102 lines
2.5 KiB
YAML
102 lines
2.5 KiB
YAML
---
|
|
- name: Install FreeIPA client packages
|
|
ansible.builtin.package:
|
|
name:
|
|
- freeipa-client
|
|
- sssd
|
|
- sssd-tools
|
|
- oddjob
|
|
- oddjob-mkhomedir
|
|
state: present
|
|
|
|
- name: Set hostname FQDN
|
|
ansible.builtin.hostname:
|
|
name: "{{ inventory_hostname }}"
|
|
|
|
- name: Check if FreeIPA client is already configured
|
|
ansible.builtin.stat:
|
|
path: /etc/ipa/default.conf
|
|
register: ipa_client_conf
|
|
|
|
- name: Check if Kerberos host keytab exists
|
|
ansible.builtin.stat:
|
|
path: /etc/krb5.keytab
|
|
register: ipa_keytab
|
|
|
|
- name: Enroll to FreeIPA
|
|
ansible.builtin.command:
|
|
argv:
|
|
- ipa-client-install
|
|
- --domain=im.lab
|
|
- --realm=IM.LAB
|
|
- --server=ipa.im.lab
|
|
- "--hostname={{ inventory_hostname }}"
|
|
- --mkhomedir
|
|
- --principal=admin
|
|
- "--password={{ ipa_admin_password }}"
|
|
- --unattended
|
|
- --force-join
|
|
no_log: true
|
|
when:
|
|
- not ipa_client_conf.stat.exists or not ipa_keytab.stat.exists
|
|
|
|
- name: Check current sudo alternative
|
|
ansible.builtin.command:
|
|
cmd: update-alternatives --query sudo
|
|
register: sudo_alternative
|
|
changed_when: false
|
|
failed_when: false
|
|
when: ansible_facts['distribution'] == "Ubuntu"
|
|
|
|
- name: Switch to classic sudo
|
|
ansible.builtin.command:
|
|
argv:
|
|
- update-alternatives
|
|
- --set
|
|
- sudo
|
|
- /usr/bin/sudo.ws
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
- sudo_alternative.rc == 0
|
|
- "'/usr/bin/sudo.ws' in sudo_alternative.stdout"
|
|
- "'Value: /usr/bin/sudo.ws' not in sudo_alternative.stdout"
|
|
|
|
- name: Prioritize SSS over local accounts in NSS
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/nsswitch.conf
|
|
regexp: '^{{ item }}:'
|
|
line: '{{ item }}: sss files systemd'
|
|
loop:
|
|
- passwd
|
|
- group
|
|
notify: Restart SSSD
|
|
|
|
- name: Check if authselect is available
|
|
ansible.builtin.command:
|
|
cmd: command -v authselect
|
|
register: authselect_available
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Enable mkhomedir with authselect
|
|
ansible.builtin.command:
|
|
argv:
|
|
- authselect
|
|
- enable-feature
|
|
- with-mkhomedir
|
|
register: authselect_mkhomedir
|
|
changed_when: "'already enabled' not in authselect_mkhomedir.stdout"
|
|
failed_when: false
|
|
when: authselect_available.rc == 0
|
|
|
|
- name: Enable and start oddjobd
|
|
ansible.builtin.service:
|
|
name: oddjobd
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Enable and start SSSD
|
|
ansible.builtin.service:
|
|
name: sssd
|
|
state: started
|
|
enabled: true |