50 lines
1.3 KiB
YAML
50 lines
1.3 KiB
YAML
---
|
|
- name: Check if keytab exists
|
|
ansible.builtin.stat:
|
|
path: "{{ keytab_path }}"
|
|
register: keytab_status
|
|
check_mode: false
|
|
|
|
- name: Add principal to keytab
|
|
ansible.builtin.command:
|
|
argv:
|
|
- kadmin.local
|
|
- -x
|
|
- host=ldaps://ldap01.foo.sh
|
|
- ktadd
|
|
- -k
|
|
- "/tmp/{{ inventory_hostname }}.kt"
|
|
- "{{ item }}"
|
|
with_items: "{{ keytab_principals }}"
|
|
delegate_to: ldap01.home.foo.sh
|
|
when: not keytab_status.stat.exists
|
|
|
|
- name: Get keytab
|
|
ansible.builtin.command:
|
|
argv:
|
|
- base64
|
|
- "/tmp/{{ inventory_hostname }}.kt"
|
|
register: keytab_data
|
|
delegate_to: ldap01.home.foo.sh
|
|
when: not keytab_status.stat.exists
|
|
|
|
- name: Delete temporary file
|
|
ansible.builtin.file:
|
|
path: "/tmp/{{ inventory_hostname }}.kt"
|
|
state: absent
|
|
delegate_to: ldap01.home.foo.sh
|
|
when: not keytab_status.stat.exists
|
|
|
|
- name: Deploy keytab file
|
|
ansible.builtin.shell: >-
|
|
set -o pipefail &&
|
|
umask 077 &&
|
|
echo '{{ keytab_data.stdout }}' | base64 -d > "{{ keytab_path }}"
|
|
when: not keytab_status.stat.exists
|
|
|
|
- name: Check keytab permissions
|
|
ansible.builtin.file:
|
|
path: "{{ keytab_path }}"
|
|
mode: "{% if keytab_group == ansible_wheel %}0600{% else %}0640{% endif %}"
|
|
owner: root
|
|
group: "{{ keytab_group }}"
|