Chapter 13. Using Ansible playbooks to manage RBAC privileges Role-based access control (RBAC) is a policy-neutral access-control mechanism defined around roles, privileges, and permissions. Especially in large companies, using RBAC can help create a hierarchical system of administrators with their individual areas of responsibility. This chapter describes the following operations for using Ansible playbooks to manage RBAC privileges in Identity Management (IdM): Using Ansible to ensure a custom RBAC privilege is present Using Ansible to ensure member permissions are present in a custom IdM RBAC privilege Using Ansible to ensure an IdM RBAC privilege does not include a permission Using Ansible to rename a custom IdM RBAC privilege Using Ansible to ensure an IdM RBAC privilege is absent Prerequisites You understand the concepts and principles of RBAC . 13.1. Using Ansible to ensure a custom IdM RBAC privilege is present To have a fully-functioning custom privilege in Identity Management (IdM) role-based access control (RBAC), you need to proceed in stages: Create a privilege with no permissions attached. Add permissions of your choice to the privilege. The following procedure describes how to create an empty privilege using an Ansible playbook so that you can later add permissions to it. The example describes how to create a privilege named full_host_administration that is meant to combine all IdM permissions related to host administration. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the privilege-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory: Open the privilege-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipaprivilege task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the new privilege, full_host_administration . Optionally, describe the privilege using the description variable. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 13.2. Using Ansible to ensure member permissions are present in a custom IdM RBAC privilege To have a fully-functioning custom privilege in Identity Management (IdM) role-based access control (RBAC), you need to proceed in stages: Create a privilege with no permissions attached. Add permissions of your choice to the privilege. The following procedure describes how to use an Ansible playbook to add permissions to a privilege created in the step. The example describes how to add all IdM permissions related to host administration to a privilege named full_host_administration . By default, the permissions are distributed between the Host Enrollment , Host Administrators and Host Group Administrator privileges. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The full_host_administration privilege exists. For information about how to create a privilege using Ansible, see Using Ansible to ensure a custom IdM RBAC privilege is present . Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the privilege-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory: Open the privilege-member-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipaprivilege task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the privilege. Set the permission list to the names of the permissions that you want to include in the privilege. Make sure that the action variable is set to member . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 13.3. Using Ansible to ensure an IdM RBAC privilege does not include a permission As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control. The following procedure describes how to use an Ansible playbook to remove a permission from a privilege. The example describes how to remove the Request Certificates ignoring CA ACLs permission from the default Certificate Administrators privilege because, for example, the administrator considers it a security risk. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the privilege-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory: Open the privilege-member-absent-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipaprivilege task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the privilege. Set the permission list to the names of the permissions that you want to remove from the privilege. Make sure that the action variable is set to member . Make sure that the state variable is set to absent . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 13.4. Using Ansible to rename a custom IdM RBAC privilege As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control. The following procedure describes how to rename a privilege because, for example, you have removed a few permissions from it. As a result, the name of the privilege is no longer accurate. In the example, the administrator renames a full_host_administration privilege to limited_host_administration . Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The full_host_administration privilege exists. For more information about how to add a privilege, see Using Ansible to ensure a custom IdM RBAC privilege is present . Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the privilege-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory: Open the rename-privilege.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipaprivilege task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the current name of the privilege. Add the rename variable and set it to the new name of the privilege. Add the state variable and set it to renamed . Rename the playbook itself, for example: Rename the task in the playbook, for example: This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 13.5. Using Ansible to ensure an IdM RBAC privilege is absent As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control. The following procedure describes how to use an Ansible playbook to ensure that an RBAC privilege is absent. The example describes how to ensure that the CA administrator privilege is absent. As a result of the procedure, the admin administrator becomes the only user capable of managing certificate authorities in IdM. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the privilege-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory: Open the privilege-absent-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipaprivilege task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the privilege you want to remove. Make sure that the state variable is set it to absent . Rename the task in the playbook, for example: This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 13.6. Additional resources See Privileges in IdM . See Permissions in IdM . See the README-privilege file available in the /usr/share/doc/ansible-freeipa/ directory. See the sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/ipaprivilege directory.

Commands:
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-present.yml privilege-present-copy.yml
--- - name: Privilege present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure privilege full_host_administration is present ipaprivilege: ipaadmin_password: "{{ ipaadmin_password }}" name: full_host_administration description: This privilege combines all IdM permissions related to host administration
ansible-playbook --vault-password-file=password_file -v -i inventory privilege-present-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-member-present.yml privilege-member-present-copy.yml
--- - name: Privilege member present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that permissions are present for the "full_host_administration" privilege ipaprivilege: ipaadmin_password: "{{ ipaadmin_password }}" name: full_host_administration permission: - "System: Add krbPrincipalName to a Host" - "System: Enroll a Host" - "System: Manage Host Certificates" - "System: Manage Host Enrollment Password" - "System: Manage Host Keytab" - "System: Manage Host Principals" - "Retrieve Certificates from the CA" - "Revoke Certificate" - "System: Add Hosts" - "System: Add krbPrincipalName to a Host" - "System: Enroll a Host" - "System: Manage Host Certificates" - "System: Manage Host Enrollment Password" - "System: Manage Host Keytab" - "System: Manage Host Keytab Permissions" - "System: Manage Host Principals" - "System: Manage Host SSH Public Keys" - "System: Manage Service Keytab" - "System: Manage Service Keytab Permissions" - "System: Modify Hosts" - "System: Remove Hosts" - "System: Add Hostgroups" - "System: Modify Hostgroup Membership" - "System: Modify Hostgroups" - "System: Remove Hostgroups"
ansible-playbook --vault-password-file=password_file -v -i inventory privilege-member-present-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-member-absent.yml privilege-member-absent-copy.yml
--- - name: Privilege absent example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "Request Certificate ignoring CA ACLs" permission is absent from the "Certificate Administrators" privilege ipaprivilege: ipaadmin_password: "{{ ipaadmin_password }}" name: Certificate Administrators permission: - "Request Certificate ignoring CA ACLs" action: member state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory privilege-member-absent-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-present.yml rename-privilege.yml
--- - name: Rename a privilege hosts: ipaserver
[...] tasks: - name: Ensure the full_host_administration privilege is renamed to limited_host_administration ipaprivilege: [...]
--- - name: Rename a privilege hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure the full_host_administration privilege is renamed to limited_host_administration ipaprivilege: ipaadmin_password: "{{ ipaadmin_password }}" name: full_host_administration rename: limited_host_administration state: renamed
ansible-playbook --vault-password-file=password_file -v -i inventory rename-privilege.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-absent.yml privilege-absent-copy.yml
[...] tasks: - name: Ensure privilege "CA administrator" is absent ipaprivilege: [...]
--- - name: Privilege absent example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure privilege "CA administrator" is absent ipaprivilege: ipaadmin_password: "{{ ipaadmin_password }}" name: CA administrator state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory privilege-absent-copy.yml