Chapter 14. Using Ansible playbooks to manage RBAC permissions in IdM
Chapter 14. Using Ansible playbooks to manage RBAC permissions in IdM Role-based access control (RBAC) is a policy-neutral access control mechanism defined around roles, privileges, and permissions. Especially in large companies, using RBAC can help create a hierarchical system of administrators with their individual areas of responsibility. This chapter describes the following operations performed when managing RBAC permissions in Identity Management (IdM) using Ansible playbooks: Using Ansible to ensure an RBAC permission is present Using Ansible to ensure an RBAC permission with an attribute is present Using Ansible to ensure an RBAC permission is absent Using Ansible to ensure an attribute is a member of an IdM RBAC permission Using Ansible to ensure an attribute is not a member of an IdM RBAC permission Using Ansible to rename an IdM RBAC permission Prerequisites You understand the concepts and principles of RBAC . 14.1. Using Ansible to ensure an RBAC permission is present As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control (RBAC). The following procedure describes how to use an Ansible playbook to ensure a permission is present in IdM so that it can be added to a privilege. The example describes how to ensure the following target state: The MyPermission permission exists. The MyPermission permission can only be applied to hosts. A user granted a privilege that contains the permission can do all of the following possible operations on an entry: Write Read Search Compare Add Delete Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the permission-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory: Open the permission-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipapermission task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the permission. Set the object_type variable to host . Set the right variable to all . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 14.2. Using Ansible to ensure an RBAC permission with an attribute is present As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control (RBAC). The following procedure describes how to use an Ansible playbook to ensure a permission is present in IdM so that it can be added to a privilege. The example describes how to ensure the following target state: The MyPermission permission exists. The MyPermission permission can only be used to add hosts. A user granted a privilege that contains the permission can do all of the following possible operations on a host entry: Write Read Search Compare Add Delete The host entries created by a user that is granted a privilege that contains the MyPermission permission can have a description value. Note The type of attribute that you can specify when creating or modifying a permission is not constrained by the IdM LDAP schema. However, specifying, for example, attrs: car_licence if the object_type is host later results in the ipa: ERROR: attribute "car-license" not allowed error message when you try to exercise the permission and add a specific car licence value to a host. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the permission-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory: Open the permission-present-with-attribute.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipapermission task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the permission. Set the object_type variable to host . Set the right variable to all . Set the attrs variable to description . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources See User and group schema in Linux Domain Identity, Authentication and Policy Guide in RHEL 7. 14.3. Using Ansible to ensure an RBAC permission is absent As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control (RBAC). The following procedure describes how to use an Ansible playbook to ensure a permission is absent in IdM so that it cannot be added to a privilege. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the permission-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory: Open the permission-absent-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipapermission task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the permission. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 14.4. Using Ansible to ensure an attribute is a member of an IdM RBAC permission As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control (RBAC). The following procedure describes how to use an Ansible playbook to ensure that an attribute is a member of an RBAC permission in IdM. As a result, a user with the permission can create entries that have the attribute. The example describes how to ensure that the host entries created by a user with a privilege that contains the MyPermission permission can have gecos and description values. Note The type of attribute that you can specify when creating or modifying a permission is not constrained by the IdM LDAP schema. However, specifying, for example, attrs: car_licence if the object_type is host later results in the ipa: ERROR: attribute "car-license" not allowed error message when you try to exercise the permission and add a specific car licence value to a host. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The MyPermission permission exists. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the permission-member-present.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory: Open the permission-member-present-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipapermission task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the permission. Set the attrs list to the description and gecos variables. Make sure the action variable is set to member . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 14.5. Using Ansible to ensure an attribute is not a member of an IdM RBAC permission As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control (RBAC). The following procedure describes how to use an Ansible playbook to ensure that an attribute is not a member of an RBAC permission in IdM. As a result, when a user with the permission creates an entry in IdM LDAP, that entry cannot have a value associated with the attribute. The example describes how to ensure the following target state: The MyPermission permission exists. The host entries created by a user with a privilege that contains the MyPermission permission cannot have the description attribute. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The MyPermission permission exists. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the permission-member-absent.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory: Open the permission-member-absent-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipapermission task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the permission. Set the attrs variable to description . Set the action variable to member . Make sure the state variable is set to absent This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 14.6. Using Ansible to rename an IdM RBAC permission As a system administrator of Identity Management (IdM), you can customize the IdM role-based access control. The following procedure describes how to use an Ansible playbook to rename a permission. The example describes how to rename MyPermission to MyNewPermission . Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. The MyPermission exists in IdM. The MyNewPermission does not exist in IdM. Procedure Navigate to the ~/ MyPlaybooks / directory: Make a copy of the permission-renamed.yml file located in the /usr/share/doc/ansible-freeipa/playbooks/permission/ directory: Open the permission-renamed-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipapermission task section: Adapt the name of the task to correspond to your use case. Set the ipaadmin_password variable to the password of the IdM administrator. Set the name variable to the name of the permission. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: 14.7. Additional resources See Permissions in IdM . See Privileges in IdM . See the README-permission file available in the /usr/share/doc/ansible-freeipa/ directory. See the sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/ipapermission directory.
cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-present.yml permission-present-copy.yml --- - name: Permission present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "MyPermission" permission is present ipapermission: ipaadmin_password: "{{ ipaadmin_password }}" name: MyPermission object_type: host right: all ansible-playbook --vault-password-file=password_file -v -i inventory permission-present-copy.yml cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-present.yml permission-present-with-attribute.yml --- - name: Permission present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "MyPermission" permission is present with an attribute ipapermission: ipaadmin_password: "{{ ipaadmin_password }}" name: MyPermission object_type: host right: all attrs: description ansible-playbook --vault-password-file=password_file -v -i inventory permission-present-with-attribute.yml cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-absent.yml permission-absent-copy.yml --- - name: Permission absent example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "MyPermission" permission is absent ipapermission: ipaadmin_password: "{{ ipaadmin_password }}" name: MyPermission state: absent ansible-playbook --vault-password-file=password_file -v -i inventory permission-absent-copy.yml cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-member-present.yml permission-member-present-copy.yml --- - name: Permission member present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that the "gecos" and "description" attributes are present in "MyPermission" ipapermission: ipaadmin_password: "{{ ipaadmin_password }}" name: MyPermission attrs: - description - gecos action: member ansible-playbook --vault-password-file=password_file -v -i inventory permission-member-present-copy.yml cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-member-absent.yml permission-member-absent-copy.yml --- - name: Permission absent example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure that an attribute is not a member of "MyPermission" ipapermission: ipaadmin_password: "{{ ipaadmin_password }}" name: MyPermission attrs: description action: member state: absent ansible-playbook --vault-password-file=password_file -v -i inventory permission-member-absent-copy.yml cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/permission/permission-renamed.yml permission-renamed-copy.yml --- - name: Permission present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Rename the "MyPermission" permission ipapermission: ipaadmin_password: "{{ ipaadmin_password }}" name: MyPermission rename: MyNewPermission state: renamed ansible-playbook --vault-password-file=password_file -v -i inventory permission-renamed-copy.yml