Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria:

   • Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case.
2. Specify the IdM domain and realm information.
3. Specify if you want the IdM server to have an integrated DNS and if you want it to use forwarders from the /etc/resolv.conf file.

4. Specify the passwords for admin and for the Directory Manager. Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file.

   Example of an inventory file with the required server information (excluding the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   [...]

   Example of an inventory file with the required server information (including the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   
   [...]

   Example playbook to set up an IdM server using admin and Directory Manager passwords stored in an Ansible Vault file

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
   
     roles:
     - role: ipaserver
       state: present

   Example playbook to set up an IdM server using admin and Directory Manager passwords from an inventory file

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
   
     roles:
     - role: ipaserver
       state: present

Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria:

   • Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case.
2. Specify the IdM domain and realm information.
3. Specify if you want the IdM server to have an integrated DNS and if you want it to use forwarders from the /etc/resolv.conf file.

4. Specify the passwords for admin and for the Directory Manager. Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file.

   Example of an inventory file with the required server information (excluding the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   [...]

   Example of an inventory file with the required server information (including the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   
   [...]

5. Create a playbook for the first step of the installation. Enter instructions for generating the certificate signing request (CSR) and copying it from the controller to the managed node.

   ---
   - name: Playbook to configure IPA server Step 1
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
     vars:
       ipaserver_external_ca: yes
   
     roles:
     - role: ipaserver
       state: present
   
     post_tasks:
     - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}"
       fetch:
         src: /root/ipa.csr
         dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}"
         flat: yes

6. Create another playbook for the final step of the installation.

   ---
   - name: Playbook to configure IPA server Step -1
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
     vars:
       ipaserver_external_cert_files: "/root/chain.crt"
   
     pre_tasks:
     - name: Copy "{{ groups.ipaserver[0] + '-chain.crt' }}" to /root/chain.crt on node
       copy:
         src: "{{ groups.ipaserver[0] + '-chain.crt' }}"
         dest: "/root/chain.crt"
         force: yes
   
     roles:
     - role: ipaserver
       state: present

Procedure

1. Run the ansible-playbook command with the name of the playbook file that contains instructions for the first step of the installation, for example install-server-step1.yml. Specify the inventory file with the -i option:

   $ ansible-playbook -v -i <path_to_inventory_directory>/host.server <path_to_playbooks_directory>/install-server-step1.yml

   Specify the level of verbosity by using the -v, -vv or -vvv option.

   You can view the output of the Ansible playbook script on the command-line interface (CLI). The following output shows that the script has run successfully as 0 tasks have failed:

   PLAY RECAP
   server.idm.example.com : ok=18   changed=10   unreachable=0    failed=0    skipped=21   rescued=0    ignored=0

2. Locate the ipa.csr certificate signing request file on the controller and submit it to the external CA.
3. Place the IdM CA certificate signed by the external CA in the controller file system so that the playbook in the next step can find it.

4. Run the ansible-playbook command with the name of the playbook file that contains instructions for the final step of the installation, for example install-server-step2.yml. Specify the inventory file with the -i option:

   $ ansible-playbook -v -i <path_to_inventory_directory>/host.server <path_to_playbooks_directory>/install-server-step2.yml