Chapter 3. Using Ansible to manage IdM user vaults: storing and retrieving secrets
Chapter 3. Using Ansible to manage IdM user vaults: storing and retrieving secrets This chapter describes how to manage user vaults in Identity Management using the Ansible vault module. Specifically, it describes how a user can use Ansible playbooks to perform the following three consecutive actions: Create a user vault in IdM . Store a secret in the vault . Retrieve a secret from the vault . The user can do the storing and the retrieving from two different IdM clients. Prerequisites The Key Recovery Authority (KRA) Certificate System component has been installed on one or more of the servers in your IdM domain. For details, see Installing the Key Recovery Authority in IdM . 3.1. Ensuring the presence of a standard user vault in IdM using Ansible Follow this procedure to use an Ansible playbook to create a vault container with one or more private vaults to securely store sensitive information. In the example used in the procedure below, the idm_user user creates a vault of the standard type named my_vault . The standard vault type ensures that idm_user will not be required to authenticate when accessing the file. idm_user will be able to retrieve the file from any IdM client to which the user is logged in. Prerequisites You have installed the ansible-freeipa package on the Ansible controller, that is the host on which you execute the steps in the procedure. You know the password of idm_user . Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/vault directory: Create an inventory file, for example inventory.file : Open inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the ensure-standard-vault-is-present.yml Ansible playbook file. For example: Open the ensure-standard-vault-is-present-copy.yml file for editing. Adapt the file by setting the following variables in the ipavault task section: Set the ipaadmin_principal variable to idm_user . Set the ipaadmin_password variable to the password of idm_user . Set the user variable to idm_user . Set the name variable to my_vault . Set the vault_type variable to standard . This the modified Ansible playbook file for the current example: Save the file. Run the playbook: 3.2. Archiving a secret in a standard user vault in IdM using Ansible Follow this procedure to use an Ansible playbook to store sensitive information in a personal vault. In the example used, the idm_user user archives a file with sensitive information named password.txt in a vault named my_vault . Prerequisites You have installed the ansible-freeipa package on the Ansible controller, that is the host on which you execute the steps in the procedure. You know the password of idm_user . idm_user is the owner, or at least a member user of my_vault . You have access to password.txt , the secret that you want to archive in my_vault . Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/vault directory: Open your inventory file and make sure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the data-archive-in-symmetric-vault.yml Ansible playbook file but replace "symmetric" by "standard". For example: Open the data-archive-in-standard-vault-copy.yml file for editing. Adapt the file by setting the following variables in the ipavault task section: Set the ipaadmin_principal variable to idm_user . Set the ipaadmin_password variable to the password of idm_user . Set the user variable to idm_user . Set the name variable to my_vault . Set the in variable to the full path to the file with sensitive information. Set the action variable to member . This the modified Ansible playbook file for the current example: Save the file. Run the playbook: 3.3. Retrieving a secret from a standard user vault in IdM using Ansible Follow this procedure to use an Ansible playbook to retrieve a secret from the user personal vault. In the example used in the procedure below, the idm_user user retrieves a file with sensitive data from a vault of the standard type named my_vault onto an IdM client named host01 . idm_user does not have to authenticate when accessing the file. idm_user can use Ansible to retrieve the file from any IdM client on which Ansible is installed. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package on the Ansible controller. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You know the password of idm_user . idm_user is the owner of my_vault . idm_user has stored a secret in my_vault . Ansible can write into the directory on the IdM host into which you want to retrieve the secret. idm_user can read from the directory on the IdM host into which you want to retrieve the secret. Procedure Navigate to the /usr/share/doc/ansible-freeipa/playbooks/vault directory: Open your inventory file and mention, in a clearly defined section, the IdM client onto which you want to retrieve the secret. For example, to instruct Ansible to retrieve the secret onto host01.idm.example.com , enter: Make a copy of the retrive-data-symmetric-vault.yml Ansible playbook file. Replace "symmetric" with "standard". For example: Open the retrieve-data-standard-vault.yml-copy.yml file for editing. Adapt the file by setting the hosts variable to ipahost . Adapt the file by setting the following variables in the ipavault task section: Set the ipaadmin_principal variable to idm_user . Set the ipaadmin_password variable to the password of idm_user . Set the user variable to idm_user . Set the name variable to my_vault . Set the out variable to the full path of the file into which you want to export the secret. Set the state variable to retrieved . This the modified Ansible playbook file for the current example: Save the file. Run the playbook: Verification SSH to host01 as user01 : View the file specified by the out variable in the Ansible playbook file: You can now see the exported secret. For more information about using Ansible to manage IdM vaults and user secrets and about playbook variables, see the README-vault.md Markdown file available in the /usr/share/doc/ansible-freeipa/ directory and the sample playbooks available in the /usr/share/doc/ansible-freeipa/playbooks/vault/ directory.
cd /usr/share/doc/ansible-freeipa/playbooks/vault touch inventory.file [ipaserver] server.idm.example.com cp ensure-standard-vault-is-present.yml ensure-standard-vault-is-present-copy.yml --- - name: Tests hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - ipavault: ipaadmin_principal: idm_user ipaadmin_password: idm_user_password user: idm_user name: my_vault vault_type: standard ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-standard-vault-is-present-copy.yml cd /usr/share/doc/ansible-freeipa/playbooks/vault [ipaserver] server.idm.example.com cp data-archive-in-symmetric-vault.yml data-archive-in-standard-vault-copy.yml --- - name: Tests hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - ipavault: ipaadmin_principal: idm_user ipaadmin_password: idm_user_password user: idm_user name: my_vault in: /usr/share/doc/ansible-freeipa/playbooks/vault/password.txt action: member ansible-playbook --vault-password-file=password_file -v -i inventory.file data-archive-in-standard-vault-copy.yml cd /usr/share/doc/ansible-freeipa/playbooks/vault [ipahost] host01.idm.example.com cp retrive-data-symmetric-vault.yml retrieve-data-standard-vault.yml-copy.yml --- - name: Tests hosts: ipahost gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - ipavault: ipaadmin_principal: idm_user ipaadmin_password: idm_user_password user: idm_user name: my_vault out: /tmp/password_exported.txt state: retrieved ansible-playbook --vault-password-file=password_file -v -i inventory.file retrieve-data-standard-vault.yml-copy.yml ssh user01@host01.idm.example.com vim /tmp/password_exported.txt