You've already forked ansible-linux-infra
90 lines
2.5 KiB
YAML
90 lines
2.5 KiB
YAML
---
|
|
- name: Include OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "default.yml"
|
|
tags: [identity_ad, always]
|
|
|
|
- name: Install AD integration packages
|
|
ansible.builtin.package:
|
|
name: "{{ identity_ad_packages }}"
|
|
state: present
|
|
tags: [identity_ad]
|
|
|
|
- name: Check whether host is already domain-joined
|
|
ansible.builtin.command: realm list
|
|
register: identity_ad_realm_status
|
|
changed_when: false
|
|
failed_when: false
|
|
tags: [identity_ad]
|
|
|
|
- name: Join Active Directory domain
|
|
ansible.builtin.command: >
|
|
realm join --user={{ ad_join_username }}
|
|
--computer-ou="{{ ad_ou }}"
|
|
{{ ad_domain }}
|
|
args:
|
|
stdin: "{{ ad_join_password }}"
|
|
when: ad_domain not in identity_ad_realm_status.stdout
|
|
changed_when: true
|
|
no_log: true
|
|
tags: [identity_ad]
|
|
|
|
- name: Deploy sssd.conf
|
|
ansible.builtin.template:
|
|
src: sssd.conf.j2
|
|
dest: /etc/sssd/sssd.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
notify: restart sssd
|
|
tags: [identity_ad]
|
|
|
|
- name: Enable oddjobd (required for pam_mkhomedir, RedHat family)
|
|
ansible.builtin.systemd:
|
|
name: oddjobd
|
|
enabled: true
|
|
state: started
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
tags: [identity_ad]
|
|
|
|
- name: Enable automatic home directory creation (RedHat family)
|
|
ansible.builtin.command: authselect enable-feature with-mkhomedir
|
|
register: identity_ad_authselect_result
|
|
changed_when: "'already enabled' not in identity_ad_authselect_result.stderr"
|
|
failed_when: false
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
tags: [identity_ad]
|
|
|
|
- name: Check whether pam_mkhomedir is already enabled (Debian family)
|
|
ansible.builtin.command: grep -q pam_mkhomedir.so /etc/pam.d/common-session
|
|
register: identity_ad_mkhomedir_check
|
|
changed_when: false
|
|
failed_when: false
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags: [identity_ad]
|
|
|
|
- name: Enable automatic home directory creation (Debian family)
|
|
ansible.builtin.command: pam-auth-update --enable mkhomedir
|
|
when:
|
|
- ansible_facts['os_family'] == "Debian"
|
|
- identity_ad_mkhomedir_check.rc != 0
|
|
changed_when: true
|
|
tags: [identity_ad]
|
|
|
|
- name: Enable and start sssd
|
|
ansible.builtin.systemd:
|
|
name: sssd
|
|
enabled: true
|
|
state: started
|
|
tags: [identity_ad]
|
|
|
|
- name: Restrict login access to authorized AD groups
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/sssd/sssd.conf
|
|
regexp: "^access_provider"
|
|
line: "access_provider = simple"
|
|
notify: restart sssd
|
|
tags: [identity_ad]
|