mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-27 01:44:44 +00:00

Files

chrisp 56b1368441 There is a new config management module placed in the plugins folder:

plugins/modules/ipaconfig.py

The config module allows the user change global config settings.

The config module is as compatible as possible to the Ansible upstream
ipa_config module, but adds many extra variables.

Here is the documentation for the module:

  README-config.md

2020-06-05 14:58:46 +01:00

4.9 KiB

Raw Blame History

Config module

Description

The config module allows the setting of global config parameters within IPA. If no parameters are specified it returns the list of all current parameters.

The config module is as compatible as possible to the Ansible upstream ipa_config module, but adds many additional parameters

Features

IPA server configuration management

Supported FreeIPA Versions

FreeIPA versions 4.4.0 and up are supported by the ipaconfig module.

Requirements

Controller

Ansible version: 2.8+

Node

Supported FreeIPA version (see above)

Usage

Example inventory file

[ipaserver]
ipaserver.test.local

Example playbook to read config options:

---
- name: Playbook to handle global config options
  hosts: ipaserver
  become: true
  tasks:
    - name: return current values of the global configuration options
      ipaconfig:
        ipaadmin_password: password
      register: result
    - name: display default login shell
      debug:
        msg: '{{result.config.defaultlogin }}'

    - name: ensure defaultloginshell and maxusernamelength are set as required
      ipaconfig:
        ipaadmin_password: password
        defaultlogin: /bin/bash
        maxusername: 64

---
- name: Playbook to ensure some config options are set
  hosts: ipaserver
  become: true
  tasks:
    - name: set defaultlogin and maxusername
      ipaconfig:
        ipaadmin_password: password
        defaultlogin: /bin/bash
        maxusername: 64

Variables

ipauser

General Variables:

Variable	Description	Required
`ipaadmin_principal`	The admin principal is a string and defaults to `admin`	no
`ipaadmin_password`	The admin password is a string and is required if there is no admin ticket available on the node	no
`maxusername` \| `ipamaxusernamelength`	Set the maximum username length (1 to 255)	false
`homedirectory` \| `ipahomesrootdir`	Set the default location of home directories	false
`defaultshell` \| `ipadefaultloginshell`	Set the default shell for new users	false
`defaultgroup` \| `ipadefaultprimarygroup`	Set the default group for new users	false
`emaildomain`\| `ipadefaultemaildomain`	Set the default e-mail domain	false
`searchtimelimit` \| `ipasearchtimelimit`	Set maximum amount of time (seconds) for a search -1 to 2147483647 (-1 or 0 is unlimited)	false
`searchrecordslimit` \| `ipasearchrecordslimit`	Set maximum number of records to search -1 to 2147483647 (-1 or 0 is unlimited)	false
`usersearch` \| `ipausersearchfields`	Set list of fields to search when searching for users	false
`groupsearch` \| `ipagroupsearchfields`	Set list of fields to search in when searching for groups	false
`enable_migration` \| `ipamigrationenabled`	Enable migration mode (choices: True, False )	false
`groupobjectclasses` \| `ipagroupobjectclasses`	Set default group objectclasses (list)	false
`userobjectclasses` \| `ipauserobjectclasses`	Set default user objectclasses (list)	false
`pwdexpnotify` \| `ipapwdexpadvnotify`	Set number of days's notice of impending password expiration (0 to 2147483647)	false
`configstring` \| `ipaconfigstring`	Set extra hashes to generate in password plug-in (choices:`AllowNThash`, `KDC:Disable Last Success`, `KDC:Disable Lockout`, `KDC:Disable Default Preauth for SPNs`)	false
`selinuxusermaporder` \| `ipaselinuxusermaporder`	Set ordered list in increasing priority of SELinux users	false
`selinuxusermapdefault`\| `ipaselinuxusermapdefault`	Set default SELinux user when no match is found in SELinux map rule	false
`pac_type` \| `ipakrbauthzdata`	set default types of PAC supported for services (choices: `MS-PAC`, `PAD`, `nfs:NONE`)
`user_auth_type` \| `ipauserauthtype`	set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`)	false
`domain_resolution_order` \| `ipadomainresolutionorder`	Set list of domains used for short name qualification	false

Return Values

Variable	Description	Returned When
`config`	config dict Fields:	No values to configure are specified
	`homedirectory`
	`defaultshell`
	`defaultgroup`
	`emaildomain`
	`searchtimelimit`
	`searchrecordslimit`
	`usersearch`
	`groupsearch`
	`enable_migration`
	`groupobjectclasses`
	`userobjectclasses`
	`pwdexpnotify`
	`configstring`
	`selinuxusermaporder`
	`selinuxusermapdefault`
	`pac_type`
	`user_auth_type`
	`domain_resolution_order`

All returned fields take the same form as their namesake input parameters

Authors

Chris Procter

4.9 KiB Raw Blame History