diff --git a/ansible/playbooks/adhoc-ipabinder.yml b/ansible/playbooks/adhoc-ipabinder.yml new file mode 100644 index 0000000..7da5cd4 --- /dev/null +++ b/ansible/playbooks/adhoc-ipabinder.yml @@ -0,0 +1,41 @@ +--- +# This playbook is meant to be used with callable variables, like adhoc or AWX. +# What: Creates a binder account for read-only binds +# What is expected: +# -> ipa_binder_name: Bind account name, in the form of name_binder +# -> ipa_binder_password: Bind account password + +- name: Create binder account + hosts: ipaserver + become: true + + tasks: + - name: "Check for user variables" + assert: + that: + - ipa_binder_name | mandatory + - ipa_binder_password | mandatory + success_msg: "Required variables provided" + fail_msg: "We are missing user information" + + - name: "Creating bind account template - binder" + template: + src: "tmp/binder_template.update" + dest: "/tmp/binder.update" + owner: root + group: root + mode: '0600' + tags: + - users + + - name: "Adding in the bind account" + command: "/usr/sbin/ipa-ldap-updater /tmp/binder.update" + register: bind_account + changed_when: "bind_account.rc == 0" + tags: + - users + + - name: "Remove template" + file: + path: "/tmp/binder.update" + state: absent diff --git a/ansible/playbooks/templates/tmp/binder_template.update b/ansible/playbooks/templates/tmp/binder_template.update new file mode 100644 index 0000000..63a87ed --- /dev/null +++ b/ansible/playbooks/templates/tmp/binder_template.update @@ -0,0 +1,7 @@ +dn: uid={{ ipa_binder_name }},cn=sysaccounts,cn=etc,dc=rockylinux,dc=org +add:objectclass:account +add:objectclass:simplesecurityobject +add:uid:{{ ipa_binder_name }} +add:userPassword:{{ ipa_binder_password }} +add:passwordExpirationTime:20380119031407Z +add:nsIdleTimeout:0