for what it’s worth, you can use ansible’s ldap module with GSSAPI if you make a one-line
patch. In this case we’re only concerned with issuing the ldap command locally. Ansible
defaults SASL to using external rather than GSSAPI. You’d think they’d make it an option,
but it’s hardcoded. I was unable to find a way to override it.
It’s more complex than you’re expect because I’m worried that ansible might choose a
different version of python than the default, so I’m trying to figure out the location of
the file that it’s actually using.
- name: Find correct ldap module to patch
local_action: command "{{ ansible_playbook_python }}" -c "import
ansible.module_utils.ldap; print(ansible.module_utils.ldap.__file__)"
register: ldapfile
- debug:
var: ldapfile
- name: patch ldap.py
become: true
local_action: replace path="{{ ldapfile.stdout }}"
regexp="ldap\.sasl\.external" replace="ldap.sasl.gssapi"
On Mar 18, 2020, at 11:05:15 AM, Kimmo Rantala via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
There was a question from Angus that he did not CC here but I think he kind of asked what
I/we are trying to do and told that Foreman is a bit like ansible.
I thought it would be fair to tell what is the goal here.
We are enrolling clients and we set the userclass attribute to a certain value to then
assign the host to host groups with automember rules. This host group is for the
environment, customer etc. so the correct users get the correct privileges to the hosts.
We have the ansible playbooks in bitbucket but currently the playbooks are ran on
peoples' workstations that may or may not be enrolled to the same IPA domain. Yes, I
know this is sub-optimal but this is the current situation. I, myself, want some kind of
centralized solution to this in the (preferably near) future.
I know that people could use kinit on their workstations to obtain a ticket. That would
require that me and my team would need to teach the various actors (who sometimes have
surprising lack of knowledge in basic IT stuff) the basic operations of Kerberos.
The current style works and we are refining it. Gonna take a look at ansible-freeipa
again. Looked at it ages ago.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...