Chapter 6. Configuring global IdM settings using Ansible playbooks Using the Ansible config module, you can retrieve and set global configuration parameters for Identity Management (IdM). Retrieving IdM configuration using an Ansible playbook Configuring the IdM CA renewal server using an Ansible playbook Configuring the default shell for IdM users using an Ansible playbook Configuring a NETBIOS name for an IdM domain by using Ansible Ensuring that IdM users and groups have SIDs by using Ansible 6.1. Retrieving IdM configuration using an Ansible playbook The following procedure describes how you can use an Ansible playbook to retrieve information about the current global IdM configuration. Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Open the /usr/share/doc/ansible-freeipa/playbooks/config/retrieve-config.yml Ansible playbook file for editing: Adapt the file by changing the following: The password of IdM administrator. Other values, if necessary. Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 6.2. Configuring the IdM CA renewal server using an Ansible playbook In an Identity Management (IdM) deployment that uses an embedded certificate authority (CA), the CA renewal server maintains and renews IdM system certificates. It ensures robust IdM deployments. For more details on the role of the IdM CA renewal server, see Using IdM CA renewal server . The following procedure describes how you can use an Ansible playbook to configure the IdM CA renewal server. Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Optional: Identify the current IdM CA renewal server: Create an inventory file, for example inventory.file , and define ipaserver in it: Open the /usr/share/doc/ansible-freeipa/playbooks/config/set-ca-renewal-master-server.yml Ansible playbook file for editing: Adapt the file by changing: The password of IdM administrator set by the ipaadmin_password variable. The name of the CA renewal server set by the ca_renewal_master_server variable. Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification You can verify that the CA renewal server has been changed: Log into ipaserver as IdM administrator: Request the identity of the IdM CA renewal server: The output shows the carenewal.idm.example.com server is the new CA renewal server. 6.3. Configuring the default shell for IdM users using an Ansible playbook The shell is a program that accepts and interprets commands. Several shells are available in Red Hat Enterprise Linux (RHEL), such as bash , sh , ksh , zsh , fish , and others. Bash , or /bin/bash , is a popular shell on most Linux systems, and it is normally the default shell for user accounts on RHEL. The following procedure describes how you can use an Ansible playbook to configure sh , an alternative shell, as the default shell for IdM users. Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Optional: Use the retrieve-config.yml Ansible playbook to identify the current shell for IdM users. See Retrieving IdM configuration using an Ansible playbook for details. Create an inventory file, for example inventory.file , and define ipaserver in it: Open the /usr/share/doc/ansible-freeipa/playbooks/config/ensure-config-options-are-set.yml Ansible playbook file for editing: Adapt the file by changing the following: The password of IdM administrator set by the ipaadmin_password variable. The default shell of the IdM users set by the defaultshell variable into /bin/sh . Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification You can verify that the default user shell has been changed by starting a new session in IdM: Log into ipaserver as IdM administrator: Display the current shell: The logged-in user is using the sh shell. 6.4. Configuring a NetBIOS name for an IdM domain by using Ansible The NetBIOS name is used for Microsoft Windows' (SMB) type of sharing and messaging. You can use NetBIOS names to map a drive or connect to a printer. Follow this procedure to use an Ansible playbook to configure a NetBIOS name for your Identity Management (IdM) domain. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. The ansible-freeipa package is installed. Assumptions The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you know the vault file password. Procedure Navigate to your ~/ MyPlaybooks / directory: Create a netbios-domain-name-present.yml Ansible playbook file. Add the following content to the file: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: When prompted, provide the vault file password. Additional resources Guidelines for configuring NetBIOS names 6.5. Ensuring that IdM users and groups have SIDs by using Ansible The Identity Management (IdM) server can assign unique security identifiers (SIDs) to IdM users and groups internally, based on the data from the ID ranges of the local domain. The SIDs are stored in the user and group objects. The goal of ensuring that IdM users and groups have SIDs is to allow the generation of the Privileged Attribute Certificate (PAC), which is the first step towards IdM-IdM trusts. If IdM users and groups have SIDs, IdM is able to issue Kerberos tickets with PAC data. Follow this procedure to achieve the following goals: Generate SIDs for already existing IdM users and user groups. Enable the generation of SIDs for IdM new users and groups. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. The ansible-freeipa package is installed. Assumptions The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you know the vault file password. Procedure Navigate to your ~/ MyPlaybooks / directory: Create a sids-for-users-and-groups-present.yml Ansible playbook file. Add the following content to the file: The enable_sid variable enables SID generation for future IdM users and groups. The add_sids variable generates SIDs for existing IdM users and groups. Note When using add_sids: true , you must also set the enable_sid variable to true . Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: When prompted, provide the vault file password. Additional resources The role of security and relative identifiers in IdM ID ranges . 6.6. Additional resources See README-config.md in the /usr/share/doc/ansible-freeipa/ directory. See sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/config directory.

Commands:
--- - name: Playbook to handle global IdM configuration hosts: ipaserver become: no gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Query IPA global configuration ipaconfig: ipaadmin_password: "{{ ipaadmin_password }}" register: serverconfig - debug: msg: "{{ serverconfig }}"
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/config/retrieve-config.yml [...] TASK [debug] ok: [server.idm.example.com] => { "msg": { "ansible_facts": { "discovered_interpreter_ }, "changed": false, "config": { "ca_renewal_master_server": "server.idm.example.com", "configstring": [ "AllowNThash", "KDC:Disable Last Success" ], "defaultgroup": "ipausers", "defaultshell": "/bin/bash", "emaildomain": "idm.example.com", "enable_migration": false, "groupsearch": [ "cn", "description" ], "homedirectory": "/home", "maxhostname": "64", "maxusername": "64", "pac_type": [ "MS-PAC", "nfs:NONE" ], "pwdexpnotify": "4", "searchrecordslimit": "100", "searchtimelimit": "2", "selinuxusermapdefault": "unconfined_u:s0-s0:c0.c1023", "selinuxusermaporder": [ "guest_u:s0USDxguest_u:s0USDuser_ ], "usersearch": [ "uid", "givenname", "sn", "telephonenumber", "ou", "title" ] }, "failed": false } }
ipa config-show | grep 'CA renewal' IPA CA renewal master: server.idm.example.com
[ipaserver] server.idm.example.com
--- - name: Playbook to handle global DNS configuration hosts: ipaserver become: no gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: set ca_renewal_master_server ipaconfig: ipaadmin_password: "{{ ipaadmin_password }}" ca_renewal_master_server: carenewal.idm.example.com
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/config/set-ca-renewal-master-server.yml
ssh admin@server.idm.example.com Password: [admin@server /]USD
ipa config-show | grep 'CA renewal' IPA CA renewal master: carenewal.idm.example.com
[ipaserver] server.idm.example.com
--- - name: Playbook to ensure some config options are set hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: # Set defaultlogin and maxusername - ipaconfig: ipaadmin_password: "{{ ipaadmin_password }}" defaultshell: /bin/bash maxusername: 64
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/config/ensure-config-options-are-set.yml
ssh admin@server.idm.example.com Password: [admin@server /]USD
[admin@server /]USD echo "USDSHELL" /bin/sh
cd ~/ MyPlaybooks /
--- - name: Playbook to change IdM domain netbios name hosts: ipaserver become: no gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Set IdM domain netbios name ipaconfig: ipaadmin_password: "{{ ipaadmin_password }}" netbios_name: IPADOM
ansible-playbook --vault-password-file=password_file -v -i inventory netbios-domain-name-present.yml
cd ~/ MyPlaybooks /
--- - name: Playbook to ensure SIDs are enabled and users and groups have SIDs hosts: ipaserver become: no gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Enable SID and generate users and groups SIDS ipaconfig: ipaadmin_password: "{{ ipaadmin_password }}" enable_sid: true add_sids: true
ansible-playbook --vault-password-file=password_file -v -i inventory sids-for-users-and-groups-present.yml