Chapter 5. Preparing your environment for managing IdM using Ansible playbooks As a system administrator managing Identity Management (IdM), when working with Red Hat Ansible Engine, it is good practice to do the following: Keep a subdirectory dedicated to Ansible playbooks in your home directory, for example ~/MyPlaybooks . Copy and adapt sample Ansible playbooks from the /usr/share/doc/ansible-freeipa/* and /usr/share/doc/rhel-system-roles/* directories and subdirectories into your ~/MyPlaybooks directory. Include your inventory file in your ~/MyPlaybooks directory. Using this practice, you can find all your playbooks in one place. Note You can run your ansible-freeipa playbooks without invoking root privileges on the managed nodes. Exceptions include playbooks that use the ipaserver , ipareplica , ipaclient , ipasmartcard_server , ipasmartcard_client and ipabackup ansible-freeipa roles. These roles require privileged access to directories and the dnf software package manager. The playbooks in the Red Hat Enterprise Linux IdM documentation assume the following security configuration : The IdM admin is your remote Ansible user on the managed nodes. You store the IdM admin password encrypted in an Ansible vault. You have placed the password that protects the Ansible vault in a password file. You block access to the vault password file to everyone except your local ansible user. You regularly remove and re-create the vault password file. Consider also alternative security configurations . 5.1. Preparing a control node and managed nodes for managing IdM using Ansible playbooks Follow this procedure to create the ~/MyPlaybooks directory and configure it so that you can use it to store and run Ansible playbooks. Prerequisites You have installed an IdM server on your managed nodes, server.idm.example.com and replica.idm.example.com . You have configured DNS and networking so you can log in to the managed nodes, server.idm.example.com and replica.idm.example.com , directly from the control node. You know the IdM admin password. Procedure Change into the ~/MyPlaybooks/ directory: Create the ~/MyPlaybooks/ansible.cfg file with the following content: Create the ~/MyPlaybooks/inventory file with the following content: This configuration defines two host groups, eu and us , for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups. Optional: Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key: Copy the SSH public key to the IdM admin account on each managed node: These commands require that you enter the IdM admin password. Create a password_file file that contains the vault password: Change the permissions to modify the file: Create a secret.yml Ansible vault to store the IdM admin password: Configure password_file to store the vault password: When prompted, enter the content of the secret.yml file: Note To use the encrypted ipaadmin_password in a playbook, you must use the vars_file directive. For example, a simple playbook to delete an IdM user can look as follows: When executing a playbook, instruct Ansible use the vault password to decrypt ipaadmin_password by adding the --vault-password-file= password_file option. For example: Warning For security reasons, remove the vault password file at the end of each session, and repeat steps 6-8 at the start of each new session. Additional resources Different methods to provide the credentials required for ansible-freeipa playbooks Installing an Identity Management server using an Ansible playbook How to build your inventory 5.2. Different methods to provide the credentials required for ansible-freeipa playbooks There are advantages and disadvantages in the different methods for providing the credentials required for running playbooks that use ansible-freeipa roles and modules. Storing passwords in plain text in a playbook Benefits : Not being prompted all the time you run the playbook. Easy to implement. Drawbacks : Everyone with access to the file can read the password. Setting wrong permissions and sharing the file, for example in an internal or external repository, can compromise security. High maintenance work: if the password is changed, it needs to be changed in all playbooks. Entering passwords interactively when you execute a playbook Benefits : No-one can steal the password as it is not stored anywhere. You can update the password easily. Easy to implement. Drawbacks : If you are using Ansible playbooks in scripts, the requirement to enter the password interactively can be inconvenient. Storing passwords in an Ansible vault and the vault password in a file: Benefits : The user password is stored encrypted. You can update the user password easily, by creating a new Ansible vault. You can update the password file that protects the ansible vault easily, by using the ansible-vault rekey --new-vault-password-file=NEW_VAULT_PASSWORD_FILE secret.yml command. If you are using Ansible playbooks in scripts, it is convenient not to have to enter the password protecting the Ansible vault interactively. Drawbacks : It is vital that the file that contains the sensitive plain text password be protected through file permissions and other security measures. Storing passwords in an Ansible vault and entering the vault password interactively Benefits : The user password is stored encrypted. No-one can steal the vault password as it is not stored anywhere. You can update the user password easily, by creating a new Ansible vault. You can update the vault password easily too, by using the ansible-vault rekey file_name command. Drawbacks : If you are using Ansible playbooks in scripts, the need to enter the vault password interactively can be inconvenient. Additional resources Preparing a control node and managed nodes for managing IdM using Ansible playbooks What is Zero trust? Protecting sensitive data with Ansible vault 5.3. The inventory plugin in ansible-freeipa You can use the ansible-freeipa freeipa inventory plugin to create dynamic inventories of Identity Management (IdM) servers to be used in ansible-freeipa playbooks. The plugin gathers data about the IdM servers in the domain, and selects only those that have a specified IdM server role or roles assigned. To use the plugin with the ansible-playbook command, set the value of the -i option to the inventory file that uses the freeipa plugin. As a result, the plays in the playbook are executed only against those servers that have the roles specified in the inventory file. The example below describes how to use the freeipa plugin to determine the versions of the bind package on the IdM servers in the topology that have the DNS role. Procedure Create a file, for example inventory.yml , to generate a dynamic inventory based on your selected IdM server role or roles. For example, to create an inventory of servers that have the IdM DNS server role: server defines the fully-qualified domain name of the host to start the scan. verify defines the server TLS certificate file for verification. role defines all the server roles that a host must have for the host to be returned. Create a playbook, for example bind-playbook.yml , that you want to execute against the IdM servers identified by the freeipa inventory plugin. For example, to determine the release version of the bind package installed on the IdM DNS servers: [Optional] Create a graph representation of the IdM servers identified by the plugin: Run the Ansible playbook. Specify the inventory.yml file as inventory:

Commands:
cd ~/MyPlaybooks
[defaults] inventory = /home/ your_username /MyPlaybooks/inventory remote_user = admin
[eu] server.idm.example.com [us] replica.idm.example.com [ipaserver:children] eu us
ssh-keygen
ssh-copy-id admin@server.idm.example.com ssh-copy-id admin@replica.idm.example.com
redhat
chmod 0600 password_file
ansible-vault create --vault-password-file=password_file secret.yml
ipaadmin_password: Secret123
--- - name: Playbook to handle users hosts: ipaserver vars_files: - /home/ user_name /MyPlaybooks/secret.yml tasks: - name: Delete user robot ipauser: ipaadmin_password: "{{ ipaadmin_password }}" name: robot state: absent
ansible-playbook -i inventory --vault-password-file=password_file del-user.yml
--- plugin: freeipa server: server.idm.example.com ipaadmin_password: Secret123 verify: ca.crt role: DNS server
--- - name: Check bind version hosts: ipaservers tasks: - name: Query bind package version package: name: bind state: present register: bind_version - name: Display bind release info debug: msg: "Bind release: {{ bind_version.results[0].version }}"
ansible-inventory -i inventory.yml --graph @all: |--@ungrouped |--@ipaservers: | |--replica01.idm.example.com
ansible-playbook -i inventory.yml bind-playbook.yml [...] TASK [Display bind release info] ok: [10.0.193.174] => { "msg": "Bind release: 9.20.3" } [...]