roles/ipaclient/library/ipaclient_setup_automount.py

@@ -68,7 +68,8 @@ RETURN = '''
 
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.ansible_ipa_client import (
-    setup_logging, check_imports, options, configure_automount
+    setup_logging, check_imports, options, configure_automount, sysrestore,
+    paths, getargspec
 )
 
 
@@ -94,10 +95,23 @@ def main():
     options.automount_location = module.params.get('automount_location')
     options.location = options.automount_location
 
+    changed = False
     if options.automount_location:
-        configure_automount(options)
+        changed = True
+        argspec = getargspec(configure_automount)
+        if len(argspec.args) > 1:
+            fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE)
+            statestore = sysrestore.StateFile(paths.IPA_CLIENT_SYSRESTORE)
 
-    module.exit_json(changed=True)
+            configure_automount(options, statestore)
+
+            # Reload the state as automount install may have modified it
+            fstore._load()
+            statestore._load()
+        else:
+            configure_automount(options)
+
+    module.exit_json(changed=changed)
 
 
 if __name__ == '__main__':

roles/ipaserver/library/ipaserver_set_ds_password.py

@@ -131,7 +131,8 @@ from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.ansible_ipa_server import (
     check_imports,
     MAX_DOMAIN_LEVEL, AnsibleModuleLog, options, sysrestore, paths,
-    api_Backend_ldap2, ds_init_info, redirect_stdout, setup_logging
+    api_Backend_ldap2, ds_init_info, redirect_stdout, setup_logging,
+    krbinstance, service
 )
 
 
@@ -221,6 +222,16 @@ def main():
     with redirect_stdout(ansible_log):
         ds.change_admin_password(options.admin_password)
 
+    # Force KDC to refresh the cached value of ipaKrbAuthzData by restarting.
+    # ipaKrbAuthzData has to be set with "MS-PAC" to trigger PAC generation,
+    # which is required to handle S4U2Proxy with the Bronze-Bit fix.
+    # Not doing so would cause API malfunction for around a minute, which is
+    # long enough to cause the hereafter client installation to fail.
+    krb = krbinstance.KrbInstance(fstore)
+    krb.set_output(ansible_log)
+    service.print_msg("Restarting the KDC")
+    krb.restart()
+
     # done ##########################################################
 
     ansible_module.exit_json(changed=True)