Skip to content
Snippets Groups Projects
Select Git revision
  • 3f785bc0e9fe1ab3ad874ce4f26e6897189db8aa
  • master default protected
  • v1.15.0
  • v1.14.7
  • v1.14.6
  • v1.14.5
  • v1.14.4
  • v1.14.3
  • v1.14.2
  • v1.14.1
  • v1.14.0
  • v1.13.2
  • v1.13.1
  • v1.13.0
  • v1.12.1
  • v1.12.0
  • v1.11.1
  • v1.11.0
  • v1.10.0
  • v1.9.2
  • v1.9.1
  • v1.9.0
22 results

README-user.md

Blame
  • README-idrange.md 6.16 KiB

    Idrange module

    Description

    The idrange module allows the management of ID ranges.

    In general it is not necessary to modify or delete ID ranges. If there is no other way to achieve a certain configuration than to modify or delete an ID range it should be done with great care. Because UIDs are stored in the file system and are used for access control it might be possible that users are allowed to access files of other users if an ID range got deleted and reused for a different domain.

    Use cases

    • Add an ID range from a transitively trusted domain

    If the trusted domain (A) trusts another domain (B) as well and this trust is transitive 'ipa trust-add domain-A' will only create a range for domain A. The ID range for domain B must be added manually.

    • Add an additional ID range for the local domain

    If the ID range of the local domain is exhausted, i.e. no new IDs can be assigned to Posix users or groups by the DNA plugin, a new range has to be created to allow new users and groups to be added. (Currently there is no connection between this range CLI and the DNA plugin, but a future version might be able to modify the configuration of the DNS plugin as well).

    Features

    • ID Range management

    Supported FreeIPA Versions

    FreeIPA versions 4.4.0 and up are supported by the ipaidrange module.

    Requirements

    Controller

    • Ansible version: 2.8+

    Node

    • Supported FreeIPA version (see above)

    Usage

    Example inventory file

    [ipaserver]
    ipaserver.test.local

    Example playbook to ensure a local domain idrange is present:

    ---
    - name: Playbook to manage IPA idrange.
      hosts: ipaserver
      become: no
    
      tasks:
      - name: Ensure an ID Range for the local domain is present.
        ipaidrange:
          ipaadmin_password: SomeADMINpassword
          name: local_domain_id_range
          base_id: 150000
          range_size: 200000

    Example playbook to ensure a local domain idrange is present, with RID and secondary RID base values:

    ---
    - name: Playbook to manage IPA idrange.
      hosts: ipaserver
      become: no
    
      tasks:
      - name: Ensure local idrange is present
        ipaidrange:
          ipaadmin_password: SomeADMINpassword
          name: local_domain_id_range
          base_id: 150000000
          range_size: 200000
          rid_base: 1000000
          secondary_rid_base: 200000000

    Example playbook to ensure an AD-trust idrange is present, with range type 'trust-ad' and using domain SID:

    ---
    - name: Playbook to manage IPA idrange.
      hosts: ipaserver
      become: no
    
      tasks:
      - name: Ensure AD-trust idrange is present
        ipaidrange:
          ipaadmin_password: SomeADMINpassword
          name: ad_id_range
          base_id: 150000000
          range_size: 200000
          idrange_type: ipa-ad-trust
          dom_sid: S-1-5-21-2870384104-3340008087-3140804251

    Example playbook to ensure an AD-trust idrange is present, with range type 'trust-ad-posix' and using domain SID:

    ---
    - name: Playbook to manage IPA idrange.
      hosts: ipaserver
      become: no
    
      tasks:
      - name: Ensure AD-trust idrange is present
        ipaidrange:
          name: ad_posix_id_range
          base_id: 150000000
          range_size: 200000
          idrange_type: ipa-ad-trust-posix
          dom_name: ad.ipa.test

    Example playbook to ensure an AD-trust idrange has auto creation of groups set to 'hybrid':