jakub
65a02177fa
Rewrites the passwd and group lines in /etc/nsswitch.conf so SSSD is consulted before local files, and notifies the existing SSSD restart handler so the change takes effect immediately. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
67 lines
1.5 KiB
YAML
67 lines
1.5 KiB
YAML
---
|
|
- name: Install FreeIPA client packages
|
|
ansible.builtin.package:
|
|
name:
|
|
- freeipa-client
|
|
- sssd
|
|
- sssd-tools
|
|
- oddjob
|
|
- oddjob-mkhomedir
|
|
state: present
|
|
|
|
- name: Set hostname FQDN
|
|
ansible.builtin.hostname:
|
|
name: "{{ inventory_hostname }}.im.lab"
|
|
|
|
- name: Check if FreeIPA client is already configured
|
|
ansible.builtin.stat:
|
|
path: /etc/ipa/default.conf
|
|
register: ipa_client_conf
|
|
|
|
- name: Enroll to FreeIPA
|
|
ansible.builtin.command:
|
|
argv:
|
|
- ipa-client-install
|
|
- --domain=im.lab
|
|
- --realm=IM.LAB
|
|
- --server=ipa.im.lab
|
|
- "--hostname={{ inventory_hostname }}.im.lab"
|
|
- --mkhomedir
|
|
- --principal=admin
|
|
- --password={{ ipa_admin_password }}
|
|
- --unattended
|
|
- --force-join
|
|
no_log: false
|
|
when: not ipa_client_conf.stat.exists
|
|
|
|
- name: Prioritize SSS over local accounts in NSS
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/nsswitch.conf
|
|
regexp: '^{{ item }}:'
|
|
line: '{{ item }}: sss files systemd'
|
|
loop:
|
|
- passwd
|
|
- group
|
|
notify: Restart SSSD
|
|
|
|
- name: Enable mkhomedir
|
|
ansible.builtin.command:
|
|
argv:
|
|
- authselect
|
|
- enable-feature
|
|
- with-mkhomedir
|
|
register: authselect_mkhomedir
|
|
changed_when: "'already enabled' not in authselect_mkhomedir.stdout"
|
|
failed_when: false
|
|
|
|
- name: Enable and start oddjobd
|
|
ansible.builtin.service:
|
|
name: oddjobd
|
|
state: started
|
|
enabled: true
|
|
|
|
- name: Enable and start SSSD
|
|
ansible.builtin.service:
|
|
name: sssd
|
|
state: started
|
|
enabled: true |