I don't know whether this is good practice, but:

* You can run the action locally instead of in the target host; if the user running Ansible has a ticket, it should work
* If you use ssh to connect to the IPA client host using an IPA user, you should get a ticket and it should work
* Another option would be to use an Ansible module to do the operation, but I don't see the existing ipa_* modules doing what you need.

Cheers,

Álex

On Wed, Mar 18, 2020 at 8:44 AM Kimmo Rantala via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:
Hi,
I searched the interwebs but didn't find definite answer.

We are enrolling clients with ansible like this:
shell: ipa-client-install -U {{ ipa_extra_params }} --domain={{ ipa_domain }} --principal={{ ipa_admin_user }} --password={{ ipa_admin_password }} --mkhomedir --force-join --hostname={{ instance_hostname.stdout }}.{{ ipa_domain }}
This works fine.

After enrolling we want to edit the attributes of the newly enrolled host. We do that like this:
shell: echo {{ ipa_admin_password }} | kinit enroller@{{ ipa_domain|upper }} && ipa host-mod --setattr=userclass="{{ host_user_class }}" {{ instance_hostname.stdout }}.{{ ipa_domain }}
This also works fine but we don't love the fact that we echo the password to kinit. I know that there is the keytab route but that would require moving the keytab file to the host first. While this is not in any way impossible, we would like to "see all the cards".

What would be the best practice(tm) for this?
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org


--
   ___
 {~._.~}
  ( Y )
 ()~*~()  mail: alex at corcoles dot net