- Jun 21, 2019
-
-
Thomas Woerner authored
This has not been done so far in the ansible_ipa_client, but only in the modules where it was really needed. But as these places are getting more with 4.7.90, this setting makes it into the module_utils.
-
- Jun 17, 2019
-
-
Thomas Woerner authored
To make sure that there will be no issue with undefined output from ipareplica_test, the default(omit) has been added.
-
Thomas Woerner authored
The variable has been ignored and was not used. The servers are now properly set from ipareplica_servers now.
-
Thomas Woerner authored
The module ipareplica_master_password has been a copy from ipaserver role and still contained code to read the cache file. This is not needed for the replica. Therefore there is no need also to provide the dm password to ipareplica_master_password any more.
-
Thomas Woerner authored
Currently the error message of ipaclient_get_otp is not visble if it failed due to the use of no_log. The no_log option is needed and useful if the one-time password has successfully been generated, but is bad if there was an error while generating the password, for example if a clock skew has been detected. There is now a new task to print the error message if ipaclient_get_otp. The task for ipaclient_get_otp has been marked with "ignore_errors: yes" and the new task "Install - Report error for OTP generation" will always fail and only be used if result_ipaclient_get_otp is failed.
-
Thomas Woerner authored
The check for the ipaadmin_keytab was not using "is defined". Because of this the playbook processing failed if the variable was not defined.
-
Thomas Woerner authored
-
Thomas Woerner authored
-
- Jun 14, 2019
-
-
Thomas Woerner authored
Fixes #87 (ipareplica README seems to have incorrect info)
-
Thomas Woerner authored
-
Thomas Woerner authored
-
Thomas Woerner authored
-
Thomas Woerner authored
-
Thomas Woerner authored
-
Thomas Woerner authored
This is for example the case if ipaadmin_keytab is used instead without ipaclient_use_otp.
-
Thomas Woerner authored
ipaadmin_keytab has been supported only with with ipaclient_use_otp. But it can also be used without for ipa-join. Important is that ipaadmin_keytab needs to be placed on the cliend node and ipaadmin_keytab needs to be a full path. Otherwise the file will not be found.
-
Thomas Woerner authored
Password and keytab do not need to be set explicitely to an empty string when they are not set. Also there is no need to have string length checks in the role tasks.
-
- Jun 12, 2019
-
-
Thomas Woerner authored
With the deactivation of the Python2/3 test the handling of ansible_python_interpreter needs to be removed as the setting might not exist and is not changed in with the Python2/3 test any more.
-
Thomas Woerner authored
This is a remain of the Python2 version and has been fixed. Fixed: #86 (AttributeError: 'str' object has no attribute 'decode')
-
- Jun 07, 2019
-
-
Thomas Woerner authored
The code for host_name, the domain_name and also the realm_name has been adapted to the code in the command line installer. The _hostname_overridden setting is now only true if the hostname has been changed.
-
Thomas Woerner authored
The install checks have been done temporarily in _test and finally also in _prepare. This is not needed and also not done this way in the command line installers.
-
Thomas Woerner authored
This makes AnsibleModuleLog compatible to the version in ipareplica role.
-
Thomas Woerner authored
The addtion is not oly adding the config setting, but also fixing the deployment without the setting as functions and methods have been changed for pki_config_override. There is a new setting for the ipaserver role: ipaserver_pki_config_override
-
Thomas Woerner authored
tasks.restore_context is only used in old releases. The existence of paths.CACHE_IPA_SESSIONS is used to determine if the call needs to be done or not.
-
Thomas Woerner authored
The section is not used since a long time any more and can therefore be removed.
-
Thomas Woerner authored
Run validate_hostname to check for valid host name if constants.MAXHOSTNAMELEN is defined. The call has not been used in older FreeIPA versions.
-
- Jun 05, 2019
-
-
Thomas Woerner authored
ansible-freeipa is a new Ansible Collection introduced with Ansible 2.8 and Ansible Galaxy 3.2.
-
Thomas Woerner authored
This will result in a better role documentation on galaxy.
-
- Jun 04, 2019
-
-
David Sastre Medina authored
The use of squash_actions to invoke a package module, such as “yum”, to only invoke the module once is deprecated, and will be removed in Ansible 2.11. Instead of relying on implicit squashing, tasks should instead supply the list directly to the name, pkg or package parameter of the module. See [1] for a reference to the upstream documentation. The ipa-krb5 and ipa-sssd modules include *_packages variables in both defaults/ and vars/, additionally, the list of packages in ipa-sssd differs from one to the other. Unify list of packages into vars/ [1]: https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_2.7.html#using-a-loop-on-a-package-module-via-squash-actions
-
Thomas Woerner authored
This test is not properly working with EL-8 nodes as the default system python is not located in /usr/bin. Additionally Ansible 2.8 is able to detect the default python version on the system. As the installation base for IPA 4.5.90 where the Python 3 bindings have not been working properly should be really small or not existing any more the deactivation of this test should be fine.
-
Thomas Woerner authored
The result from ipareplica_test should be used to enable freeipa-trust in the firewall.
-
- May 31, 2019
-
-
Thomas Woerner authored
The hidden replica support introduced some incompatible changes to replica deployment. The methods find_providing_server and find_providing_serves have been moved from ipaserver.install.service to ipaserver.masters. Additionally the host_name argument for find_providing_server is a list now. This breaks existing ipareplica Ansible modules ipareplica_prepare and ipareplica_enable_ipa.
-
Thomas Woerner authored
The freeipa-trust service has not been added if adtrust was enabled. For ipareplica the addition of freeipa-replication has been removed as the used port is not used anymore since some time. Fixes: #83 (when installing with ipaserver_setup_adtrust: true the firewalld service freeipa-trust is not added)
-
Thomas Woerner authored
Replication agreements are not removed with the command line tools.
-
Thomas Woerner authored
This calms down ansible-lint in Ansible galaxy.
-
Thomas Woerner authored
-
Thomas Woerner authored
sstore and fstore have been set twice.
-
Thomas Woerner authored
-
Thomas Woerner authored
This fixes the type warnings while deploying server and replica.
-
Thomas Woerner authored
The generated OTP password is stored into ipaadmin_password. The original password is now saved and restored later on again. This fixes the failure with incorrect password while installing the client part in a replica deployment.
-