install.yml

---
# tasks file for ipaclient

- name: Install - Ensure that IPA client packages are installed
  package:
    name: "{{ item }}"
    state: present
  with_items: "{{ ipaclient_packages }}"
  when: ipaclient_install_packages | bool

- name: Install - Include Python2/3 import test
  import_tasks: "{{role_path}}/tasks/python_2_3_test.yml"

- name: Install - Set ipaclient_servers
  set_fact:
    ipaclient_servers: "{{ groups['ipaservers'] | list }}"
  when: groups.ipaservers is defined and ipaclient_servers is not defined

- name: Install - Set ipaclient_servers from cluster inventory
  set_fact:
    ipaclient_servers: "{{ groups['ipaserver'] | list }}"
  when: ipaclient_no_dns_lookup | bool and groups.ipaserver is defined and ipaclient_servers is not defined

- name: Install - IPA discovery
  ipaclient_test:
    domain: "{{ ipaserver_domain | default(ipaclient_domain) | default(omit) }}"
    servers: "{{ ipaclient_servers | default(omit) }}"
    realm: "{{ ipaserver_realm | default(ipaclient_realm) | default(omit) }}"
    hostname: "{{ ipaclient_hostname | default(ansible_fqdn) }}"
    ca_cert_file: "{{ ipaclient_ca_cert_file | default(omit) }}"
    on_master: "{{ ipaclient_on_master }}"
    ntp_servers: "{{ ipaclient_ntp_servers | default([]) }}"
    ntp_pool: "{{ ipaclient_ntp_pool | default(omit) }}"
    no_ntp: "{{ ipaclient_no_ntp }}"
  register: result_ipaclient_test

- name: Install - Set default principal if no keytab is given
  set_fact:
    ipaadmin_principal: admin
  when: ipaadmin_principal is undefined and ipaclient_keytab is undefined

- name: Install - Cleanup leftover ccache
  file:
    path: "/etc/ipa/.dns_ccache"
    state: absent

- block:
  - name: Install - Configure NTP
    ipaclient_setup_ntp:
      ### basic ###
      ntp_servers: "{{ ipaclient_ntp_servers | default(omit) }}"
      ntp_pool: "{{ ipaclient_ntp_pool | default(omit) }}"
      no_ntp: "{{ ipaclient_no_ntp }}"
      #force_ntpd: "{{ ipaclient_force_ntpd }}"
      on_master: "{{ ipaclient_on_master }}"
      ### additional ###
      domain: "{{ result_ipaclient_test.domain }}"

  - name: Install - Test if IPA client has working krb5.keytab
    ipaclient_test_keytab:
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"
      realm: "{{ result_ipaclient_test.realm }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      kdc: "{{ result_ipaclient_test.kdc }}"
      kinit_attempts: "{{ ipaclient_kinit_attempts | default(omit) }}"
    register: result_ipaclient_test_keytab

  - name: Install - Disable One-Time Password for client with working krb5.keytab
    set_fact:
      ipaclient_use_otp: "no"
    when: ipaclient_use_otp | bool and result_ipaclient_test_keytab.krb5_keytab_ok and not ipaclient_force_join | bool


  # The following block is executed when using OTP to enroll IPA client
  # ie when ipaclient_use_otp is set.
  # It connects to ipaserver and add the host with --random option in order
  # to create a OneTime Password
  # If a keytab is specified in the hostent, then the hostent will be disabled
  # if ipaclient_use_otp is set.
  - block:
    - fail: msg="Keytab or password is required for otp"
      when: ipaadmin_keytab is undefined and ipaadmin_password is undefined

    - name: Install - Save client ansible_python_interpreter setting
      set_fact:
        ipaclient_ansible_python_interpreter: "{{ ansible_python_interpreter }}"

    - name: Install - Include Python2/3 import test
      import_tasks: "{{role_path}}/tasks/python_2_3_test.yml"
      delegate_to: "{{ result_ipaclient_test.servers[0] }}"

    - name: Install - Get One-Time Password for client enrollment
      #no_log: yes
      ipaclient_get_otp:
        state: present
        principal: "{{ ipaadmin_principal | default('admin') }}"
        password: "{{ ipaadmin_password | default(omit) }}"
        keytab: "{{ ipaadmin_keytab | default(omit) }}"
        fqdn: "{{ result_ipaclient_test.hostname }}"
        lifetime: "{{ ipaclient_lifetime | default(omit) }}"
        random: True
        ansible_python_interpreter: "{{ ansible_python_interpreter }}"
      register: result_ipaclient_get_otp
      # If the host is already enrolled, this command will exit on error
      # The error can be ignored
      failed_when: result_ipaclient_get_otp is failed and "Password cannot be set on enrolled host" not in result_ipaclient_get_otp.msg
      delegate_to: "{{ result_ipaclient_test.servers[0] }}"
      delegate_facts: True

    - name: Install - Store the previously obtained OTP
      no_log: yes
      set_fact:
        ipaadmin_password: "{{ result_ipaclient_get_otp.host.randompassword if result_ipaclient_get_otp.host is defined }}"

    - name: Install - Restore client ansible_python_interpreter setting
      set_fact:
        ansible_python_interpreter: "{{ ipaclient_ansible_python_interpreter }}"

    when: ipaclient_use_otp | bool

  - block:
    - name: Install - Check if principal and keytab are set
      fail: msg="Principal and keytab cannot be used together"
      when: ipaadmin_principal is defined and ipaadmin_principal != "" and ipaclient_keytab is defined and ipaclient_keytab != ""

    - name: Install - Check if one of password and keytab are set
      fail: msg="At least one of password or keytab must be specified"
      when: not result_ipaclient_test_keytab.krb5_keytab_ok and (ipaadmin_password is undefined or ipaadmin_password == "") and (ipaclient_keytab is undefined or ipaclient_keytab == "")
    when: not ipaclient_on_master | bool

  - name: Install - Purge {{ result_ipaclient_test.realm }} from host keytab
    command: >
      /usr/sbin/ipa-rmkeytab
      -k /etc/krb5.keytab
      -r "{{ result_ipaclient_test.realm }}"
    register: result_ipa_rmkeytab
    # Do not fail on error codes 3 and 5:
    #   3 - Unable to open keytab
    #   5 - Principal name or realm not found in keytab
    failed_when: result_ipa_rmkeytab.rc != 0 and result_ipa_rmkeytab.rc != 3 and result_ipa_rmkeytab.rc != 5
    when: ipaclient_use_otp | bool or ipaclient_force_join | bool

  - name: Install - Backup and set hostname
    ipaclient_set_hostname:
      hostname: "{{ result_ipaclient_test.hostname }}"
    when: not ipaclient_on_master | bool

  - name: Install - Join IPA
    ipaclient_join:
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"
      realm: "{{ result_ipaclient_test.realm }}"
      kdc: "{{ result_ipaclient_test.kdc }}"
      basedn: "{{ result_ipaclient_test.basedn }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      force_join: "{{ ipaclient_force_join | default(omit) }}"
      principal: "{{ ipaadmin_principal if not ipaclient_use_otp | bool and ipaclient_keytab is not defined else '' }}"
      password: "{{ ipaadmin_password | default(omit) }}"
      keytab: "{{ ipaclient_keytab | default(omit) }}"
      #ca_cert_file: "{{ ipaclient_ca_cert_file | default(omit) }}"
      kinit_attempts: "{{ ipaclient_kinit_attempts | default(omit) }}"
    register: result_ipaclient_join
    when: not ipaclient_on_master | bool and (not result_ipaclient_test_keytab.krb5_keytab_ok or ipaclient_force_join)

  - block:
    - name: Install - End playbook processing
      file:
        path: "/etc/ipa/.dns_ccache"
        state: absent
    - fail:
        msg: "The krb5 configuration is not correct, please enable allow_repair to fix this."
      when: not result_ipaclient_test_keytab.krb5_conf_ok
    - fail:
        msg: "The IPA test failed, please enable allow_repair to fix this."
      when: not result_ipaclient_test_keytab.ping_test_ok
    - fail:
        msg: "The ca.crt file is missing, please enable allow_repair to fix this."
      when: not result_ipaclient_test_keytab.ca_crt_exists
    - meta: end_play
    when: not ipaclient_on_master | bool and not result_ipaclient_join.changed and not ipaclient_allow_repair | bool and (result_ipaclient_test_keytab.krb5_keytab_ok or (result_ipaclient_join.already_joined is defined and result_ipaclient_join.already_joined))

  - name: Install - Configure IPA default.conf
    include_role:
      name: ipaconf
    vars:
      ipaconf_server: "{{ result_ipaclient_test.servers[0] }}"
      ipaconf_domain: "{{ result_ipaclient_test.domain }}"
      ipaconf_realm: "{{ result_ipaclient_test.realm }}"
      ipaconf_hostname: "{{ result_ipaclient_test.hostname }}"
      ipaconf_basedn: "{{ result_ipaclient_test.basedn }}"
    when: not ipaclient_on_master | bool

  - name: Install - Configure SSSD
    ipaclient_setup_sssd:
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"
      realm: "{{ result_ipaclient_test.realm }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      services: ["ssh", "sudo"]
      krb5_offline_passwords: yes
      on_master: "{{ ipaclient_on_master }}"
      #primary: no
      #permit: no
      #dns_updates: no
      #all_ip_addresses: no

  - name: Install - Configure krb5 for IPA realm "{{ result_ipaclient_test.realm }} <= 4.4"
    include_role:
      name: ipa-krb5
    vars:
      krb5_servers: "{{ result_ipaclient_test.servers if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else [ ] }}"
      krb5_realm: "{{ result_ipaclient_test.realm }}"
      krb5_dns_lookup_realm: "{{ 'false' if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else 'true' }}"
      krb5_dns_lookup_kdc: "{{ 'false' if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else 'true' }}"
      krb5_default_domain: "{{ 'true' if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else 'false' }}"
      krb5_pkinit_anchors: "FILE:/etc/ipa/ca.crt"
    when: not ipaclient_on_master | bool and result_ipaclient_test.ipa_python_version <= 40400

  - name: Install - Configure krb5 for IPA realm "{{ result_ipaclient_test.realm }} > 4.4"
    include_role:
      name: ipa-krb5
    vars:
      krb5_servers: "{{ result_ipaclient_test.servers if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else [ ] }}"
      krb5_realm: "{{ result_ipaclient_test.realm }}"
      krb5_dns_lookup_realm: "{{ 'false' if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else 'true' }}"
      krb5_dns_lookup_kdc: "{{ 'false' if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else 'true' }}"
      krb5_default_domain: "{{ 'true' if not result_ipaclient_test.dnsok or not result_ipaclient_test.kdc else 'false' }}"
      krb5_dns_canonicalize_hostname: "false"
      krb5_pkinit_pool: "FILE:/var/lib/ipa-client/pki/ca-bundle.pem"
      krb5_pkinit_anchors: "FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem"
    when: not ipaclient_on_master | bool and result_ipaclient_test.ipa_python_version > 40400

  - name: Install - IPA API calls for remaining enrollment parts
    ipaclient_api:
      servers: "{{ result_ipaclient_test.servers }}"
      realm: "{{ result_ipaclient_test.realm }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      #debug: yes
    register: result_ipaclient_api

  - name: Install - Fix IPA ca
    ipaclient_fix_ca:
      servers: "{{ result_ipaclient_test.servers }}"
      realm: "{{ result_ipaclient_test.realm }}"
      basedn: "{{ result_ipaclient_test.basedn }}"
      allow_repair: "{{ ipaclient_allow_repair }}"
    when: not ipaclient_on_master | bool and result_ipaclient_test_keytab.krb5_keytab_ok and not result_ipaclient_test_keytab.ca_crt_exists

  - name: Install - Create IPA NSS database
    ipaclient_setup_nss:
      servers: "{{ result_ipaclient_test.servers }}"
      domain: "{{ result_ipaclient_test.domain }}"
      realm: "{{ result_ipaclient_test.realm }}"
      basedn: "{{ result_ipaclient_test.basedn }}"
      hostname: "{{ result_ipaclient_test.hostname }}"
      subject_base: "{{ result_ipaclient_api.subject_base }}"
      principal: "{{ ipaadmin_principal | default(omit) }}"
      mkhomedir: "{{ ipaclient_mkhomedir | default(omit) }}"
      ca_enabled: "{{ result_ipaclient_api.ca_enabled | default(omit) }}"
      on_master: "{{ ipaclient_on_master }}"

  - name: Install - Configure SSH and SSHD
    ipaclient_setup_ssh:
      servers: "{{ result_ipaclient_test.servers }}"
      sssd: "{{ result_ipaclient_test.sssd }}"
      ssh: "{{ not ipaclient_no_ssh }}"
      trust_sshfp: "{{ ipaclient_ssh_trust_dns }}"
      sshd: "{{ not ipaclient_no_sshd }}"

  - name: Install - Configure automount
    ipaclient_setup_automount:
      servers: "{{ result_ipaclient_test.servers }}"
      sssd: "{{ result_ipaclient_test.sssd }}"
      automount_location: "{{ ipaautomount_location | default(omit) }}"

  - name: Install - Configure firefox
    ipaclient_setup_firefox:
      firefox_dir: "{{ ipaclient_firefox_dir | default(omit) }}"
    when: ipaclient_configure_firefox | bool

  - name: Install - Configure NIS
    ipaclient_setup_nis:
      domain: "{{ result_ipaclient_test.domain }}"
      nisdomain: "{{ ipaclient_nisdomain | default(omit)}}"
    when: not ipaclient_no_nisdomain | bool

  always:
  - name: Cleanup leftover ccache
    file:
      path: "/etc/ipa/.dns_ccache"
      state: absent