kerberos/kdc: Rename to just kdc

roles/kdc/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart kdc
+  service:
+    name: krb5kdc
+    state: restarted

roles/kdc/meta/main.yml

@@ -0,0 +1,4 @@
+---
+dependencies:
+  - {role: nginx/server}
+  - {role: gunicorn}

roles/kdc/tasks/main.yml

@@ -0,0 +1,88 @@
+---
+- name: install packages
+  package:
+    name: "{{ item }}"
+    state: installed
+  with_items:
+    - krb5-server
+    - krb5-server-ldap
+    - python-kdcproxy
+
+- name: create kerberos config
+  template:
+    dest: /var/kerberos/krb5kdc/kdc.conf
+    src: kdc.conf.j2
+    mode: 0600
+    owner: root
+    group: "{{ ansible_wheel }}"
+  notify: restart kdc
+
+- name: store kdc and kadmin ldap auth credentials
+  shell: "( echo '{{ kerberos_kdc_pass }}' ; echo '{{ kerberos_kdc_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kdc,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }} ; ( echo '{{ kerberos_kadmin_pass }}' ; echo '{{ kerberos_kadmin_pass }}' ) | kdb5_ldap_util stashsrvpw uid=krb5kadmin,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }}"
+  args:
+    creates: "/var/kerberos/krb5kdc/.k5.ldap.{{ kerberos_realm|lower() }}"
+  no_log: true
+
+- name: store kdc master key
+  shell: "echo '{{ kerberos_master_pass }}' | kdb5_util stash"
+  args:
+    creates: "/var/kerberos/krb5kdc/.k5.{{ kerberos_realm }}"
+  no_log: true
+
+- name: enable kerberos service
+  service:
+    name: krb5kdc
+    state: started
+    enabled: true
+
+- name: create kdcproxy group
+  group:
+    name: kdcproxy
+    system: true
+
+- name: create kdcproxy user
+  user:
+    name: kdcproxy
+    comment: KDC Proxy
+    group: kdcproxy
+    groups: gunicorn
+    home: /var/empty
+    shell: /sbin/nologin
+    system: true
+
+- name: add nginx to kdcproxy group
+  user:
+    name: nginx
+    groups: kdcproxy
+
+- name: create kdcproxy config
+  template:
+    dest: /etc/kdcproxy.conf
+    src: kdcproxy.conf.j2
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+
+- name: create kdcproxy socket file
+  copy:
+    dest: /lib/systemd/system/gunicorn@kdcproxy.socket
+    src: /lib/systemd/system/gunicorn@.socket
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+    remote_src: true
+
+- name: enable kdcproxy socket
+  systemd:
+    name: gunicorn@kdcproxy.socket
+    enabled: true
+    state: started
+
+- name: create kdcproxy config for nginx
+  template:
+    dest: "/etc/nginx/conf.d/{{ inventory_hostname }}/kdcproxy.conf"
+    src: nginx-kdcproxy.conf.j2
+    mode: 0644
+    owner: root
+    group: "{{ ansible_wheel }}"
+  notify: restart nginx

roles/kdc/templates/kdc.conf.j2

@@ -0,0 +1,33 @@
+[libdefaults]
+  default_realm = {{ kerberos_realm }}
+
+[logging]
+  kdc = SYSLOG
+  admin_server = SYSLOG
+
+[kdcdefaults]
+  # listen on localhost only
+  kdc_listen = 127.0.0.1:88
+  kdc_tcp_listen = 127.0.0.1:88
+
+[realms]
+  {{ kerberos_realm }} = {
+    database_module = ldap.{{ kerberos_realm|lower() }}
+    key_stash_file = "/var/kerberos/krb5kdc/.k5.{{ kerberos_realm }}"
+    max_lifetime = 24h 0m 0s
+    max_renewable_life = 7d 0h 0m 0s
+    master_key_type = aes256-cts-hmac-sha1-96
+    supported_enctypes = aes256-cts-hmac-sha1-96:normal
+  }
+
+[dbmodules]
+  ldap.{{ kerberos_realm|lower() }} = {
+    db_library = kldap
+    disable_last_success = true
+    disable_lockout  = true
+    ldap_kerberos_container_dn = "ou=System,{{ ldap_basedn }}"
+    ldap_kdc_dn = "uid=krb5kdc,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }}"
+    ldap_kadmind_dn = "uid=krb5kadmin,cn={{ kerberos_realm }},ou=System,{{ ldap_basedn }}"
+    ldap_service_password_file = "/var/kerberos/krb5kdc/.k5.ldap.{{ kerberos_realm|lower() }}"
+    ldap_servers = "{% for item in ldap_server %}ldaps://{{ item }} {% endfor %}"
+  }

roles/kdc/templates/kdcproxy.conf.j2

@@ -0,0 +1,4 @@
+[global]
+
+[{{ kerberos_realm }}]
+kerberos = kerberos+tcp://localhost

roles/kdc/templates/nginx-kdcproxy.conf.j2

@@ -0,0 +1,3 @@
+location /KdcProxy {
+    proxy_pass http://unix:/run/gunicorn/gunicorn-kdcproxy.sock:/KdcProxy;
+}