient_test_keytab.krb5_keytab_ok or
              ipaclient_force_join)

  - block:
    - fail:
        msg: >
          The krb5 configuration is not correct, please enable allow_repair
          to fix this.
      when: not result_ipaclient_test_keytab.krb5_conf_ok
    - fail:
        msg: "The IPA test failed, please enable allow_repair to fix this."
      when: not result_ipaclient_test_keytab.ping_test_ok
    - fail:
        msg: >
          The ca.crt file is missing, please enable allow_repair to fix this.
      when: not result_ipaclient_test_keytab.ca_crt_exists
    when: not ipaclient_on_master | bool and
          not result_ipaclient_join.changed and
          not ipaclient_allow_repair | bool and
          (result_ipaclient_test_keytab.krb5_keytab_ok or
              (result_ipaclient_join.already_joined is defined and
                  result_ipaclient_join.already_joined))

  - block:
    - name: Install - Configure IPA default.conf
      ipaclient_ipa_conf:
        servers: "{{ result_ipaclient_test.servers }}"
        domain: "{{ result_ipaclient_test.domain }}"
        realm: "{{ result_ipaclient_test.realm }}"
        hostname: "{{ result_ipaclient_test.hostname }}"
        basedn: "{{ result_ipaclient_test.basedn }}"
      when: not ipaclient_on_master | bool

    - name: Install - Configure SSSD
      ipaclient_setup_sssd:
        servers: "{{ result_ipaclient_test.servers }}"
        domain: "{{ result_ipaclient_test.domain }}"
        realm: "{{ result_ipaclient_test.realm }}"
        hostname: "{{ result_ipaclient_test.hostname }}"
        on_master: "{{ ipaclient_on_master }}"
        no_ssh: "{{ ipaclient_no_ssh }}"
        no_sshd: "{{ ipaclient_no_sshd }}"
        no_sudo: "{{ ipaclient_no_sudo }}"
        all_ip_addresses: "{{ ipaclient_all_ip_addresses }}"
        fixed_primary: "{{ ipassd_fixed_primary
                           | default(ipasssd_fixed_primary) }}"
        permit: "{{ ipassd_permit | default(ipasssd_permit) }}"
        enable_dns_updates: "{{ ipassd_enable_dns_updates
                                | default(ipasssd_enable_dns_updates) }}"
        preserve_sssd: "{{ ipassd_preserve_sssd
                           | default(ipasssd_preserve_sssd) }}"
        no_krb5_offline_passwords:
          "{{ ipassd_no_krb5_offline_passwords
              | default(ipasssd_no_krb5_offline_passwords) }}"

    - name: Install - Configure krb5 for IPA realm
      ipaclient_setup_krb5:
        realm: "{{ result_ipaclient_test.realm }}"
        domain: "{{ result_ipaclient_test.domain }}"
        servers: "{{ result_ipaclient_test.servers }}"
        kdc: "{{ result_ipaclient_test.kdc }}"
        dnsok: "{{ result_ipaclient_test.dnsok }}"
        client_domain: "{{ result_ipaclient_test.client_domain }}"
        hostname: "{{ result_ipaclient_test.hostname }}"
        sssd: "{{ result_ipaclient_test.sssd }}"
        force: "{{ ipaclient_force }}"
        # on_master: "{{ ipaclient_on_master }}"
      when: not ipaclient_on_master | bool

    - name: Install - IPA API calls for remaining enrollment parts
      ipaclient_api:
        servers: "{{ result_ipaclient_test.servers }}"
        realm: "{{ result_ipaclient_test.realm }}"
        hostname: "{{ result_ipaclient_test.hostname }}"
        # debug: yes
      register: result_ipaclient_api

    - name: Install - Fix IPA ca
      ipaclient_fix_ca:
        servers: "{{ result_ipaclient_test.servers }}"
        realm: "{{ result_ipaclient_test.realm }}"
        basedn: "{{ result_ipaclient_test.basedn }}"
        allow_repair: "{{ ipaclient_allow_repair }}"
      when: not ipaclient_on_master | bool and
            result_ipaclient_test_keytab.krb5_keytab_ok and
            not result_ipaclient_test_keytab.ca_crt_exists

    - name: Install - Create IPA NSS database
      ipaclient_setup_nss:
        servers: "{{ result_ipaclient_test.servers }}"
        domain: "{{ result_ipaclient_test.domain }}"
        realm: "{{ result_ipaclient_test.realm }}"
        basedn: "{{ result_ipaclient_test.basedn }}"
        hostname: "{{ result_ipaclient_test.hostname }}"
        subject_base: "{{ result_ipaclient_api.subject_base }}"
        principal: "{{ ipaadmin_principal | default(omit) }}"
        mkhomedir: "{{ ipaclient_mkhomedir }}"
        ca_enabled: "{{ result_ipaclient_api.ca_enabled }}"
        on_master: "{{ ipaclient_on_master }}"
        dnsok: "{{ result_ipaclient_test.dnsok }}"
        enable_dns_updates: "{{ ipassd_enable_dns_updates
                                | default(ipasssd_enable_dns_updates) }}"
        all_ip_addresses: "{{ ipaclient_all_ip_addresses }}"
        ip_addresses: "{{ ipaclient_ip_addresses | default(omit) }}"
        request_cert: "{{ ipaclient_request_cert }}"
        preserve_sssd: "{{ ipassd_preserve_sssd
                           | default(ipasssd_preserve_sssd) }}"
        no_ssh: "{{ ipaclient_no_ssh }}"
        no_sshd: "{{ ipaclient_no_sshd }}"
        no_sudo: "{{ ipaclient_no_sudo }}"
        fixed_primary: "{{ ipassd_fixed_primary
                           | default(ipasssd_fixed_primary) }}"
        permit: "{{ ipassd_permit | default(ipasssd_permit) }}"
        no_krb5_offline_passwords:
          "{{ ipassd_no_krb5_offline_passwords
              | default(ipasssd_no_krb5_offline_passwords) }}"
        no_dns_sshfp: "{{ ipaclient_no_dns_sshfp }}"

    - name: Install - Configure SSH and SSHD
      ipaclient_setup_ssh:
        servers: "{{ result_ipaclient_test.servers }}"
        sssd: "{{ result_ipaclient_test.sssd }}"
        no_ssh: "{{ ipaclient_no_ssh }}"
        ssh_trust_dns: "{{ ipaclient_ssh_trust_dns }}"
        no_sshd: "{{ ipaclient_no_sshd }}"

    - name: Install - Configure automount
      ipaclient_setup_automount:
        servers: "{{ result_ipaclient_test.servers }}"
        sssd: "{{ result_ipaclient_test.sssd }}"
        automount_location: "{{ ipaautomount_location | default(omit) }}"

    - name: Install - Configure firefox
      ipaclient_setup_firefox:
        firefox_dir: "{{ ipaclient_firefox_dir | default(omit) }}"
        domain: "{{ result_ipaclient_test.domain }}"
      when: ipaclient_configure_firefox | bool

    - name: Install - Configure NIS
      ipaclient_setup_nis:
        domain: "{{ result_ipaclient_test.domain }}"
        nisdomain: "{{ ipaclient_nisdomain | default(omit) }}"
      when: not ipaclient_no_nisdomain | bool

    when: not (not ipaclient_on_master | bool and
          not result_ipaclient_join.changed and
          not ipaclient_allow_repair | bool
              and (result_ipaclient_test_keytab.krb5_keytab_ok
              or (result_ipaclient_join.already_joined is defined
              and result_ipaclient_join.already_joined)))

  when: not ansible_check_mode and
        not (result_ipaclient_test.client_already_configured and
            not ipaclient_allow_repair | bool and not ipaclient_force_join | bool)

  always:
  - name: Install - Restore original admin password if overwritten by OTP
    no_log: yes
    set_fact:
        ipaadmin_password: "{{ ipaadmin_orig_password }}"
    when: ipaclient_use_otp | bool and ipaadmin_orig_password is defined

  - name: Cleanup leftover ccache
    file:
      path: "/etc/ipa/.dns_ccache"
      state: absent