-
Notifications
You must be signed in to change notification settings - Fork 234
FreeIPA Installation Using ansible freeipa
Thomas Woerner edited this page Jun 27, 2018
·
2 revisions
- Project goals
- IPA installers vs. ansible-freeipa
- IPA client installation steps
- Enrollment workflow with ipa-client-install vs. with ansible-freeipa
- IPA client OTP use case
- IPA client domain configuration with ipa-client-install vs. with ansible-freeipa
- IPA server installation steps
- IPA replica installation steps
- Examples of Ansible inventory files and playbooks
- Allow automation of FreeIPA installations and configuration using ansible-freeipa
- Same result using normal FreeIPA installers and ansible-freeipa
- ansible-freeipa can provide additional features
- Provide Ansible roles and modules for server, client and replica installations
- The replica installation is still work in progress and not part of the upstream repository yet
- Support FreeIPA 4.5+ for ipaserver, ipareplica and ipaclient roles
- Log in to every machine, start installation process manually
- Use either principal/password or keytab
- Wait till installation is done
- Simple installation on more than one machine
- One configuration file (inventory file) per domain or realm
- One place for configuration options
- Simple use of OTP for client installation and update, more secure: Admin password not transferred to the clients
- Advanced auto detection for clients
- Repair of broken client configurations with one known limitation:
- Missing /etc/krb5.keytab
- Domain discovery and validation of parameters
- Time synchronization (ntp, chrony)
- IPA enrollment (Creation of host entry and keytab)
- SSSD, PAM, NSS configuration
- Kerberos client configuration
- PKI configuration
- DNS configuration
- Full autodiscovery: No need to provide domain or realm
- Using DNS SRV/TXT records for ldap and kerberos
- Autodiscovery of IPA servers: Provide IPA domain
- Enhanced discovery: Provide only server
- No discovery: Provide server and domain
- Realm is usually derived from upper-cased name of the IPA domain, or can be forced to a different value
- Supported enrollment types
- OTP
- Admin principal and password
- Existing host keytab
# Example minimal inventory file using full auto-detection
[ipaclients]
ipaclient.ipadomain.com
# ipaclient_password can be provided by a Vault-protected file
| Variable | Description |
|---|---|
ipaservers |
Group of IPA server FQDN |
ipaclients |
Group of IPA client FQDN |
ipaadmin_keytab |
The path to the admin keytab used for alternative authentication |
ipaadmin_password |
The password for the kerberos admin principal |
ipaadmin_principal |
The authorized kerberos principal used to join the IPA realm |
ipaclient_domain |
The primary DNS domain of an existing IPA deployment |
ipaclient_realm |
The Kerberos realm of an existing IPA deployment |
ipaclient_keytab |
The path to a backed-up host keytab from previous enrollment |
ipaclient_force_join |
Set force_join to yes to join the host even if it is already enrolled |
ipaclient_use_otp |
Generate a one-time-password |
ipaclient_kinit_attempts |
Repeat the request for host Kerberos ticket |
ipaclient_no_ntp |
Set to yes to not configure and enable NTP |
ipaclient_mkhomedir |
Create users home dir |
ipaclient_allow_repair |
Allow repair of already joined hosts |
install-client.yml
---
- name: Playbook to configure IPA clients with username/password
hosts: ipaclients
become: true
vars_files:
- playbook_sensitive_data.yml
roles:
- role: ipaclient
state: present
uninstall-client.yml
---
- name: Playbook to configure IPA clients with username/password
hosts: ipaclients
become: true
vars_files:
- playbook_sensitive_data.yml
roles:
- role: ipaclient
state: absent
- Domain discovery and validation of parameters
- (Configure firewall)
- Time synchronization and configuration (ntpd)
- Directory server configuration (dirsrv)
- Kerberos configuration (krb5kdc, kadmin)
- Certificate Server configuration (pki-tomcatd)
- Further directory server configuration (dirsrv)
- OTPD configuration (ipa-otpd)
- Custodia configuration (ipa-custodia)
- HTTP configuration (httpd)
- Kerberos KDC configuration (krb5kdc)
- KRA (Key Recovery Authority) configuration
- DNS configuration (named)
- AD trust configuration (smb, winbind)
- Client configuration on master
- Enable IPA service
# Example minimal server inventory file
[ipaserver]
ipaserver.ipadomain.com
[ipaserver:vars]
ipaserver_domain=ipadomain.com
ipaserver_realm=IPADOMAIN.COM
# Passwords can be provided by a Vault-protected file
ipaadmin_password=SomePassword1
ipadm_password=SomePassword2
| Variable | Description |
|---|---|
ipaserver |
Group with IPA server FQDN |
ipaadmin_password |
The password for the kerberos admin principal |
ipaserver_domain |
The primary DNS domain for the IPA deployment |
ipaserver_realm |
The Kerberos realm for the IPA deployment |
ipaserver_setup_kra |
Install and configure a KRA on this server |
ipaserver_setup_dns |
Configure an integrated DNS server |
ipaserver_setup_adtrust |
Configure AD Trust capability |
ipaserver_auto_forwarders |
Add DNS forwarders configured in /etc/resolv.conf |
ipaserver_no_reverse |
Do not create reverse DNS zone |
ipaclient_no_ntp |
Set to no to not configure and enable NTP |
ipaclient_mkhomedir |
Create users home dir |
install-server.yml
---
- name: Playbook to configure IPA server
hosts: ipaserver
become: true
roles:
- role: ipaserver
state: present
uninstall-server.yml
---
- name: Playbook to unconfigure IPA server
hosts: ipaserver
become: true
roles:
- role: ipaserver
state: absent
- Domain discovery and validation of parameters
- (Configure firewall)
- Time synchronization and configuration (ntpd)
- ...
# Example minimal replica inventory file
[ipaservers]
ipaserver.ipadomain.com
[ipareplicas]
ipareplica1.ipadomain.com
[ipareplicas:vars]
ipaadmin_password=SomePassword1
ipadm_password=SomePassword2
| Variable | Description |
|---|---|
| ipaservers | Group with IPA server FQDNs |
| ipaadmin_password | The password for the kerberos admin principal |
| ipadm_password | The Directory Manager password used for connection check |
| ipaserver_domain | The primary DNS domain for the IPA deployment |
| ipaserver_realm | The Kerberos realm for the IPA deployment |
| ipareplica_setup_kra | Install and configure a KRA on this server |
| ipareplica_setup_dns | Configure an integrated DNS server |
| ipareplica_setup_adtrust | Configure AD Trust capability |
| ipareplica_auto_forwarders | Add DNS forwarders configured in /etc/resolv.conf |
| ipareplica_no_reverse | Do not create reverse DNS zone |
| ipaclient_no_ntp | Set to no to not configure and enable NTP |
| ipaclient_mkhomedir | Create users home dir |
install-replica.yml
---
- name: Playbook to configure IPA replicas
hosts: ipareplicas
become: true
roles:
- role: ipareplica
state: present
uninstall-replica.yml
---
- name: Playbook to unconfigure IPA replicas
hosts: ipareplicas
become: true
roles:
- role: ipareplica
state: absent
# Example minimal cluster inventory file
[ipaserver]
ipaserver.ipadomain.com
[ipaserver:vars]
#ipaserver_setup_dns=yes
#ipaserver_auto_forwarders=yes
[ipareplicas]
ipareplica1.ipadomain.com
[ipareplicas:vars]
ipaclient_force_join=yes
[ipaclients]
ipaclient1.ipadomain.com
ipaclient2.ipadomain.com
ipaclient3.ipadomain.com
[ipaclients:vars]
#ipaclient_use_otp=yes
ipaclient_allow_repair=yes
[ipa:children]
ipaserver
ipareplicas
ipaclients
[ipa:vars]
ipaadmin_password=SomePassword456
ipadm_password=SomePassword123
ipaserver_domain=ipadomain.com
ipaserver_realm=IPADOMAIN.COM
install-cluster.yml
---
- name: Install IPA servers
hosts: ipaserver
become: true
roles:
- role: ipaserver
state: present
- name: Install IPA replicas
hosts: ipareplicas
become: true
roles:
- role: ipareplica
state: present
- name: Install IPA clients
hosts: ipaclients
become: true
roles:
- role: ipaclient
state: present
uninstall-cluster.yml
---
- name: Uninstall IPA clients
hosts: ipaclients
become: true
roles:
- role: ipaclient
state: absent
- name: Uninstall IPA replicas
hosts: ipareplicas
become: true
roles:
- role: ipareplica
state: absent
- name: Uninstall IPA servers
hosts: ipaserver
become: true
roles:
- role: ipaserver
state: absent
Note: Please remember to register the client IP addresses and FQDN names if DNS will be setup in the IPA server. This needs to be done before the clients are enrolled.