On Fri, Jan 8, 2021 at 11:03 AM Dominik Vogt via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
We have to set up the ipa-server with Ansible scripts, but there
isn't a module for everything. For example, this command needs to
be executed.
- name: ...
shell: ipa config-mod --ipaselinuxusermaporder="..."
However, that doesn't work (using either the "root" or ipa
"admin"
accounts) because the Kerberos ticket granting ticket is missing.
Hard coding user and password in a plain script or on the command
line is bad. I've really no idea how to solve this.
If running IPA commands with the `shell` module, you need to `kinit` in the
script. If I need to, I wrap them with something like:
- block:
- name: Verify assymetric-only fields are not present.
shell: |
echo {{ some_secret }} | kinit -c {{ KRB5CCNAME }} admin
KRB5CCNAME={{ KRB5CCNAME }} ipa vault-show test_vault
kdestroy -A -q -c {{ KRB5CCNAME }}
vars:
KRB5CCNAME: some_very_unique_name
But I resort to it only if I really need to.
P.S.: The existing ipa modules for Ansible seem to do their work
over the http interface.
These are the Ansible community-general modules. If using ansible-freeipa,
as Thomas suggested, it does not uses http
I'd second the suggestion to use ansible-freeipa's ipaconfig module.
Regards,
Rafael
--
Rafael Guterres Jeffman
Senior Software Engineer
FreeIPA - Red Hat