On pe, 08 tammi 2021, Dominik Vogt via FreeIPA-users wrote:
On Fri, Jan 08, 2021 at 11:31:28AM -0300, Rafael Jeffman wrote:
> On Fri, Jan 8, 2021 at 11:03 AM Dominik Vogt via FreeIPA-users <
> freeipa-users(a)lists.fedorahosted.org> wrote:
>
> > We have to set up the ipa-server with Ansible scripts, but there
> > isn't a module for everything. For example, this command needs to
> > be executed.
> >
> > - name: ...
> > shell: ipa config-mod --ipaselinuxusermaporder="..."
> >
> > However, that doesn't work (using either the "root" or ipa
"admin"
> > accounts) because the Kerberos ticket granting ticket is missing.
> > Hard coding user and password in a plain script or on the command
> > line is bad. I've really no idea how to solve this.
> >
>
> If running IPA commands with the `shell` module, you need to `kinit` in the
> script. If I need to, I wrap them with something like:
Actually the command to run is so complex that I use "script"
instead of "shell" - mostly because of that very annoying
behaviour of the ipa commands to generate an error if a change is
requested but the requested value was already active.
> - block:
> - name: Verify assymetric-only fields are not present.
> shell: |
> echo {{ some_secret }} | kinit -c {{ KRB5CCNAME }} admin
> KRB5CCNAME={{ KRB5CCNAME }} ipa vault-show test_vault
> kdestroy -A -q -c {{ KRB5CCNAME }}
> vars:
> KRB5CCNAME: some_very_unique_name
>
> But I resort to it only if I really need to.
I'll check that.
> I'd second the suggestion to use ansible-freeipa's ipaconfig module.
Okay, I'll take a look at that. Sounds much better than the
modules coming with Ansible. Is it considered to be a part of
ipa? Because, if we use third party software for our project,
we'll have to justify why we need it and why it can be assumed to
be safe, and that security patches will be available.
Whoever started Ansible's community modules around IPA, are not
associated with FreeIPA project. We have no influence over that code --
it is a separate project that runs on its own base and never really
consulted with FreeIPA. We don't really support the way that module is
done. Instead, we have been working on ansible-freeipa project which is
using native IPA Python API and tries to stay close to FreeIPA upstream.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland