On Thu, Sep 14, 2023 at 8:10 AM Finn Fysj via FreeIPA-users < freeipa-users(a)lists.fedorahosted.org> wrote:
Most of the role variables are not replicated.
In the example you show the vars as set in the role call, not in an inventory file. The same variables (ipaclient_*) should be replicated in the ipareplica role (and on ipaclient) for the settings to be the same on all hosts.
How are you executing the ipareplica code?
Rafael
Thank you for taking your time.
It's important to note a "Cloud" dynamic-inventory is being used to reach all of the servers involved.
server.yml - hosts: - server become: true pre_tasks: - name: Replace default UID/GID_MAX ansible.builtin.replace: dest: /etc/login.defs regexp: "^{{ item }}.*" replace: "{{ item }} 6999" loop: - "UID_MAX" - "GID_MAX" - role: freeipa.ansible_freeipa.ipaserver vars: ipaserver: "{{ ansible_hostname }}.example" ipaserver_hostname: "{{ ansible_hostname }}.example" ipaadmin_password: "test123" ipadm_password: "test321" ipaserver_domain: "example.com" ipaserver_realm: "EXAMPLE.COM" ipaserver_no_host_dns: true ipaserver_mem_check: true ipaserver_install_packages: true ipaserver_setup_dns: false ipaserver_no_pkinit: true ipaserver_no_hbac_allow: true ipaserver_no_ui_redirect: false ipaclient_no_ntp: true ipaclient_mkhomedir: true ipaclient_no_sudo: false
replica.yml --- - hosts: - replica become: true roles: - role: freeipa.ansible_freeipa.ipareplica vars: # IPA Replica ipareplica_servers: ["server01.example.com"] ipareplicas: ["{{ ansible_play_hosts_all | join(', ') }}"] ipareplica_domain: "example" ipaadmin_principal: "admin" ipaadmin_password: "test123" ipadm_password: "test321" ipareplica_install_packages: true ipareplica_setup_firewalld: false ipareplica_setup_dns: false ipaclient_no_ntp: true ipaclient_mkhomedir: true ipaclient_no_sudo: false
site.yml --- - import_playbook: server.yml - import_playbook: replica.yml
ansible-playbook --ask-become-pass -i dynamic-inventory site.yml
Authselect output: $ authselect current Profile ID: sssd Enabled features: - with-mkhomedir - with-sudo
Turns out now it works great.
I also then apply SUDO and HBAC rules to my MASTER server using playbooks. The sync of rules takes a lot of time. Could a SSSD restart trigger this?
After this is migrate existing USERS and GROUPS from an old IPA server (RHEL 7) which is going to be destroyed. DS migration: ipa migrate-ds --with-compat --user-container='cn=users,cn=accounts' --group-container='cn=groups,cn=accounts' ldap://old.ipa.example
I've later realized private groups are not being migrated. Any way of "regenerate" these?