From e3def666c836e00e9c548d8c16e16e98ea237af8 Mon Sep 17 00:00:00 2001
From: jakub <jakub@zacekj.cz>
Date: Wed, 2 Sep 2026 20:03:52 +0000
Subject: [PATCH] Update initial_install/roles/freeipa_client/tasks/main.yml

---
 .../roles/freeipa_client/tasks/main.yml       | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/initial_install/roles/freeipa_client/tasks/main.yml b/initial_install/roles/freeipa_client/tasks/main.yml
index bab499f..3e779f6 100644
--- a/initial_install/roles/freeipa_client/tasks/main.yml
+++ b/initial_install/roles/freeipa_client/tasks/main.yml
@@ -18,6 +18,11 @@
     path: /etc/ipa/default.conf
   register: ipa_client_conf
 
+- name: Check if Kerberos host keytab exists
+  ansible.builtin.stat:
+    path: /etc/krb5.keytab
+  register: ipa_keytab
+
 - name: Enroll to FreeIPA
   ansible.builtin.command:
     argv:
@@ -31,8 +36,9 @@
       - "--password={{ ipa_admin_password }}"
       - --unattended
       - --force-join
-  no_log: false
-  when: not ipa_client_conf.stat.exists
+  no_log: true
+  when:
+    - not ipa_client_conf.stat.exists or not ipa_keytab.stat.exists
 
 - name: Check current sudo alternative
   ansible.builtin.command:
@@ -50,7 +56,9 @@
       - sudo
       - /usr/bin/sudo.ws
   when:
-    - ansible_distribution == "Ubuntu"
+    - ansible_facts['distribution'] == "Ubuntu"
+    - sudo_alternative.rc == 0
+    - "'/usr/bin/sudo.ws' in sudo_alternative.stdout"
     - "'Value: /usr/bin/sudo.ws' not in sudo_alternative.stdout"
 
 - name: Prioritize SSS over local accounts in NSS
@@ -63,7 +71,14 @@
     - group
   notify: Restart SSSD
 
-- name: Enable mkhomedir
+- name: Check if authselect is available
+  ansible.builtin.command:
+    cmd: command -v authselect
+  register: authselect_available
+  changed_when: false
+  failed_when: false
+
+- name: Enable mkhomedir with authselect
   ansible.builtin.command:
     argv:
       - authselect
@@ -72,6 +87,7 @@
   register: authselect_mkhomedir
   changed_when: "'already enabled' not in authselect_mkhomedir.stdout"
   failed_when: false
+  when: authselect_available.rc == 0
 
 - name: Enable and start oddjobd
   ansible.builtin.service: