Chapter 30. Using Ansible playbooks to manage role-based access control in IdM Role-based access control (RBAC) is a policy-neutral access-control mechanism defined around roles and privileges. The components of RBAC in Identity Management (IdM) are roles, privileges and permissions: Permissions grant the right to perform a specific task such as adding or deleting users, modifying a group, and enabling read-access. Privileges combine permissions, for example all the permissions needed to add a new user. Roles grant a set of privileges to users, user groups, hosts or host groups. Especially in large companies, using RBAC can help create a hierarchical system of administrators with their individual areas of responsibility. This chapter describes the following operations performed when managing RBAC using Ansible playbooks: Permissions in IdM Default managed permissions Privileges in IdM Roles in IdM Predefined roles in IdM Using Ansible to ensure an IdM RBAC role with privileges is present Using Ansible to ensure an IdM RBAC role is absent Using Ansible to ensure that a group of users is assigned to an IdM RBAC role Using Ansible to ensure that specific users are not assigned to an IdM RBAC role Using Ansible to ensure a service is a member of an IdM RBAC role Using Ansible to ensure a host is a member of an IdM RBAC role Using Ansible to ensure a host group is a member of an IdM RBAC role 30.1. Permissions in IdM Permissions are the lowest level unit of role-based access control, they define operations together with the LDAP entries to which those operations apply. Comparable to building blocks, permissions can be assigned to as many privileges as needed. One or more rights define what operations are allowed: write read search compare add delete all These operations apply to three basic targets : subtree : a domain name (DN); the subtree under this DN target filter : an LDAP filter target : DN with possible wildcards to specify entries Additionally, the following convenience options set the corresponding attribute(s): type : a type of object (user, group, etc); sets subtree and target filter memberof : members of a group; sets a target filter Note Setting the memberof attribute permission is not applied if the target LDAP entry does not contain any reference to group membership. targetgroup : grants access to modify a specific group (such as granting the rights to manage group membership); sets a target With IdM permissions, you can control which users have access to which objects and even which attributes of these objects. IdM enables you to allow or block individual attributes or change the entire visibility of a specific IdM function, such as users, groups, or sudo, to all anonymous users, all authenticated users, or just a certain group of privileged users. For example, the flexibility of this approach to permissions is useful for an administrator who wants to limit access of users or groups only to the specific sections these users or groups need to access and to make the other sections completely hidden to them. Note A permission cannot contain other permissions. 30.2. Default managed permissions Managed permissions are permissions that come by default with IdM. They behave like other permissions created by the user, with the following differences: You cannot delete them or modify their name, location, and target attributes. They have three sets of attributes: Default attributes, the user cannot modify them, as they are managed by IdM Included attributes, which are additional attributes added by the user Excluded attributes, which are attributes removed by the user A managed permission applies to all attributes that appear in the default and included attribute sets but not in the excluded set. Note While you cannot delete a managed permission, setting its bind type to permission and removing the managed permission from all privileges effectively disables it. Names of all managed permissions start with System: , for example System: Add Sudo rule or System: Modify Services . Earlier versions of IdM used a different scheme for default permissions. For example, the user could not delete them and was only able to assign them to privileges. Most of these default permissions have been turned into managed permissions, however, the following permissions still use the scheme: Add Automember Rebuild Membership Task Add Configuration Sub-Entries Add Replication Agreements Certificate Remove Hold Get Certificates status from the CA Read DNA Range Modify DNA Range Read PassSync Managers Configuration Modify PassSync Managers Configuration Read Replication Agreements Modify Replication Agreements Remove Replication Agreements Read LDBM Database Configuration Request Certificate Request Certificate ignoring CA ACLs Request Certificates from a different host Retrieve Certificates from the CA Revoke Certificate Write IPA Configuration Note If you attempt to modify a managed permission from the command line, the system does not allow you to change the attributes that you cannot modify, the command fails. If you attempt to modify a managed permission from the Web UI, the attributes that you cannot modify are disabled. 30.3. Privileges in IdM A privilege is a group of permissions applicable to a role. While a permission provides the rights to do a single operation, there are certain IdM tasks that require multiple permissions to succeed. Therefore, a privilege combines the different permissions required to perform a specific task. For example, setting up an account for a new IdM user requires the following permissions: Creating a new user entry Resetting a user password Adding the new user to the default IPA users group Combining these three low-level tasks into a higher level task in the form of a custom privilege named, for example, Add User makes it easier for a system administrator to manage roles. IdM already contains several default privileges. Apart from users and user groups, privileges are also assigned to hosts and host groups, as well as network services. This practice permits a fine-grained control of operations by a set of users on a set of hosts using specific network services. Note A privilege may not contain other privileges. 30.4. Roles in IdM A role is a list of privileges that users specified for the role possess. In effect, permissions grant the ability to perform given low-level tasks (such as creating a user entry and adding an entry to a group), privileges combine one or more of these permissions needed for a higher-level task (such as creating a new user in a given group). Roles gather privileges together as needed: for example, a User Administrator role would be able to add, modify, and delete users. Important Roles are used to classify permitted actions. They are not used as a tool to implement privilege separation or to protect from privilege escalation. Note Roles can not contain other roles. 30.5. Predefined roles in Identity Management Red Hat Identity Management provides the following range of pre-defined roles: Table 30.1. Predefined Roles in Identity Management Role Privilege Description Enrollment Administrator Host Enrollment Responsible for client, or host, enrollment helpdesk Modify Users and Reset passwords, Modify Group membership Responsible for performing simple user administration tasks IT Security Specialist Netgroups Administrators, HBAC Administrator, Sudo Administrator Responsible for managing security policy such as host-based access controls, sudo rules IT Specialist Host Administrators, Host Group Administrators, Service Administrators, Automount Administrators Responsible for managing hosts Security Architect Delegation Administrator, Replication Administrators, Write IPA Configuration, Password Policy Administrator Responsible for managing the Identity Management environment, creating trusts, creating replication agreements User Administrator User Administrators, Group Administrators, Stage User Administrators Responsible for creating users and groups 30.6. Using Ansible to ensure an IdM RBAC role with privileges is present To exercise more granular control over role-based access (RBAC) to resources in Identity Management (IdM) than the default roles provide, create a custom role. The following procedure describes how to use an Ansible playbook to define privileges for a new IdM custom role and ensure its presence. In the example, the new user_and_host_administrator role contains a unique combination of the following privileges that are present in IdM by default: Group Administrators User Administrators Stage User Administrators Group Administrators Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-member-user-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-member-user-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the new role. Set the privilege list to the names of the IdM privileges that you want to include in the new role. Optionally, set the user variable to the name of the user to whom you want to grant the new role. Optionally, set the group variable to the name of the group to which you want to grant the new role. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role file in the /usr/share/doc/ansible-freeipa/ directory Sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory 30.7. Using Ansible to ensure an IdM RBAC role is absent As a system administrator managing role-based access control (RBAC) in Identity Management (IdM), you may want to ensure the absence of an obsolete role so that no administrator assigns it to any user accidentally. The following procedure describes how to use an Ansible playbook to ensure a role is absent. The example below describes how to make sure the custom user_and_host_administrator role does not exist in IdM. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-is-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-is-absent-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the role. Ensure that the state variable is set to absent . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role Markdown file in the /usr/share/doc/ansible-freeipa/ directory Sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory 30.8. Using Ansible to ensure that a group of users is assigned to an IdM RBAC role As a system administrator managing role-based access control (RBAC) in Identity Management (IdM), you may want to assign a role to a specific group of users, for example junior administrators. The following example describes how to use an Ansible playbook to ensure the built-in IdM RBAC helpdesk role is assigned to junior_sysadmins . Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-member-group-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-member-group-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the role you want to assign. Set the group variable to the name of the group. Set the action variable to member . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role Markdown file in the /usr/share/doc/ansible-freeipa/ directory Sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory 30.9. Using Ansible to ensure that specific users are not assigned to an IdM RBAC role As a system administrator managing role-based access control (RBAC) in Identity Management (IdM), you may want to ensure that an RBAC role is not assigned to specific users after they have, for example, moved to different positions within the company. The following procedure describes how to use an Ansible playbook to ensure that the users named user_01 and user_02 are not assigned to the helpdesk role. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-member-user-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-member-user-absent-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the role you want to assign. Set the user list to the names of the users. Set the action variable to member . Set the state variable to absent . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role Markdown file in the /usr/share/doc/ansible-freeipa/ directory Sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory 30.10. Using Ansible to ensure a service is a member of an IdM RBAC role As a system administrator managing role-based access control (RBAC) in Identity Management (IdM), you may want to ensure that a specific service that is enrolled into IdM is a member of a particular role. The following example describes how to ensure that the custom web_administrator role can manage the HTTP service that is running on the client01.idm.example.com server. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The web_administrator role exists in IdM. The HTTP/client01.idm.example.com@IDM.EXAMPLE.COM service exists in IdM. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-member-service-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-member-service-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the role you want to assign. Set the service list to the name of the service. Set the action variable to member . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role Markdown file in the /usr/share/doc/ansible-freeipa/ directory The sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory 30.11. Using Ansible to ensure a host is a member of an IdM RBAC role As a system administrator managing role-based access control in Identity Management (IdM), you may want to ensure that a specific host or host group is associated with a specific role. The following example describes how to ensure that the custom web_administrator role can manage the client01.idm.example.com IdM host on which the HTTP service is running. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The web_administrator role exists in IdM. The client01.idm.example.com host exists in IdM. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-member-host-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-member-host-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the role you want to assign. Set the host list to the name of the host. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role Markdown file in the /usr/share/doc/ansible-freeipa/ directory Sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory 30.12. Using Ansible to ensure a host group is a member of an IdM RBAC role As a system administrator managing role-based access control in Identity Management (IdM), you may want to ensure that a specific host or host group is associated with a specific role. The following example describes how to ensure that the custom web_administrator role can manage the web_servers group of IdM hosts on which the HTTP service is running. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The web_administrator role exists in IdM. The web_servers host group exists in IdM. Procedure Navigate to the ~/ <MyPlaybooks> / directory: Make a copy of the role-member-hostgroup-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory: Open the role-member-hostgroup-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the iparole task section: Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the role you want to assign. Set the hostgroup list to the name of the hostgroup. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Encrypting content with Ansible Vault Roles in IdM The README-role Markdown file in the /usr/share/doc/ansible-freeipa/ directory The sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/iparole directory

Commands:
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-user-present.yml role-member-user-present-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: user_and_host_administrator user: idm_user01 group: idm_group01 privilege: - Group Administrators - User Administrators - Stage User Administrators - Group Administrators
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-member-user-present-copy.yml
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-is-absent.yml role-is-absent-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: user_and_host_administrator state: absent
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-is-absent-copy.yml
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-group-present.yml role-member-group-present-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: helpdesk group: junior_sysadmins action: member
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-member-group-present-copy.yml
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-user-absent.yml role-member-user-absent-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: helpdesk user - user_01 - user_02 action: member state: absent
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-member-user-absent-copy.yml
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-service-present-absent.yml role-member-service-present-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: web_administrator service: - HTTP/client01.idm.example.com action: member
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-member-service-present-copy.yml
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-host-present.yml role-member-host-present-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: web_administrator host: - client01.idm.example.com action: member
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-member-host-present-copy.yml
cd ~/ <MyPlaybooks> /
cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-hostgroup-present.yml role-member-hostgroup-present-copy.yml
--- - name: Playbook to manage IPA role with members. hosts: ipaserver become: true gather_facts: no vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - iparole: ipaadmin_password: "{{ ipaadmin_password }}" name: web_administrator hostgroup: - web_servers action: member
ansible-playbook --vault-password-file=password_file -v -i ~/ <MyPlaybooks> /inventory role-member-hostgroup-present-copy.yml