Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create your Ansible playbook file that defines the HBAC policy whose presence you want to ensure. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/hbacrule/ensure-hbacrule-allhosts-present.yml file:

   ---
   - name: Playbook to handle hbacrules
     hosts: ipaserver
     become: true
   
     tasks:
     # Ensure idm_user can access client.idm.example.com via the sshd service
     - ipahbacrule:
         ipaadmin_password: MySecret123
         name: login
         user: idm_user
         host: client.idm.example.com
         hbacsvc:
         - sshd
         state: present

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-new-hbacrule-present.yml

Verification steps

1. Log in to the IdM Web UI as administrator.
2. Navigate to Policy → Host-Based-Access-Control → HBAC Test.
3. In the Who tab, select idm_user.
4. In the Accessing tab, select client.idm.example.com.
5. In the Via service tab, select sshd.
6. In the Rules tab, select login.
7. In the Run test tab, click the Run test button. If you see ACCESS GRANTED, the HBAC rule is implemented successfully.