Chapter 19. Using Ansible to automate group membership in IdM Using automatic group membership, you can assign users and hosts user groups and host groups automatically, based on their attributes. For example, you can: Divide employees' user entries into groups based on the employees' manager, location, position or any other attribute. You can list all attributes by entering ipa user-add --help on the command-line. Divide hosts into groups based on their class, location, or any other attribute. You can list all attributes by entering ipa host-add --help on the command-line. Add all users or all hosts to a single global group. You can use Red Hat Ansible Engine to automate the management of automatic group membership in Identity Management (IdM). This section covers the following topics: Preparing your Ansible control node for managing IdM Using Ansible to ensure that an automember rule for an IdM user group is present Using Ansible to ensure that a condition is present in an IdM user group automember rule Using Ansible to ensure that a condition is absent in an IdM user group automember rule Using Ansible to ensure that an automember rule for an IdM group is absent Using Ansible to ensure that a condition is present in an IdM host group automember rule 19.1. Preparing your Ansible control node for managing IdM As a system administrator managing Identity Management (IdM), when working with Red Hat Ansible Engine, it is good practice to do the following: Create a subdirectory dedicated to Ansible playbooks in your home directory, for example ~/MyPlaybooks . Copy and adapt sample Ansible playbooks from the /usr/share/doc/ansible-freeipa/* and /usr/share/doc/rhel-system-roles/* directories and subdirectories into your ~/MyPlaybooks directory. Include your inventory file in your ~/MyPlaybooks directory. By following this practice, you can find all your playbooks in one place and you can run your playbooks without invoking root privileges. Note You only need root privileges on the managed nodes to execute the ipaserver , ipareplica , ipaclient , ipabackup , ipasmartcard_server and ipasmartcard_client ansible-freeipa roles. These roles require privileged access to directories and the dnf software package manager. Follow this procedure to create the ~/MyPlaybooks directory and configure it so that you can use it to store and run Ansible playbooks. Prerequisites You have installed an IdM server on your managed nodes, server.idm.example.com and replica.idm.example.com . You have configured DNS and networking so you can log in to the managed nodes, server.idm.example.com and replica.idm.example.com , directly from the control node. You know the IdM admin password. Procedure Create a directory for your Ansible configuration and playbooks in your home directory: Change into the ~/MyPlaybooks/ directory: Create the ~/MyPlaybooks/ansible.cfg file with the following content: Create the ~/MyPlaybooks/inventory file with the following content: This configuration defines two host groups, eu and us , for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups. Optional: Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key: Copy the SSH public key to the IdM admin account on each managed node: You must enter the IdM admin password when you enter these commands. Additional resources Installing an Identity Management server using an Ansible playbook How to build your inventory 19.2. Using Ansible to ensure that an automember rule for an IdM user group is present The following procedure describes how to use an Ansible playbook to ensure an automember rule for an Identity Management (IdM) group exists. In the example, the presence of an automember rule is ensured for the testing_group user group. Prerequisites You know the IdM admin password. The testing_group user group exists in IdM. You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the automember-group-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory: Open the automember-group-present-copy.yml file for editing. Adapt the file by setting the following variables in the ipaautomember task section: Set the ipaadmin_password variable to the password of the IdM admin . Set the name variable to testing_group . Set the automember_type variable to group . Ensure that the state variable is set to present . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources See Benefits of automatic group membership and Automember rules . See Using Ansible to ensure that a condition is present in an IdM user group automember rule . See the README-automember.md file in the /usr/share/doc/ansible-freeipa/ directory. See the /usr/share/doc/ansible-freeipa/playbooks/automember directory. 19.3. Using Ansible to ensure that a specified condition is present in an IdM user group automember rule The following procedure describes how to use an Ansible playbook to ensure that a specified condition exists in an automember rule for an Identity Management (IdM) group. In the example, the presence of a UID-related condition in the automember rule is ensured for the testing_group group. By specifying the .* condition, you ensure that all future IdM users automatically become members of the testing_group . Prerequisites You know the IdM admin password. The testing_group user group and automember user group rule exist in IdM. You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the automember-hostgroup-rule-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory and name it, for example, automember-usergroup-rule-present.yml : Open the automember-usergroup-rule-present.yml file for editing. Adapt the file by modifying the following parameters: Rename the playbook to correspond to your use case, for example: Automember user group rule member present . Rename the task to correspond to your use case, for example: Ensure an automember condition for a user group is present . Set the following variables in the ipaautomember task section: Set the ipaadmin_password variable to the password of the IdM admin . Set the name variable to testing_group . Set the automember_type variable to group . Ensure that the state variable is set to present . Ensure that the action variable is set to member . Set the inclusive key variable to UID . Set the inclusive expression variable to . * This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log in as an IdM administrator. Add a user, for example: Additional resources See Applying automember rules to existing entries using the IdM CLI . See Benefits of automatic group membership and Automember rules . See the README-automember.md file in the /usr/share/doc/ansible-freeipa/ directory. See the /usr/share/doc/ansible-freeipa/playbooks/automember directory. 19.4. Using Ansible to ensure that a condition is absent from an IdM user group automember rule The following procedure describes how to use an Ansible playbook to ensure a condition is absent from an automember rule for an Identity Management (IdM) group. In the example, the absence of a condition in the automember rule is ensured that specifies that users whose initials are dp should be included. The automember rule is applied to the testing_group group. By applying the condition, you ensure that no future IdM user whose initials are dp becomes a member of the testing_group . Prerequisites You know the IdM admin password. The testing_group user group and automember user group rule exist in IdM. You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the automember-hostgroup-rule-absent.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory and name it, for example, automember-usergroup-rule-absent.yml : Open the automember-usergroup-rule-absent.yml file for editing. Adapt the file by modifying the following parameters: Rename the playbook to correspond to your use case, for example: Automember user group rule member absent . Rename the task to correspond to your use case, for example: Ensure an automember condition for a user group is absent . Set the following variables in the ipaautomember task section: Set the ipaadmin_password variable to the password of the IdM admin . Set the name variable to testing_group . Set the automember_type variable to group . Ensure that the state variable is set to absent . Ensure that the action variable is set to member . Set the inclusive key variable to initials . Set the inclusive expression variable to dp . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log in as an IdM administrator. View the automember group: The absence of an Inclusive Regex: initials=dp entry in the output confirms that the testing_group automember rule does not contain the condition specified. Additional resources See Applying automember rules to existing entries using the IdM CLI . See Benefits of automatic group membership and Automember rules . See the README-automember.md file in the /usr/share/doc/ansible-freeipa/ directory. See the /usr/share/doc/ansible-freeipa/playbooks/automember directory. 19.5. Using Ansible to ensure that an automember rule for an IdM user group is absent The following procedure describes how to use an Ansible playbook to ensure an automember rule is absent for an Identity Management (IdM) group. In the example, the absence of an automember rule is ensured for the testing_group group. Note Deleting an automember rule also deletes all conditions associated with the rule. To remove only specific conditions from a rule, see Using Ansible to ensure that a condition is absent in an IdM user group automember rule . Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the automember-group-absent.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory: Open the automember-group-absent-copy.yml file for editing. Adapt the file by setting the following variables in the ipaautomember task section: Set the ipaadmin_password variable to the password of the IdM admin . Set the name variable to testing_group . Set the automember_type variable to group . Ensure that the state variable is set to absent . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources See Benefits of automatic group membership and Automember rules . See the README-automember.md file in the /usr/share/doc/ansible-freeipa/ directory. See the /usr/share/doc/ansible-freeipa/playbooks/automember directory. 19.6. Using Ansible to ensure that a condition is present in an IdM host group automember rule Follow this procedure to use Ansible to ensure that a condition is present in an IdM host group automember rule. The example describes how to ensure that hosts with the FQDN of .*.idm.example.com are members of the primary_dns_domain_hosts host group and hosts whose FQDN is .*.example.org are not members of the primary_dns_domain_hosts host group. Prerequisites You know the IdM admin password. The primary_dns_domain_hosts host group and automember host group rule exist in IdM. You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the automember-hostgroup-rule-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory: Open the automember-hostgroup-rule-present-copy.yml file for editing. Adapt the file by setting the following variables in the ipaautomember task section: Set the ipaadmin_password variable to the password of the IdM admin . Set the name variable to primary_dns_domain_hosts . Set the automember_type variable to hostgroup . Ensure that the state variable is set to present . Ensure that the action variable is set to member . Ensure that the inclusive key variable is set to fqdn . Set the corresponding inclusive expression variable to .*.idm.example.com . Set the exclusive key variable to fqdn . Set the corresponding exclusive expression variable to .*.example.org . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources See Applying automember rules to existing entries using the IdM CLI . See Benefits of automatic group membership and Automember rules . See the README-automember.md file in the /usr/share/doc/ansible-freeipa/ directory. See the /usr/share/doc/ansible-freeipa/playbooks/automember directory. 19.7. Additional resources Managing user accounts using Ansible playbooks Managing hosts using Ansible playbooks Managing user groups using Ansible playbooks Managing host groups using the IdM CLI

Commands:
mkdir ~/MyPlaybooks/
cd ~/MyPlaybooks
[defaults] inventory = /home/ your_username /MyPlaybooks/inventory [privilege_escalation] become=True
[ipaserver] server.idm.example.com [ipareplicas] replica1.idm.example.com replica2.idm.example.com [ipacluster:children] ipaserver ipareplicas [ipacluster:vars] ipaadmin_password=SomeADMINpassword [ipaclients] ipaclient1.example.com ipaclient2.example.com [ipaclients:vars] ipaadmin_password=SomeADMINpassword
ssh-keygen
ssh-copy-id admin@server.idm.example.com ssh-copy-id admin@replica.idm.example.com
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-group-present.yml automember-group-present-copy.yml
--- - name: Automember group present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure group automember rule admins is present ipaautomember: ipaadmin_password: "{{ ipaadmin_password }}" name: testing_group automember_type: group state: present
ansible-playbook --vault-password-file=password_file -v -i inventory automember-group-present-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-hostgroup-rule-present.yml automember-usergroup-rule-present.yml
--- - name: Automember user group rule member present hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure an automember condition for a user group is present ipaautomember: ipaadmin_password: "{{ ipaadmin_password }}" name: testing_group automember_type: group state: present action: member inclusive: - key: UID expression: . *
ansible-playbook --vault-password-file=password_file -v -i inventory automember-usergroup-rule-present.yml
kinit admin
ipa user-add user101 --first user --last 101 ----------------------- Added user "user101" ----------------------- User login: user101 First name: user Last name: 101 Member of groups: ipausers, testing_group
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-hostgroup-rule-absent.yml automember-usergroup-rule-absent.yml
--- - name: Automember user group rule member absent hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure an automember condition for a user group is absent ipaautomember: ipaadmin_password: "{{ ipaadmin_password }}" name: testing_group automember_type: group state: absent action: member inclusive: - key: initials expression: dp
ansible-playbook --vault-password-file=password_file -v -i inventory automember-usergroup-rule-absent.yml
kinit admin
ipa automember-show --type=group testing_group Automember Rule: testing_group
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-group-absent.yml automember-group-absent-copy.yml
--- - name: Automember group absent example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure group automember rule admins is absent ipaautomember: ipaadmin_password: "{{ ipaadmin_password }}" name: testing_group automember_type: group state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory automember-group-absent.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-hostgroup-rule-present.yml automember-hostgroup-rule-present-copy.yml
--- - name: Automember user group rule member present hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure an automember condition for a user group is present ipaautomember: ipaadmin_password: "{{ ipaadmin_password }}" name: primary_dns_domain_hosts automember_type: hostgroup state: present action: member inclusive: - key: fqdn expression: .*.idm.example.com exclusive: - key: fqdn expression: .*.example.org
ansible-playbook --vault-password-file=password_file -v -i inventory automember-hostgroup-rule-present-copy.yml