ipaserver role

Description

This role allows to configure and IPA server.

Note: The ansible playbooks and role require a configured ansible environment where the ansible nodes are reachable and are properly set up to have an IP address and a working package manager.

Features

• Server deployment

Supported FreeIPA Versions

FreeIPA versions 4.5 and up are supported by the server role.

Supported Distributions

• RHEL/CentOS 7.6+
• Fedora 26+
• Ubuntu

Requirements

Controller * Ansible version: 2.8+

Node Supported FreeIPA version (see above) Supported distribution (needed for package installation only, see above)

Limitations

External signed CA

External signed CA is now supported. But the currently needed two step process is an issue for the processing in a simple playbook.

Work is planned to have a new method to handle CSR for external signed CAs in a separate step before starting the server installation.

Usage

Example inventory file with fixed domain and realm, setting up of the DNS server and using forwarders from /etc/resolv.conf:

[ipaserver]
ipaserver2.example.com

[ipaserver:vars]
ipaserver_domain=example.com
ipaserver_realm=EXAMPLE.COM
ipaserver_setup_dns=yes
ipaserver_auto_forwarders=yes

Example playbook to setup the IPA server using admin and dirman passwords from an Ansible Vault file:

- name: Playbook to configure IPA server
  hosts: ipaserver
  become: true
  vars_files:
  - playbook_sensitive_data.yml

  roles:
  - role: ipaserver
    state: present

Example playbook to unconfigure the IPA client(s) using principal and password from inventory file:

- name: Playbook to unconfigure IPA server
  hosts: ipaserver
  become: true

  roles:
  - role: ipaserver
    state: absent

Example inventory file with fixed domain, realm, admin and dirman passwords:

[ipaserver]
ipaserver.example.com

[ipaserver:vars]
ipaserver_domain=example.com
ipaserver_realm=EXAMPLE.COM
ipaadmin_password=MySecretPassword123
ipadm_password=MySecretPassword234

Example playbook to setup the IPA server using admin and dirman passwords from inventory file:

- name: Playbook to configure IPA server
  hosts: ipaserver
  become: true

  roles:
  - role: ipaserver
    state: present

Example playbook to setup the IPA primary with external signed CA using the previous inventory file:

Server installation step 1: Generate CSR, copy to controller as <ipaserver hostname>-ipa.csr

---
- name: Playbook to configure IPA server step1
  hosts: ipaserver
  become: true
  vars:
    ipaserver_external_ca: yes

  roles:
  - role: ipaserver
    state: present

  post_tasks:
  - name: Copy CSR /root/ipa.csr from node to "{{ groups.ipaserver[0] + '-ipa.csr' }}"
    fetch:
      src: /root/ipa.csr
      dest: "{{ groups.ipaserver[0] + '-ipa.csr' }}"
      flat: yes

Sign with CA: This is up to you

Server installation step 2: Copy <ipaserver hostname>-chain.crt to the IPA server and continue with installation of the primary.

- name: Playbook to configure IPA server step3
  hosts: ipaserver
  become: true
  vars:
    ipaserver_external_cert_files: "/root/chain.crt"

  pre_tasks:
  - name: Copy "{{ groups.ipaserver[0] + '-chain.crt' }}" to /root/chain.crt on node
    copy:
      src: "{{ groups.ipaserver[0] + '-chain.crt' }}"
      dest: "/root/chain.crt"
      force: yes

  roles:
  - role: ipaserver
    state: present

The files can also be copied automatically: Set ipaserver_copy_csr_to_controller to true in the server installation step 1 and set ipaserver_external_cert_files_from_controller to point to the chain.crt file in the server installation step 2.

Playbooks

The playbooks needed to deploy or undeploy a server are part of the repository in the playbooks folder. There are also playbooks to deploy and undeploy clusters.

install-server.yml
uninstall-server.yml

Please remember to link or copy the playbooks to the base directory of ansible-freeipa if you want to use the roles within the source archive.

How to setup a server

ansible-playbook -v -i inventory/hosts install-server.yml

This will deploy the server defined in the inventory file.

Variables

Base Variables

Server Variables

SSL certificate Variables

Client Variables

Certificate system Variables

DNS Variables

AD trust Variables

Special Variables

Authors

Thomas Woerner