initial commit

roles/identity_ad/tasks/main.yml

@@ -0,0 +1,89 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [identity_ad, always]
+
+- name: Install AD integration packages
+  ansible.builtin.package:
+    name: "{{ identity_ad_packages }}"
+    state: present
+  tags: [identity_ad]
+
+- name: Check whether host is already domain-joined
+  ansible.builtin.command: realm list
+  register: identity_ad_realm_status
+  changed_when: false
+  failed_when: false
+  tags: [identity_ad]
+
+- name: Join Active Directory domain
+  ansible.builtin.command: >
+    realm join --user={{ ad_join_username }}
+    --computer-ou="{{ ad_ou }}"
+    {{ ad_domain }}
+  args:
+    stdin: "{{ ad_join_password }}"
+  when: ad_domain not in identity_ad_realm_status.stdout
+  changed_when: true
+  no_log: true
+  tags: [identity_ad]
+
+- name: Deploy sssd.conf
+  ansible.builtin.template:
+    src: sssd.conf.j2
+    dest: /etc/sssd/sssd.conf
+    owner: root
+    group: root
+    mode: "0600"
+  notify: restart sssd
+  tags: [identity_ad]
+
+- name: Enable oddjobd (required for pam_mkhomedir, RedHat family)
+  ansible.builtin.systemd:
+    name: oddjobd
+    enabled: true
+    state: started
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [identity_ad]
+
+- name: Enable automatic home directory creation (RedHat family)
+  ansible.builtin.command: authselect enable-feature with-mkhomedir
+  register: identity_ad_authselect_result
+  changed_when: "'already enabled' not in identity_ad_authselect_result.stderr"
+  failed_when: false
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [identity_ad]
+
+- name: Check whether pam_mkhomedir is already enabled (Debian family)
+  ansible.builtin.command: grep -q pam_mkhomedir.so /etc/pam.d/common-session
+  register: identity_ad_mkhomedir_check
+  changed_when: false
+  failed_when: false
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [identity_ad]
+
+- name: Enable automatic home directory creation (Debian family)
+  ansible.builtin.command: pam-auth-update --enable mkhomedir
+  when:
+    - ansible_facts['os_family'] == "Debian"
+    - identity_ad_mkhomedir_check.rc != 0
+  changed_when: true
+  tags: [identity_ad]
+
+- name: Enable and start sssd
+  ansible.builtin.systemd:
+    name: sssd
+    enabled: true
+    state: started
+  tags: [identity_ad]
+
+- name: Restrict login access to authorized AD groups
+  ansible.builtin.lineinfile:
+    path: /etc/sssd/sssd.conf
+    regexp: "^access_provider"
+    line: "access_provider = simple"
+  notify: restart sssd
+  tags: [identity_ad]