Chapter 5. Preparing your environment for managing IdM using Ansible playbooks As a system administrator managing Identity Management (IdM), when working with Red Hat Ansible Engine, it is good practice to do the following: Keep a subdirectory dedicated to Ansible playbooks in your home directory, for example ~/MyPlaybooks . Copy and adapt sample Ansible playbooks from the /usr/share/doc/ansible-freeipa/* and /usr/share/doc/rhel-system-roles/* directories and subdirectories into your ~/MyPlaybooks directory. Include your inventory file in your ~/MyPlaybooks directory. Using this practice, you can find all your playbooks in one place. Note You can run your ansible-freeipa playbooks without invoking root privileges on the managed nodes. Exceptions include playbooks that use the ipaserver , ipareplica , ipaclient , ipasmartcard_server , ipasmartcard_client and ipabackup ansible-freeipa roles. These roles require privileged access to directories and the dnf software package manager. The playbooks in the Red Hat Enterprise Linux IdM documentation assume the following security configuration : The IdM admin is your remote Ansible user on the managed nodes. You store the IdM admin password encrypted in an Ansible vault. You have placed the password that protects the Ansible vault in a password file. You block access to the vault password file to everyone except your local ansible user. You regularly remove and re-create the vault password file. Consider also alternative security configurations . 5.1. Preparing a control node and managed nodes for managing IdM using Ansible playbooks Follow this procedure to create the ~/MyPlaybooks directory and configure it so that you can use it to store and run Ansible playbooks. Prerequisites You have installed an IdM server on your managed nodes, server.idm.example.com and replica.idm.example.com . You have configured DNS and networking so you can log in to the managed nodes, server.idm.example.com and replica.idm.example.com , directly from the control node. You know the IdM admin password. Procedure Change into the ~/MyPlaybooks/ directory: Create the ~/MyPlaybooks/ansible.cfg file with the following content: Create the ~/MyPlaybooks/inventory file with the following content: This configuration defines two host groups, eu and us , for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups. Optional: Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key: Copy the SSH public key to the IdM admin account on each managed node: These commands require that you enter the IdM admin password. Create a password_file file that contains the vault password: Change the permissions to modify the file: Create a secret.yml Ansible vault to store the IdM admin password: Configure password_file to store the vault password: When prompted, enter the content of the secret.yml file: Note To use the encrypted ipaadmin_password in a playbook, you must use the vars_file directive. For example, a simple playbook to delete an IdM user can look as follows: When executing a playbook, instruct Ansible use the vault password to decrypt ipaadmin_password by adding the --vault-password-file= password_file option. For example: Warning For security reasons, remove the vault password file at the end of each session, and repeat steps 6-8 at the start of each new session. Additional resources Different methods to provide the credentials required for ansible-freeipa playbooks Installing an Identity Management server using an Ansible playbook How to build your inventory 5.2. Different methods to provide the credentials required for ansible-freeipa playbooks There are advantages and disadvantages in the different methods for providing the credentials required for running playbooks that use ansible-freeipa roles and modules. Storing passwords in plain text in a playbook Benefits : Not being prompted all the time you run the playbook. Easy to implement. Drawbacks : Everyone with access to the file can read the password. Setting wrong permissions and sharing the file, for example in an internal or external repository, can compromise security. High maintenance work: if the password is changed, it needs to be changed in all playbooks. Entering passwords interactively when you execute a playbook Benefits : No-one can steal the password as it is not stored anywhere. You can update the password easily. Easy to implement. Drawbacks : If you are using Ansible playbooks in scripts, the requirement to enter the password interactively can be inconvenient. Storing passwords in an Ansible vault and the vault password in a file: Benefits : The user password is stored encrypted. You can update the user password easily, by creating a new Ansible vault. You can update the password file that protects the ansible vault easily, by using the ansible-vault rekey --new-vault-password-file=NEW_VAULT_PASSWORD_FILE secret.yml command. If you are using Ansible playbooks in scripts, it is convenient not to have to enter the password protecting the Ansible vault interactively. Drawbacks : It is vital that the file that contains the sensitive plain text password be protected through file permissions and other security measures. Storing passwords in an Ansible vault and entering the vault password interactively Benefits : The user password is stored encrypted. No-one can steal the vault password as it is not stored anywhere. You can update the user password easily, by creating a new Ansible vault. You can update the vault password easily too, by using the ansible-vault rekey file_name command. Drawbacks : If you are using Ansible playbooks in scripts, the need to enter the vault password interactively can be inconvenient. Additional resources Preparing a control node and managed nodes for managing IdM using Ansible playbooks What is Zero trust? Protecting sensitive data with Ansible vault

Commands:
cd ~/MyPlaybooks
[defaults] inventory = /home/ your_username /MyPlaybooks/inventory remote_user = admin
[eu] server.idm.example.com [us] replica.idm.example.com [ipaserver:children] eu us
ssh-keygen
ssh-copy-id admin@server.idm.example.com ssh-copy-id admin@replica.idm.example.com
redhat
chmod 0600 password_file
ansible-vault create --vault-password-file=password_file secret.yml
ipaadmin_password: Secret123
--- - name: Playbook to handle users hosts: ipaserver vars_files: - /home/ user_name /MyPlaybooks/secret.yml tasks: - name: Delete user robot ipauser: ipaadmin_password: "{{ ipaadmin_password }}" name: robot state: absent
ansible-playbook -i inventory --vault-password-file=password_file del-user.yml