Chapter 33. Using Ansible to integrate IdM with NIS domains and netgroups 33.1. NIS and its benefits In UNIX environments, the network information service (NIS) is a common way to centrally manage identities and authentication. NIS, which was originally named Yellow Pages (YP), centrally manages authentication and identity information such as: Users and passwords Host names and IP addresses POSIX groups For modern network infrastructures, NIS is considered too insecure because, for example, it neither provides host authentication, nor is data sent encrypted over the network. To work around the problems, NIS is often integrated with other protocols to enhance security. If you use Identity Management (IdM), you can use the NIS server plug-in to connect clients that cannot be fully migrated to IdM. IdM integrates netgroups and other NIS data into the IdM domain. Additionally, you can easily migrate user and host identities from a NIS domain to IdM. Netgroups can be used everywhere that NIS groups are expected. Additional resources NIS in IdM NIS netgroups in IdM Migrating from NIS to Identity Management 33.2. NIS in IdM NIS objects in IdM NIS objects are integrated and stored in the Directory Server back end in compliance with RFC 2307 . IdM creates NIS objects in the LDAP directory and clients retrieve them through, for example, System Security Services Daemon (SSSD) or nss_ldap using an encrypted LDAP connection. IdM manages netgroups, accounts, groups, hosts, and other data. IdM uses a NIS listener to map passwords, groups, and netgroups to IdM entries. NIS Plug-ins in IdM For NIS support, IdM uses the following plug-ins provided in the slapi-nis package: NIS Server Plug-in The NIS Server plug-in enables the IdM-integrated LDAP server to act as a NIS server for clients. In this role, Directory Server dynamically generates and updates NIS maps according to the configuration. Using the plug-in, IdM serves clients using the NIS protocol as an NIS server. Schema Compatibility Plug-in The Schema Compatibility plug-in enables the Directory Server back end to provide an alternate view of entries stored in part of the directory information tree (DIT). This includes adding, dropping, or renaming attribute values, and optionally retrieving values for attributes from multiple entries in the tree. For further details, see the /usr/share/doc/slapi-nis- version /sch-getting-started.txt file. 33.3. NIS netgroups in IdM NIS entities can be stored in netgroups. Compared to UNIX groups, netgroups provide support for: Nested groups (groups as members of other groups). Grouping hosts. A netgroup defines a set of the following information: host, user, and domain. This set is called a triple . These three fields can contain: A value. A dash ( - ), which specifies "no valid value" No value. An empty field specifies a wildcard. When a client requests a NIS netgroup, IdM translates the LDAP entry : To a traditional NIS map and sends it to the client over the NIS protocol by using the NIS plug-in. To an LDAP format that is compliant with RFC 2307 or RFC 2307bis. 33.4. Using Ansible to ensure that a netgroup is present You can use an Ansible playbook to ensure that an IdM netgroup is present. The example describes how to ensure that the TestNetgroup1 group is present. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package on the Ansible controller. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. Procedure Create your Ansible playbook file netgroup-present.yml with the following content: Run the playbook: Additional resources NIS in IdM /usr/share/doc/ansible-freeipa/README-netgroup.md /usr/share/doc/ansible-freeipa/playbooks/netgroup 33.5. Using Ansible to ensure that members are present in a netgroup You can use an Ansible playbook to ensure that IdM users, groups, and netgroups are members of a netgroup. The example describes how to ensure that the TestNetgroup1 group has the following members: The user1 and user2 IdM users The group1 IdM group The admins netgroup An idmclient1 host that is an IdM client Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package on the Ansible controller. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. The TestNetgroup1 IdM netgroup exists. The user1 and user2 IdM users exist. The group1 IdM group exists. The admins IdM netgroup exists. Procedure Create your Ansible playbook file IdM-members-present-in-a-netgroup.yml with the following content: Run the playbook: Additional resources NIS in IdM /usr/share/doc/ansible-freeipa/README-netgroup.md /usr/share/doc/ansible-freeipa/playbooks/netgroup 33.6. Using Ansible to ensure that a member is absent from a netgroup You can use an Ansible playbook to ensure that IdM users are members of a netgroup. The example describes how to ensure that the TestNetgroup1 group does not have the user1 IdM user among its members. netgroup Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package on the Ansible controller. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. The TestNetgroup1 netgroup exists. Procedure Create your Ansible playbook file IdM-member-absent-from-a-netgroup.yml with the following content: Run the playbook: Additional resources NIS in IdM /usr/share/doc/ansible-freeipa/README-netgroup.md /usr/share/doc/ansible-freeipa/playbooks/netgroup 33.7. Using Ansible to ensure that a netgroup is absent You can use an Ansible playbook to ensure that a netgroup does not exist in Identity Management (IdM). The example describes how to ensure that the TestNetgroup1 group does not exist in your IdM domain. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package on the Ansible controller. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You have stored your ipaadmin_password in the secret.yml Ansible vault. Procedure Create your Ansible playbook file netgroup-absent.yml with the following content: Run the playbook: Additional resources NIS in IdM /usr/share/doc/ansible-freeipa/README-netgroup.md /usr/share/doc/ansible-freeipa/playbooks/netgroup

Commands:
( host.example.com ,, nisdomain.example.com ) (-, user , nisdomain.example.com )
--- - name: Playbook to manage IPA netgroup. hosts: ipaserver become: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure netgroup members are present ipanetgroup: ipaadmin_password: "{{ ipaadmin_password }}" name: TestNetgroup1
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory_/netgroup-present.yml
--- - name: Playbook to manage IPA netgroup. hosts: ipaserver become: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure netgroup members are present ipanetgroup: ipaadmin_password: "{{ ipaadmin_password }}" name: TestNetgroup1 user: user1,user2 group: group1 host: idmclient1 netgroup: admins action: member
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory_/IdM-members-present-in-a-netgroup.yml
--- - name: Playbook to manage IPA netgroup. hosts: ipaserver become: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure netgroup user, "user1", is absent ipanetgroup: ipaadmin_password: "{{ ipaadmin_password }}" name: TestNetgroup1 user: "user1" action: member state: absent
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory_/IdM-member-absent-from-a-netgroup.yml
--- - name: Playbook to manage IPA netgroup. hosts: ipaserver become: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure netgroup my_netgroup1 is absent ipanetgroup: ipaadmin_password: "{{ ipaadmin_password }}" name: my_netgroup1 state: absent
ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory_/netgroup-absent.yml