1. If your system is running on RHEL 8.5 and earlier, enable the required repository:

   # subscription-manager repos --enable ansible-2.8-for-rhel-8-x86_64-rpms

2. If your system is running on RHEL 8.5 and earlier, install the ansible package:

   # dnf install ansible

3. Install the ansible-freeipa package:

   # dnf install ansible-freeipa

   The roles and modules are installed into the /usr/share/ansible/roles/ and /usr/share/ansible/plugins/modules directories.

Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria:

   • Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case.
2. Specify the IdM domain and realm information.

3. Specify that you want to use integrated DNS by adding the following option:

   ipaserver_setup_dns=yes

4. Specify the DNS forwarding settings. Choose one of the following options:

   • Use the ipaserver_auto_forwarders=yes option if you want the installer to use forwarders from the /etc/resolv.conf file. Do not use this option if the nameserver specified in the /etc/resolv.conf file is the localhost 127.0.0.1 address or if you are on a virtual private network and the DNS servers you are using are normally unreachable from the public internet.
   • Use the ipaserver_forwarders option to specify your forwarders manually. The installation process adds the forwarder IP addresses to the /etc/named.conf file on the installed IdM server.

   • Use the ipaserver_no_forwarders=yes option to configure root DNS servers to be used instead.

     Note

     With no DNS forwarders, your environment is isolated, and names from other DNS domains in your infrastructure are not resolved.

5. Specify the DNS reverse record and zone settings. Choose from the following options:

   • Use the ipaserver_allow_zone_overlap=yes option to allow the creation of a (reverse) zone even if the zone is already resolvable.
   • Use the ipaserver_reverse_zones option to specify your reverse zones manually.

   • Use the ipaserver_no_reverse=yes option if you do not want the installer to create a reverse DNS zone.

     Note

     Using IdM to manage reverse zones is optional. You can use an external DNS service for this purpose instead.

6. Specify the passwords for admin and for the Directory Manager. Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file.

7. (Optional) Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public.

   Important

   The specified firewalld zone must exist and be permanent.

   Example of an inventory file with the required server information (excluding the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   [...]

   Example of an inventory file with the required server information (including the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   
   [...]

   Example of an inventory file with a custom firewalld zone

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   ipaserver_firewalld_zone=custom zone

   Example playbook to set up an IdM server using admin and Directory Manager passwords stored in an Ansible Vault file

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
   
     roles:
     - role: ipaserver
       state: present

   Example playbook to set up an IdM server using admin and Directory Manager passwords from an inventory file

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
   
     roles:
     - role: ipaserver
       state: present

Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria:

   • Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case.
2. Specify the IdM domain and realm information.
3. Make sure that the ipaserver_setup_dns option is set to no or that it is absent.
4. Specify the passwords for admin and for the Directory Manager. Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file.

5. (Optional) Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public.

   Important

   The specified firewalld zone must exist and be permanent.

   Example of an inventory file with the required server information (excluding the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=no
   [...]

   Example of an inventory file with the required server information (including the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=no
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   
   [...]

   Example of an inventory file with a custom firewalld zone

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=no
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   ipaserver_firewalld_zone=custom zone

   Example playbook to set up an IdM server using admin and Directory Manager passwords stored in an Ansible Vault file

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
   
     roles:
     - role: ipaserver
       state: present

   Example playbook to set up an IdM server using admin and Directory Manager passwords from an inventory file

   ---
   - name: Playbook to configure IPA server
     hosts: ipaserver
     become: true
   
     roles:
     - role: ipaserver
       state: present

Procedure

1. Run the ansible-playbook command with the name of the playbook file, for example install-server.yml. Specify the inventory file with the -i option:

   $ ansible-playbook -v -i <path_to_inventory_directory>/hosts <path_to_playbooks_directory>/install-server.yml

   Specify the level of verbosity by using the -v, -vv, or -vvv option.

   You can view the output of the Ansible playbook script on the command-line interface (CLI). The following output shows that the script has run successfully as 0 tasks have failed:

   PLAY RECAP
   server.idm.example.com : ok=18   changed=10   unreachable=0    failed=0    skipped=21   rescued=0    ignored=0

2. Choose one of the following options:

   • If your IdM deployment uses external DNS: add the DNS resource records contained in the /tmp/ipa.system.records.UFRPto.db file to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.

     ...
     Restarting the KDC
     Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db
     Restarting the web server
     ...

   Important

   The server installation is not complete until you add the DNS records to the existing DNS servers.

   • If your IdM deployment uses integrated DNS:

     • Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is idm.example.com, add a name server (NS) record to the example.com parent domain.

       Important

       Repeat this step each time after an IdM DNS server is installed.

     • Add an _ntp._udp service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server.

Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria:

   • Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case.
2. Specify the IdM domain and realm information.

3. Specify that you want to use integrated DNS by adding the following option:

   ipaserver_setup_dns=yes

4. Specify the DNS forwarding settings. Choose one of the following options:

   • Use the ipaserver_auto_forwarders=yes option if you want the installation process to use forwarders from the /etc/resolv.conf file. This option is not recommended if the nameserver specified in the /etc/resolv.conf file is the localhost 127.0.0.1 address or if you are on a virtual private network and the DNS servers you are using are normally unreachable from the public internet.
   • Use the ipaserver_forwarders option to specify your forwarders manually. The installation process adds the forwarder IP addresses to the /etc/named.conf file on the installed IdM server.

   • Use the ipaserver_no_forwarders=yes option to configure root DNS servers to be used instead.

     Note

     With no DNS forwarders, your environment is isolated, and names from other DNS domains in your infrastructure are not resolved.

5. Specify the DNS reverse record and zone settings. Choose from the following options:

   • Use the ipaserver_allow_zone_overlap=yes option to allow the creation of a (reverse) zone even if the zone is already resolvable.
   • Use the ipaserver_reverse_zones option to specify your reverse zones manually.

   • Use the ipaserver_no_reverse=yes option if you do not want the installation process to create a reverse DNS zone.

     Note

     Using IdM to manage reverse zones is optional. You can use an external DNS service for this purpose instead.

6. Specify the passwords for admin and for the Directory Manager. Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file.

7. (Optional) Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM adds its services to the default firewalld zone. The predefined default zone is public.

   Important

   The specified firewalld zone must exist and be permanent.

   Example of an inventory file with the required server information (excluding the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   [...]

   Example of an inventory file with the required server information (including the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   
   [...]

   Example of an inventory file with a custom firewalld zone

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=yes
   ipaserver_auto_forwarders=yes
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   ipaserver_firewalld_zone=custom zone
   
   [...]

8. Create a playbook for the first step of the installation. Enter instructions for generating the certificate signing request (CSR) and copying it from the controller to the managed node.

   ---
   - name: Playbook to configure IPA server Step 1
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
     vars:
       ipaserver_external_ca: yes
   
     roles:
     - role: ipaserver
       state: present
   
     post_tasks:
     - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}"
       fetch:
         src: /root/ipa.csr
         dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}"
         flat: yes

9. Create another playbook for the final step of the installation.

   ---
   - name: Playbook to configure IPA server Step -1
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
     vars:
       ipaserver_external_cert_files: "/root/chain.crt"
   
     pre_tasks:
     - name: Copy "{{ groups.ipaserver[0] + '-chain.crt' }}" to /root/chain.crt on node
       copy:
         src: "{{ groups.ipaserver[0] + '-chain.crt' }}"
         dest: "/root/chain.crt"
         force: yes
   
     roles:
     - role: ipaserver
       state: present

Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the host you want to use as an IdM server. Ensure that the FQDN meets the following criteria:

   • Only alphanumeric characters and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case.
2. Specify the IdM domain and realm information.
3. Make sure that the ipaserver_setup_dns option is set to no or that it is absent.
4. Specify the passwords for admin and for the Directory Manager. Use the Ansible Vault to store the password, and reference the Vault file from the playbook file. Alternatively and less securely, specify the passwords directly in the inventory file.

5. (Optional) Specify a custom firewalld zone to be used by the IdM server. If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public.

   Important

   The specified firewalld zone must exist and be permanent.

   Example of an inventory file with the required server information (excluding the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=no
   [...]

   Example of an inventory file with the required server information (including the passwords)

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=no
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   
   [...]

   Example of an inventory file with a custom firewalld zone

   [ipaserver]
   server.idm.example.com
   
   [ipaserver:vars]
   ipaserver_domain=idm.example.com
   ipaserver_realm=IDM.EXAMPLE.COM
   ipaserver_setup_dns=no
   ipaadmin_password=MySecretPassword123
   ipadm_password=MySecretPassword234
   ipaserver_firewalld_zone=custom zone
   
   [...]

6. Create a playbook for the first step of the installation. Enter instructions for generating the certificate signing request (CSR) and copying it from the controller to the managed node.

   ---
   - name: Playbook to configure IPA server Step 1
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
     vars:
       ipaserver_external_ca: yes
   
     roles:
     - role: ipaserver
       state: present
   
     post_tasks:
     - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}"
       fetch:
         src: /root/ipa.csr
         dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}"
         flat: yes

7. Create another playbook for the final step of the installation.

   ---
   - name: Playbook to configure IPA server Step -1
     hosts: ipaserver
     become: true
     vars_files:
     - playbook_sensitive_data.yml
     vars:
       ipaserver_external_cert_files: "/root/chain.crt"
   
     pre_tasks:
     - name: Copy "{{ groups.ipaserver[0] + '-chain.crt' }}" to /root/chain.crt on node
       copy:
         src: "{{ groups.ipaserver[0] + '-chain.crt' }}"
         dest: "/root/chain.crt"
         force: yes
   
     roles:
     - role: ipaserver
       state: present

Procedure

1. Run the ansible-playbook command with the name of the playbook file that contains instructions for the first step of the installation, for example install-server-step1.yml. Specify the inventory file with the -i option:

   $ ansible-playbook -v -i <path_to_inventory_directory>/host.server <path_to_playbooks_directory>/install-server-step1.yml

   Specify the level of verbosity by using the -v, -vv or -vvv option.

   You can view the output of the Ansible playbook script on the command-line interface (CLI). The following output shows that the script has run successfully as 0 tasks have failed:

   PLAY RECAP
   server.idm.example.com : ok=18   changed=10   unreachable=0    failed=0    skipped=21   rescued=0    ignored=0

2. Locate the ipa.csr certificate signing request file on the controller and submit it to the external CA.
3. Place the IdM CA certificate signed by the external CA in the controller file system so that the playbook in the next step can find it.

4. Run the ansible-playbook command with the name of the playbook file that contains instructions for the final step of the installation, for example install-server-step2.yml. Specify the inventory file with the -i option:

   $ ansible-playbook -v -i <path_to_inventory_directory>/host.server <path_to_playbooks_directory>/install-server-step2.yml

5. Choose one of the following options:

   • If your IdM deployment uses external DNS: add the DNS resource records contained in the /tmp/ipa.system.records.UFRPto.db file to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.

     ...
     Restarting the KDC
     Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db
     Restarting the web server
     ...

   Important

   The server installation is not complete until you add the DNS records to the existing DNS servers.

   • If your IdM deployment uses integrated DNS:

     • Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is idm.example.com, add a name server (NS) record to the example.com parent domain.

       Important

       Repeat this step each time after an IdM DNS server is installed.

     • Add an _ntp._udp service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server.

Procedure

1. Open the inventory file for editing. Specify the fully-qualified domain names (FQDN) of the hosts to become IdM replicas. The FQDNs must be valid DNS names:

   • Only numbers, alphabetic characters, and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.

   • The host name must be all lower-case.

     Example of a simple inventory hosts file with only the replicas' FQDN defined

     [ipareplicas]
     replica1.idm.example.com
     replica2.idm.example.com
     replica3.idm.example.com
     [...]

     If the IdM server is already deployed and the SRV records are set properly in the IdM DNS zone, the script automatically discovers all the other required values.

2. Optionally, provide additional information in the inventory file based on which of the following scenarios is closest to yours:

   Scenario 1

   If you want to avoid autodiscovery and have all replicas listed in the [ipareplicas] section use a specific IdM server, set the server in the [ipaservers] section of the inventory file.

   Example inventory hosts file with the FQDN of the IdM server and replicas defined

   [ipaservers]
   server.idm.example.com
   
   [ipareplicas]
   replica1.idm.example.com
   replica2.idm.example.com
   replica3.idm.example.com
   [...]

   Scenario 2

   Alternatively, if you want to avoid autodiscovery but want to deploy specific replicas with specific servers, set the servers for specific replicas individually in the [ipareplicas] section in the inventory file.

   Example inventory file with a specific IdM server defined for a specific replica

   [ipaservers]
   server.idm.example.com
   replica1.idm.example.com
   
   [ipareplicas]
   replica2.idm.example.com
   replica3.idm.example.com ipareplica_servers=replica1.idm.example.com

   In the example above, replica3.idm.example.com uses the already deployed replica1.idm.example.com as its replication source.

   Scenario 3

   If you are deploying several replicas in one batch and time is a concern to you, multitier replica deployment can be useful for you. Define specific groups of replicas in the inventory file, for example [ipareplicas_tier1] and [ipareplicas_tier2], and design separate plays for each group in the install-replica.yml playbook.

   Example inventory file with replica tiers defined

   [ipaservers]
   server.idm.example.com
   
   [ipareplicas_tier1]
   replica1.idm.example.com
   
   [ipareplicas_tier2]
   replica2.idm.example.com \ ipareplica_servers=replica1.idm.example.com,server.idm.example.com

   The first entry in ipareplica_servers will be used. The second entry will be used as a fallback option. When using multiple tiers for deploying IdM replicas, you must have separate tasks in the playbook to first deploy replicas from tier1 and then replicas from tier2:

   Example of a playbook file with different plays for different replica groups

   ---
   - name: Playbook to configure IPA replicas (tier1)
     hosts: ipareplicas_tier1
     become: true
   
     roles:
     - role: ipareplica
       state: present
   
   - name: Playbook to configure IPA replicas (tier2)
     hosts: ipareplicas_tier2
     become: true
   
     roles:
     - role: ipareplica
       state: present

   Scenario 4

   If you want the replica to use a specified firewalld zone instead of the default one, you can specify it in the inventory file. This can be useful, for example, when you want to use an internal firewalld zone for your IdM installation instead of a public zone that is set as default.

   If you do not set a custom zone, IdM will add its services to the default firewalld zone. The predefined default zone is public.

   Important

   The specified firewalld zone must exist and be permanent.

   Example of a simple inventory hosts file with a custom firewalld zone

   [ipaservers]
   server.idm.example.com
   
   [ipareplicas]
   replica1.idm.example.com
   replica2.idm.example.com
   replica3.idm.example.com
   [...]
   
   [ipareplicas:vars]
   ipareplica_firewalld_zone=custom zone

   Scenario 5

   If you want the replica to host the IdM DNS service, add the ipareplica_setup_dns=yes line to the [ipareplicas:vars] section. Additionally, specify if you want to use per-server DNS forwarders:

   • To configure per-server forwarders, add the ipareplica_forwarders variable and a list of strings to the [ipareplicas:vars] section, for example: ipareplica_forwarders=192.0.2.1,192.0.2.2
   • To configure no per-server forwarders, add the following line to the [ipareplicas:vars] section: ipareplica_no_forwarders=yes.
   • To configure per-server forwarders based on the forwarders listed in the /etc/resolv.conf file of the replica, add the ipareplica_auto_forwarders variable to the [ipareplicas:vars] section.

   Example inventory file with instructions to set up DNS and per-server forwarders on the replicas

   [ipaservers]
   server.idm.example.com
   
   [ipareplicas]
   replica1.idm.example.com
   replica2.idm.example.com
   replica3.idm.example.com
   [...]
   
   [ipareplicas:vars]
   ipareplica_setup_dns=yes
   ipareplica_forwarders=192.0.2.1,192.0.2.2

Procedure

1. Specify the password of a user authorized to deploy replicas, for example the IdM admin.

   • Red Hat recommends using the Ansible Vault to store the password, and referencing the Vault file from the playbook file, for example install-replica.yml:

     Example playbook file using principal from inventory file and password from an Ansible Vault file

     - name: Playbook to configure IPA replicas
       hosts: ipareplicas
       become: true
       vars_files:
       - playbook_sensitive_data.yml
     
       roles:
       - role: ipareplica
         state: present

     For details how to use Ansible Vault, see the official Ansible Vault documentation.

   • Less securely, provide the credentials of admin directly in the inventory file. Use the ipaadmin_password option in the [ipareplicas:vars] section of the inventory file. The inventory file and the install-replica.yml playbook file can then look as follows:

     Example inventory hosts.replica file

     [...]
     [ipareplicas:vars]
     ipaadmin_password=Secret123

     Example playbook using principal and password from inventory file

     - name: Playbook to configure IPA replicas
       hosts: ipareplicas
       become: true
     
       roles:
       - role: ipareplica
         state: present

   • Alternatively but also less securely, provide the credentials of another user authorized to deploy a replica directly in the inventory file. To specify a different authorized user, use the ipaadmin_principal option for the user name, and the ipaadmin_password option for the password. The inventory file and the install-replica.yml playbook file can then look as follows:

     Example inventory hosts.replica file

     [...]
     [ipareplicas:vars]
     ipaadmin_principal=my_admin
     ipaadmin_password=my_admin_secret123

     Example playbook using principal and password from inventory file

     - name: Playbook to configure IPA replicas
       hosts: ipareplicas
       become: true
     
       roles:
       - role: ipareplica
         state: present

Procedure

1. Specify the fully-qualified hostname (FQDN) of the host to become an IdM client. The fully qualified domain name must be a valid DNS name:

   • Only numbers, alphabetic characters, and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case. No capital letters are allowed.

   If the SRV records are set properly in the IdM DNS zone, the script automatically discovers all the other required values.

   Example of a simple inventory hosts file with only the client FQDN defined

   [ipaclients]
   client.idm.example.com
   [...]

2. Specify the credentials for enrolling the client. The following authentication methods are available:

   • The password of a user authorized to enroll clients. This is the default option.

     • Red Hat recommends using the Ansible Vault to store the password, and referencing the Vault file from the playbook file, for example install-client.yml, directly:

       Example playbook file using principal from inventory file and password from an Ansible Vault file

       - name: Playbook to configure IPA clients with username/password
         hosts: ipaclients
         become: true
         vars_files:
         - playbook_sensitive_data.yml
       
         roles:
         - role: ipaclient
           state: present

     • Less securely, provide the credentials of admin using the ipaadmin_password option in the [ipaclients:vars] section of the inventory/hosts file. Alternatively, to specify a different authorized user, use the ipaadmin_principal option for the user name, and the ipaadmin_password option for the password. The inventory/hosts inventory file and the install-client.yml playbook file can then look as follows:

       Example inventory hosts file

       [...]
       [ipaclients:vars]
       ipaadmin_principal=my_admin
       ipaadmin_password=Secret123

       Example Playbook using principal and password from inventory file

       - name: Playbook to unconfigure IPA clients
         hosts: ipaclients
         become: true
       
         roles:
         - role: ipaclient
           state: true

   • The client keytab from the previous enrollment if it is still available.

     This option is available if the system was previously enrolled as an Identity Management client. To use this authentication method, uncomment the #ipaclient_keytab option, specifying the path to the file storing the keytab, for example in the [ipaclient:vars] section of inventory/hosts.

   • A random, one-time password (OTP) to be generated during the enrollment. To use this authentication method, use the ipaclient_use_otp=yes option in your inventory file. For example, you can uncomment the ipaclient_use_otp=yes option in the [ipaclients:vars] section of the inventory/hosts file. Note that with OTP you must also specify one of the following options:

     • The password of a user authorized to enroll clients, for example by providing a value for ipaadmin_password in the [ipaclients:vars] section of the inventory/hosts file.
     • The admin keytab, for example by providing a value for ipaadmin_keytab in the [ipaclients:vars] section of inventory/hosts.

Procedure

1. Specify the fully-qualified hostname (FQDN) of the host to become an IdM client. The fully qualified domain name must be a valid DNS name:

   • Only numbers, alphabetic characters, and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.
   • The host name must be all lower-case. No capital letters are allowed.

2. Specify other options in the relevant sections of the inventory/hosts file:

   • the FQDN of the servers in the [ipaservers] section to indicate which IdM server the client will be enrolled with

   • one of the two following options:

     • the ipaclient_domain option in the [ipaclients:vars] section to indicate the DNS domain name of the IdM server the client will be enrolled with

     • the ipaclient_realm option in the [ipaclients:vars] section to indicate the name of the Kerberos realm controlled by the IdM server

       Example of an inventory hosts file with the client FQDN, the server FQDN and the domain defined

       [ipaclients]
       client.idm.example.com
       
       [ipaservers]
       server.idm.example.com
       
       [ipaclients:vars]
       ipaclient_domain=idm.example.com
       [...]

3. Specify the credentials for enrolling the client. The following authentication methods are available:

   • The password of a user authorized to enroll clients. This is the default option.

     • Red Hat recommends using the Ansible Vault to store the password, and referencing the Vault file from the playbook file, for example install-client.yml, directly: .Example playbook file using principal from inventory file and password from an Ansible Vault file

Procedure

1. Create an inventory file, for example inventory.file, and define the IdM server from which you want to retrieve the IdM configuration in the [ipaserver] section. For example, to instruct Ansible to retrieve the data from server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

2. Open the /usr/share/doc/ansible-freeipa/playbooks/config/retrieve-config.yml Ansible playbook file for editing:

   ---
   - name: Playbook to handle global IdM configuration
     hosts: ipaserver
     become: no
     gather_facts: no
   
     tasks:
     - name: Query IPA global configuration
       ipaconfig:
         ipaadmin_password: Secret123
       register: serverconfig
   
     - debug:
         msg: "{{ serverconfig }}"

3. Adapt the file by changing the following:

   • The password of IdM administrator.
   • Other values, if necessary.
4. Save the file.

5. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file /usr/share/doc/ansible-freeipa/playbooks/config/retrieve-config.yml
   [...]
   TASK [debug]
   ok: [server.idm.example.com] => {
       "msg": {
           "ansible_facts": {
               "discovered_interpreter_
           },
           "changed": false,
           "config": {
               "ca_renewal_master_server": "server.idm.example.com",
               "configstring": [
                   "AllowNThash",
                   "KDC:Disable Last Success"
               ],
               "defaultgroup": "ipausers",
               "defaultshell": "/bin/bash",
               "emaildomain": "idm.example.com",
               "enable_migration": false,
               "groupsearch": [
                   "cn",
                   "description"
               ],
               "homedirectory": "/home",
               "maxhostname": "64",
               "maxusername": "64",
               "pac_type": [
                   "MS-PAC",
                   "nfs:NONE"
               ],
               "pwdexpnotify": "4",
               "searchrecordslimit": "100",
               "searchtimelimit": "2",
               "selinuxusermapdefault": "unconfined_u:s0-s0:c0.c1023",
               "selinuxusermaporder": [
                   "guest_u:s0$xguest_u:s0$user_
               ],
               "usersearch": [
                   "uid",
                   "givenname",
                   "sn",
                   "telephonenumber",
                   "ou",
                   "title"
               ]
           },
           "failed": false
       }
   }

Procedure

1. Optional: Identify the current IdM CA renewal server:

   $ ipa config-show | grep 'CA renewal'
     IPA CA renewal master: server.idm.example.com

2. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

3. Open the /usr/share/doc/ansible-freeipa/playbooks/config/set-ca-renewal-master-server.yml Ansible playbook file for editing:

   ---
   - name: Playbook to handle global DNS configuration
     hosts: ipaserver
     become: no
     gather_facts: no
   
     tasks:
     - name: set ca_renewal_master_server
       ipaconfig:
         ipaadmin_password: SomeADMINpassword
         ca_renewal_master_server: carenewal.idm.example.com

4. Adapt the file by changing:

   • The password of IdM administrator set by the ipaadmin_password variable.
   • The name of the CA renewal server set by the ca_renewal_master_server variable.
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file and the inventory file:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file /usr/share/doc/ansible-freeipa/playbooks/config/set-ca-renewal-master-server.yml

1. Log into ipaserver as IdM administrator:

   $ ssh admin@server.idm.example.com
   Password:
   [admin@server /]$

2. Request the identity of the IdM CA renewal server:

   $ ipa config-show | grep ‘CA renewal’
   IPA CA renewal master:  carenewal.idm.example.com

   The output shows the carenewal.idm.example.com server is the new CA renewal server.

Procedure

1. Optional: Use the retrieve-config.yml Ansible playbook to identify the current shell for IdM users. See Retrieving IdM configuration using an Ansible playbook for details.

2. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

3. Open the /usr/share/doc/ansible-freeipa/playbooks/config/ensure-config-options-are-set.yml Ansible playbook file for editing:

   ---
   - name: Playbook to ensure some config options are set
     hosts: ipaserver
     become: true
   
     tasks:
     # Set defaultlogin and maxusername
     - ipaconfig:
         ipaadmin_password: Secret123
         defaultshell: /bin/bash
         maxusername: 64

4. Adapt the file by changing the following:

   • The password of IdM administrator set by the ipaadmin_password variable.
   • The default shell of the IdM users set by the defaultshell variable into /bin/sh.
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file and the inventory file:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file /usr/share/doc/ansible-freeipa/playbooks/config/ensure-config-options-are-set.yml

1. Log into ipaserver as IdM administrator:

   $ ssh admin@server.idm.example.com
   Password:
   [admin@server /]$

2. Display the current shell:

   [admin@server /]$ echo "$SHELL"
   /bin/sh

   The logged-in user is using the sh shell.

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the data of the user whose presence in IdM you want to ensure. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/user/add-user.yml file. For example, to create user named idm_user and add Password123 as the user password:

   ---
   - name: Playbook to handle users
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Create user idm_user
       ipauser:
         ipaadmin_password: MySecret123
         name: idm_user
         first: Alice
         last: Acme
         uid: 1000111
         gid: 10011
         phone: "+555123457"
         email: idm_user@acme.com
         passwordexpiration: "2023-01-19 23:59:59"
         password: "Password123"
         update_password: on_create

   You must use the following options to add a user:

   • name: the login name
   • first: the first name string
   • last: the last name string

   For the full list of available user options, see the /usr/share/doc/ansible-freeipa/README-user.md Markdown file.

   Note

   If you use the update_password: on_create option, Ansible only creates the user password when it creates the user. If the user is already created with a password, Ansible does not generate a new password.

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/add-IdM-user.yml

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the data of the users whose presence you want to ensure in IdM. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/user/ensure-users-present.yml file. For example, to create users idm_user_1, idm_user_2, and idm_user_3, and add Password123 as the password of idm_user_1:

   ---
   - name: Playbook to handle users
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Create user idm_users
       ipauser:
         ipaadmin_password: MySecret123
         users:
         - name: idm_user_1
           first: Alice
           last: Acme
           uid: 10001
           gid: 10011
           phone: "+555123457"
           email: idm_user@acme.com
           passwordexpiration: "2023-01-19 23:59:59"
           password: "Password123"
         - name: idm_user_2
           first: Bob
           last: Acme
           uid: 100011
           gid: 10011
         - name: idm_user_3
           first: Eve
           last: Acme
           uid: 1000111
           gid: 10011

   Note

   If you do not specify the update_password: on_create option, Ansible re-sets the user password every time the playbook is run: if the user has changed the password since the last time the playbook was run, Ansible re-sets password.

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/add-users.yml

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the necessary tasks. Reference the JSON file with the data of the users whose presence you want to ensure. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/ensure-users-present-ymlfile.yml file:

   ---
   - name: Ensure users' presence
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Include users.json
       include_vars:
         file: users.json
   
     - name: Users present
       ipauser:
         ipaadmin_password: MySecret123
         users: "{{ users }}"

3. Create the users.json file, and add the IdM users into it. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/user/users.json file. For example, to create users idm_user_1, idm_user_2, and idm_user_3, and add Password123 as the password of idm_user_1:

   {
     "users": [
      {
       "name": "idm_user_1",
       "first": "Alice",
       "last": "Acme",
       "password": "Password123"
      },
      {
       "name": "idm_user_2",
       "first": "Bob",
       "last": "Acme"
      },
      {
       "name": "idm_user_3",
       "first": "Eve",
       "last": "Acme"
      }
     ]
   }

4. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-users-present-jsonfile.yml

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the users whose absence from IdM you want to ensure. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/user/ensure-users-present.yml file. For example, to delete users idm_user_1, idm_user_2, and idm_user_3:

   ---
   - name: Playbook to handle users
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Delete users idm_user_1, idm_user_2, idm_user_3
       ipauser:
         ipaadmin_password: MySecret123
         users:
         - name: idm_user_1
         - name: idm_user_2
         - name: idm_user_3
         state: absent

3. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/delete-users.yml

1. Log into ipaserver as administrator:

   $ ssh administrator@server.idm.example.com
   Password:
   [admin@server /]$

2. Request information about idm_user_1:

   $ ipa user-show idm_user_1
   ipa: ERROR: idm_user_1: user not found

   The user named idm_user_1 does not exist in IdM.

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the necessary user and group information:

   ---
   - name: Playbook to handle groups
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Create group ops with gid 1234
       ipagroup:
         ipaadmin_password: MySecret123
         name: ops
         gidnumber: 1234
   
     - name: Create group sysops
       ipagroup:
         ipaadmin_password: MySecret123
         name: sysops
         user:
         - idm_user
   
     - name: Create group appops
       ipagroup:
         ipaadmin_password: MySecret123
         name: appops
   
     - name: Add group members sysops and appops to group ops
       ipagroup:
         ipaadmin_password: MySecret123
         name: ops
         group:
         - sysops
         - appops

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/add-group-members.yml

1. Log into ipaserver as administrator:

   $ ssh admin@server.idm.example.com
   Password:
   [admin@server /]$

2. Display information about ops:

   ipaserver]$ ipa group-show ops
     Group name: ops
     GID: 1234
     Member groups: sysops, appops
     Indirect Member users: idm_user

   The appops and sysops groups - the latter including the idm_user user - exist in IdM.

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the necessary user and group member management information:

   ---
   - name: Playbook to handle membership management
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure user test is present for group_a
       ipagroup:
         ipaadmin_password: MySecret123
         name: group_a
         membermanager_user: test
   
     - name: Ensure group_admins is present for group_a
       ipagroup:
         ipaadmin_password: MySecret123
         name: group_a
         membermanager_group: group_admins

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/add-member-managers-user-groups.yml

1. Log into ipaserver as administrator:

   $ ssh admin@server.idm.example.com
   Password:
   [admin@server /]$

2. Display information about managergroup1:

   ipaserver]$ ipa group-show group_a
     Group name: group_a
     GID: 1133400009
     Membership managed by groups: group_admins
     Membership managed by users: test

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the necessary user and group member management information:

   ---
   - name: Playbook to handle membership management
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure member manager user and group members are absent for group_a
       ipagroup:
         ipaadmin_password: MySecret123
         name: group_a
         membermanager_user: test
         membermanager_group: group_admins
         action: member
         state: absent

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-member-managers-are-absent.yml

1. Log into ipaserver as administrator:

   $ ssh admin@server.idm.example.com
   Password:
   [admin@server /]$

2. Display information about group_a:

   ipaserver]$ ipa group-show group_a
     Group name: group_a
     GID: 1133400009

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the automember-group-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-group-present.yml automember-group-present-copy.yml

3. Open the automember-group-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaautomember task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to testing_group.
   • Set the automember_type variable to group.
   • Ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Automember group present example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure group automember rule admins is present
       ipaautomember:
         ipaadmin_password: Secret123
         name: testing_group
         automember_type: group
         state: present

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory automember-group-present-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the automember-hostgroup-rule-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automember/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/automember/automember-hostgroup-rule-present.yml automember-hostgroup-rule-present-copy.yml

3. Open the automember-hostgroup-rule-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaautomember task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to primary_dns_domain_hosts.
   • Set the automember_type variable to hostgroup.
   • Ensure that the state variable is set to present.
   • Ensure that the action variable is set to member.
   • Ensure that the inclusive key variable is set to fqdn.
   • Set the corresponding inclusive expression variable to .*.idm.example.com.
   • Set the exclusive key variable to fqdn.
   • Set the corresponding exclusive expression variable to .*.example.org.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Automember user group rule member present
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure an automember condition for a user group is present
       ipaautomember:
         ipaadmin_password: Secret123
         name: primary_dns_domain_hosts
         automember_type: hostgroup
         state: present
         action: member
         inclusive:
           - key: fqdn
             expression: .*.idm.example.com
         exclusive:
           - key: fqdn
             expression: .*.example.org

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory automember-hostgroup-rule-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the selfservice-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/selfservice/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/selfservice/selfservice-present.yml selfservice-present-copy.yml

3. Open the selfservice-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaselfservice task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the new self-service rule.
   • Set the permission variable to a comma-separated list of permissions to grant: read and write.
   • Set the attribute variable to a list of attributes that users can manage themselves: givenname, displayname, title, and initials.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Self-service present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure self-service rule "Users can manage their own name details" is present
       ipaselfservice:
         ipaadmin_password: Secret123
         name: "Users can manage their own name details"
         permission: read, write
         attribute:
         - givenname
         - displayname
         - title
         - initials

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory selfservice-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the selfservice-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/selfservice/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/selfservice/selfservice-absent.yml selfservice-absent-copy.yml

3. Open the selfservice-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaselfservice task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the self-service rule.
   • Set the state variable to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Self-service absent
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure self-service rule "Users can manage their own name details" is absent
       ipaselfservice:
         ipaadmin_password: Secret123
         name: "Users can manage their own name details"
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory selfservice-absent-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the selfservice-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/selfservice/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/selfservice/selfservice-member-present.yml selfservice-member-present-copy.yml

3. Open the selfservice-member-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaselfservice task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the self-service rule to modify.
   • Set the attribute variable to surname.
   • Set the action variable to member.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Self-service member present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure selfservice "Users can manage their own name details" member attribute surname is present
       ipaselfservice:
         ipaadmin_password: Secret123
         name: "Users can manage their own name details"
         attribute:
         - surname
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory selfservice-member-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the selfservice-member-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/selfservice/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/selfservice/selfservice-member-absent.yml selfservice-member-absent-copy.yml

3. Open the selfservice-member-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaselfservice task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the self-service rule you want to modify.
   • Set the attribute variable to givenname and surname.
   • Set the action variable to member.
   • Set the state variable to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Self-service member absent
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure selfservice "Users can manage their own name details" member attributes givenname and surname are absent
       ipaselfservice:
         ipaadmin_password: Secret123
         name: "Users can manage their own name details"
         attribute:
         - givenname
         - surname
         action: member
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory selfservice-member-absent-copy.yml

Procedure

1. Create a directory for your Ansible configuration and playbooks in your home directory:

   $ mkdir ~/MyPlaybooks/

2. Change into the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks

3. Create the ~/MyPlaybooks/ansible.cfg file with the following content:

   [defaults]
   inventory = /home/<username>/MyPlaybooks/inventory
   
   [privilege_escalation]
   become=True

4. Create the ~/MyPlaybooks/inventory file with the following content:

   [eu]
   server.idm.example.com
   
   [us]
   replica.idm.example.com
   
   [ipaserver:children]
   eu
   us

   This configuration defines two host groups, eu and us, for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the delegation-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/delegation/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/delegation/delegation-present.yml delegation-present-copy.yml

3. Open the delegation-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipadelegation task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the new delegation rule.
   • Set the permission variable to a comma-separated list of permissions to grant: read and write.
   • Set the attribute variable to a list of attributes the delegated user group can manage: businesscategory, departmentnumber, employeenumber, and employeetype.
   • Set the group variable to the name of the group that is being given access to view or modify attributes.
   • Set the membergroup variable to the name of the group whose attributes can be viewed or modified.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage a delegation rule
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure delegation "basic manager attributes" is present
       ipadelegation:
         ipaadmin_password: Secret123
         name: "basic manager attributes"
         permission: read, write
         attribute:
         - businesscategory
         - departmentnumber
         - employeenumber
         - employeetype
         group: managers
         membergroup: employees

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/MyPlaybooks/inventory delegation-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks>/

2. Make a copy of the delegation-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/delegation/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/delegation/delegation-present.yml delegation-absent-copy.yml

3. Open the delegation-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipadelegation task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the delegation rule.
   • Set the state variable to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Delegation absent
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure delegation "basic manager attributes" is absent
       ipadelegation:
         ipaadmin_password: Secret123
         name: "basic manager attributes"
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/MyPlaybooks/inventory delegation-absent-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the delegation-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/delegation/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/delegation/delegation-member-present.yml delegation-member-present-copy.yml

3. Open the delegation-member-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipadelegation task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the delegation rule to modify.
   • Set the attribute variable to departmentnumber.
   • Set the action variable to member.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Delegation member present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present
       ipadelegation:
         ipaadmin_password: Secret123
         name: "basic manager attributes"
         attribute:
         - departmentnumber
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/MyPlaybooks/inventory delegation-member-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the delegation-member-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/delegation/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/delegation/delegation-member-absent.yml delegation-member-absent-copy.yml

3. Open the delegation-member-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipadelegation task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the delegation rule to modify.
   • Set the attribute variable to employeenumber and employeetype.
   • Set the action variable to member.
   • Set the state variable to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Delegation member absent
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent
       ipadelegation:
         ipaadmin_password: Secret123
         name: "basic manager attributes"
         attribute:
         - employeenumber
         - employeetype
         action: member
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/MyPlaybooks/inventory delegation-member-absent-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-member-user-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-user-present.yml role-member-user-present-copy.yml

3. Open the role-member-user-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the new role.
   • Set the privilege list to the names of the IdM privileges that you want to include in the new role.
   • Optionally, set the user variable to the name of the user to whom you want to grant the new role.
   • Optionally, set the group variable to the name of the group to which you want to grant the new role.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: user_and_host_administrator
         user: idm_user01
         group: idm_group01
         privilege:
         - Group Administrators
         - User Administrators
         - Stage User Administrators
         - Group Administrators

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-member-user-present-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-is-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-is-absent.yml role-is-absent-copy.yml

3. Open the role-is-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the role.
   • Ensure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: user_and_host_administrator
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-is-absent-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-member-group-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-group-present.yml role-member-group-present-copy.yml

3. Open the role-member-group-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the role you want to assign.
   • Set the group variable to the name of the group.
   • Set the action variable to member.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: helpdesk
         group: junior_sysadmins
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-member-group-present-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-member-user-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-user-absent.yml role-member-user-absent-copy.yml

3. Open the role-member-user-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the role you want to assign.
   • Set the user list to the names of the users.
   • Set the action variable to member.
   • Set the state variable to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: helpdesk
         user
         - user_01
         - user_02
         action: member
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-member-user-absent-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-member-service-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-service-present-absent.yml role-member-service-present-copy.yml

3. Open the role-member-service-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the role you want to assign.
   • Set the service list to the name of the service.
   • Set the action variable to member.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: web_administrator
         service:
         - HTTP/client01.idm.example.com
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-member-service-present-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-member-host-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-host-present.yml role-member-host-present-copy.yml

3. Open the role-member-host-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the role you want to assign.
   • Set the host list to the name of the host.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: web_administrator
         host:
         - client01.idm.example.com
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-member-host-present-copy.yml

Procedure

1. Navigate to the ~/<MyPlaybooks>/ directory:

   $ cd ~/<MyPlaybooks>/

2. Make a copy of the role-member-hostgroup-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/role/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/role/role-member-hostgroup-present.yml role-member-hostgroup-present-copy.yml

3. Open the role-member-hostgroup-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the iparole task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the role you want to assign.
   • Set the hostgroup list to the name of the hostgroup.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to manage IPA role with members.
     hosts: ipaserver
     become: yes
     gather_facts: no
   
     tasks:
     - iparole:
         ipaadmin_password: Secret123
         name: web_administrator
         hostgroup:
         - web_servers
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i ~/<MyPlaybooks>/inventory role-member-hostgroup-present-copy.yml

1. Create a privilege with no permissions attached.
2. Add permissions of your choice to the privilege.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the privilege-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-present.yml privilege-present-copy.yml

3. Open the privilege-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaprivilege task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the new privilege, full_host_administration.
   • Optionally, describe the privilege using the description variable.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Privilege present example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure privilege full_host_administration is present
       ipaprivilege:
         ipaadmin_password: Secret123
         name: full_host_administration
         description: This privilege combines all IdM permissions related to host administration

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory privilege-present-copy.yml

1. Create a privilege with no permissions attached.
2. Add permissions of your choice to the privilege.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the privilege-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-member-present.yml privilege-member-present-copy.yml

3. Open the privilege-member-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaprivilege task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the privilege.
   • Set the permission list to the names of the permissions that you want to include in the privilege.
   • Make sure that the action variable is set to member.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Privilege member present example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that permissions are present for the "full_host_administration" privilege
       ipaprivilege:
         ipaadmin_password: Secret123
         name: full_host_administration
         permission:
         - "System: Add krbPrincipalName to a Host"
         - "System: Enroll a Host"
         - "System: Manage Host Certificates"
         - "System: Manage Host Enrollment Password"
         - "System: Manage Host Keytab"
         - "System: Manage Host Principals"
         - "Retrieve Certificates from the CA"
         - "Revoke Certificate"
         - "System: Add Hosts"
         - "System: Add krbPrincipalName to a Host"
         - "System: Enroll a Host"
         - "System: Manage Host Certificates"
         - "System: Manage Host Enrollment Password"
         - "System: Manage Host Keytab"
         - "System: Manage Host Keytab Permissions"
         - "System: Manage Host Principals"
         - "System: Manage Host SSH Public Keys"
         - "System: Manage Service Keytab"
         - "System: Manage Service Keytab Permissions"
         - "System: Modify Hosts"
         - "System: Remove Hosts"
         - "System: Add Hostgroups"
         - "System: Modify Hostgroup Membership"
         - "System: Modify Hostgroups"
         - "System: Remove Hostgroups"

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory privilege-member-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the privilege-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-member-absent.yml privilege-member-absent-copy.yml

3. Open the privilege-member-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaprivilege task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the privilege.
   • Set the permission list to the names of the permissions that you want to remove from the privilege.
   • Make sure that the action variable is set to member.
   • Make sure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Privilege absent example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that the "Request Certificate ignoring CA ACLs" permission is absent from the "Certificate Administrators" privilege
       ipaprivilege:
         ipaadmin_password: Secret123
         name: Certificate Administrators
         permission:
         - "Request Certificate ignoring CA ACLs"
         action: member
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory privilege-member-absent-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the privilege-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-present.yml rename-privilege.yml

3. Open the rename-privilege.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaprivilege task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the current name of the privilege.
   • Add the rename variable and set it to the new name of the privilege.
   • Add the state variable and set it to renamed.

5. Rename the playbook itself, for example:

   ---
   - name: Rename a privilege
     hosts: ipaserver
     become: true

6. Rename the task in the playbook, for example:

   [...]
   tasks:
   - name: Ensure the full_host_administration privilege is renamed to limited_host_administration
     ipaprivilege:
     [...]

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Rename a privilege
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure the full_host_administration privilege is renamed to limited_host_administration
       ipaprivilege:
         ipaadmin_password: Secret123
         name: full_host_administration
         rename: limited_host_administration
         state: renamed

7. Save the file.

8. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory rename-privilege.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the privilege-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/privilege/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/privilege/privilege-absent.yml privilege-absent-copy.yml

3. Open the privilege-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipaprivilege task section:

   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the privilege you want to remove.
   • Make sure that the state variable is set it to absent.

5. Rename the task in the playbook, for example:

   [...]
   tasks:
   - name: Ensure privilege "CA administrator" is absent
     ipaprivilege:
     [...]

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Privilege absent example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure privilege "CA administrator" is absent
       ipaprivilege:
         ipaadmin_password: Secret123
         name: CA administrator
         state: absent

6. Save the file.

7. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory privilege-absent-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the permission-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-present.yml permission-present-copy.yml

3. Open the permission-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipapermission task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the permission.
   • Set the object_type variable to host.
   • Set the right variable to all.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Permission present example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that the "MyPermission" permission is present
       ipapermission:
         ipaadmin_password: Secret123
         name: MyPermission
         object_type: host
         right: all

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory permission-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the permission-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-present.yml permission-present-with-attribute.yml

3. Open the permission-present-with-attribute.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipapermission task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the permission.
   • Set the object_type variable to host.
   • Set the right variable to all.
   • Set the attrs variable to description.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Permission present example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that the "MyPermission" permission is present with an attribute
       ipapermission:
         ipaadmin_password: Secret123
         name: MyPermission
         object_type: host
         right: all
         attrs: description

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory permission-present-with-attribute.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the permission-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-absent.yml permission-absent-copy.yml

3. Open the permission-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipapermission task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the permission.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Permission absent example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that the "MyPermission" permission is absent
       ipapermission:
         ipaadmin_password: Secret123
         name: MyPermission
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory permission-absent-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the permission-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-member-present.yml permission-member-present-copy.yml

3. Open the permission-member-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipapermission task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the permission.
   • Set the attrs list to the description and gecos variables.
   • Make sure the action variable is set to member.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Permission member present example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that the "gecos" and "description" attributes are present in "MyPermission"
       ipapermission:
         ipaadmin_password: Secret123
         name: MyPermission
         attrs:
         - description
         - gecos
         action: member

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory permission-member-present-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the permission-member-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-member-absent.yml permission-member-absent-copy.yml

3. Open the permission-member-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipapermission task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the permission.
   • Set the attrs variable to description.
   • Set the action variable to member.
   • Make sure the state variable is set to absent

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Permission absent example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure that an attribute is not a member of "MyPermission"
       ipapermission:
         ipaadmin_password: Secret123
         name: MyPermission
         attrs: description
         action: member
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory permission-member-absent-copy.yml

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Make a copy of the permission-renamed.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-renamed.yml permission-renamed-copy.yml

3. Open the permission-renamed-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipapermission task section:

   • Adapt the name of the task to correspond to your use case.
   • Set the ipaadmin_password variable to the password of the IdM administrator.
   • Set the name variable to the name of the permission.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Permission present example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Rename the "MyPermission" permission
       ipapermission:
         ipaadmin_password: Secret123
         name: MyPermission
         rename: MyNewPermission
         state: renamed

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory permission-renamed-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegment.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegment.yml add-topologysegment-copy.yml

3. Open the add-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
   • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.
   • Ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
     become: true
   
     tasks:
   - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: Secret123
         suffix: domain
         left: server.idm.example.com
         right: replica.idm.example.com
         state: present

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory add-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegments.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml

3. Open the add-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Set the ipaadmin_password variable to the password of the IdM admin.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     become: true
     gather_facts: false
   
     vars:
       ipaadmin_password: Secret123
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     tasks:
     - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: present
         #state: absent
         #state: checked
         #state: reinitialized
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory add-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the check-topologysegments.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/check-topologysegments.yml check-topologysegments-copy.yml

3. Open the check-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Set the ipaadmin_password variable to the password of the IdM admin.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on the type of segment you are adding.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the check-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     become: true
     gather_facts: false
   
     vars:
       ipaadmin_password: Secret123
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com, right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     tasks:
     - name: Check topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: checked
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory check-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the verify-topologysuffix.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/ verify-topologysuffix.yml verify-topologysuffix-copy.yml

3. Open the verify-topologysuffix-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipatopologysuffix section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to domain. If you are verifying the presence of the ca suffix, set the variable to ca.
   • Ensure that the state variable is set to verified. No other option is possible.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysuffix
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Verify topology suffix
       ipatopologysuffix:
         ipaadmin_password: Secret123
         suffix: domain
         state: verified

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory verify-topologysuffix-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the reinitialize-topologysegment.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/reinitialize-topologysegment.yml reinitialize-topologysegment-copy.yml

3. Open the reinitialize-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to domain. If you are reinitializing the ca data, set the variable to ca.
   • Set the left variable to the left node of the replication agreement.
   • Set the right variable to the right node of the replication agreement.
   • Set the direction variable to the direction of the reinitializing data. The left-to-right direction means that data flows from the left node to the right node.

   • Ensure that the state variable is set to reinitialized.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Playbook to handle topologysegment
       hosts: ipaserver
       become: true
     
       tasks:
       - name: Reinitialize topology segment
         ipatopologysegment:
           ipaadmin_password: Secret123
           suffix: domain
           left: server.idm.example.com
           right: replica.idm.example.com
           direction: left-to-right
           state: reinitialized

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory reinitialize-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the delete-topologysegment.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/delete-topologysegment.yml delete-topologysegment-copy.yml

3. Open the delete-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to domain. Alternatively, if you are ensuring that the ca data are not replicated between the left and right nodes, set the variable to ca.
   • Set the left variable to the name of the IdM server that is the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that is the right node of the replication agreement.
   • Ensure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
     become: true
   
     tasks:
   - name: Delete topology segment
       ipatopologysegment:
         ipaadmin_password: Secret123
         suffix: domain
         left: replica01.idm.example.com
         right: replica02.idm.example.com:
         state: absent

5. Save the file.

6. Run the Ansible playbook specifying the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory delete-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-present.yml server-present-copy.yml

3. Open the server-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to the FQDN of the server. The FQDN of the example server is server123.idm.example.com.

   ---
   - name: Server present example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server server123.idm.example.com is present
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-present-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-absent.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-absent.yml server-absent-copy.yml

3. Open the server-absent-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to the FQDN of the server. The FQDN of the example server is server123.idm.example.com.
   • Ensure that the state variable is set to absent.

   ---
   - name: Server absent example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server server123.idm.example.com is absent
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         state: absent

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-absent-copy.yml

6. Make sure all name server (NS) DNS records pointing to server123.idm.example.com are deleted from your DNS zones. This applies regardless of whether you use integrated DNS managed by IdM or external DNS.

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-absent-ignore-last-of-role.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-absent-ignore-last-of-role.yml server-absent-ignore-last-of-role-copy.yml

3. Open the server-absent-ignore-last-of-role-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to the FQDN of the server. The FQDN of the example server is server123.idm.example.com.
   • Ensure that the ignore_last_of_role variable is set to yes.
   • Set the state variable to absent.

   ---
   - name: Server absent with last of role skip example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server “server123.idm.example.com” is absent with last of role skip
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         ignore_last_of_role: yes
         state: absent

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-absent-ignore-last-of-role-copy.yml

6. Make sure all name server (NS) DNS records that point to server123.idm.example.com are deleted from your DNS zones. This applies regardless of whether you use integrated DNS managed by IdM or external DNS.

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-absent-ignore_topology_disconnect.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-absent-ignore_topology_disconnect.yml server-absent-ignore_topology_disconnect-copy.yml

3. Open the server-absent-ignore_topology_disconnect-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to the FQDN of the server. The FQDN of the example server is server123.idm.example.com.
   • Ensure that the ignore_topology_disconnect variable is set to yes.
   • Ensure that the state variable is set to absent.

   ---
   - name: Server absent with ignoring topology disconnects example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server “server123.idm.example.com” with ignoring topology disconnects
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         ignore_topology_disconnect: yes
         state: absent

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-absent-ignore_topology_disconnect-copy.yml

6. [Optional] Make sure all name server (NS) DNS records pointing to server123.idm.example.com are deleted from your DNS zones. This applies regardless of whether you use integrated DNS managed by IdM or external DNS.

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-hidden.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-hidden.yml server-hidden-copy.yml

3. Open the server-hidden-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to the FQDN of the server. The FQDN of the example server is server123.idm.example.com.
   • Ensure that the hidden variable is set to True.

   ---
   - name: Server hidden example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server server123.idm.example.com is hidden
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         hidden: True

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-hidden-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-not-hidden.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-not-hidden.yml server-not-hidden-copy.yml

3. Open the server-not-hidden-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to the FQDN of the server. The FQDN of the example server is server123.idm.example.com.
   • Ensure that the hidden variable is set to no.

   ---
   - name: Server not hidden example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server server123.idm.example.com is not hidden
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         hidden: no

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-not-hidden-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-location.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-location.yml server-location-copy.yml

3. Open the server-location-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to server123.idm.example.com.
   • Set the location variable to germany.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Server enabled example
     hosts: ipaserver
     become: true
     tasks:
     - name: Ensure server server123.idm.example.com with location “germany” is present
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         location: germany

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-location-copy.yml

6. Connect to server123.idm.example.com as root using SSH:

   ssh root@server123.idm.example.com

7. Restart the named-pkcs11 service on the server for the updates to take effect immediately:

   [root@server123.idm.example.com ~]# systemctl restart named-pkcs11

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the server-no-location.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/server/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/server/server-no-location.yml server-no-location-copy.yml

3. Open the server-no-location-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipaserver task section and save the file:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to server123.idm.example.com.
   • Ensure that the location variable is set to ””.

   ---
   - name: Server no location example
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure server server123.idm.example.com is present with no location
       ipaserver:
         ipaadmin_password: Secret123
         name: server123.idm.example.com
         location: “”

5. Run the Ansible playbook and specify the playbook file and the inventory file:

   $ ansible-playbook -v -i inventory server-no-location-copy.yml

6. Connect to server123.idm.example.com as root using SSH:

   ssh root@server123.idm.example.com

7. Restart the named-pkcs11 service on the server for the updates to take effect immediately:

   [root@server123.idm.example.com ~]# systemctl restart named-pkcs11

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create an Ansible playbook file with the FQDN of the host whose presence in IdM you want to ensure. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/host/add-host.yml file:

   ---
   - name: Host present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Host host01.idm.example.com present
       ipahost:
         ipaadmin_password: MySecret123
         name: host01.idm.example.com
         state: present
         force: yes

3. Run the playbook:

   $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-host-is-present.yml