Chapter 26. Ensuring the presence and absence of services in IdM using Ansible
Chapter 26. Ensuring the presence and absence of services in IdM using Ansible With the Ansible service module, Identity Management (IdM) administrator can ensure that specific services that are not native to IdM are present or absent in IdM. For example, you can use the service module to: Check that a manually installed service is present on an IdM client and automatically install that service if it is absent. For details, see: Ensuring the presence of an HTTP service in IdM on an IdM client. Ensuring the presence of an HTTP service in IdM on a non-IdM client. Ensuring the presence of an HTTP service on an IdM client without DNS. Check that a service enrolled in IdM has a certificate attached and automatically install that certificate if it is absent. For details, see: Ensuring the presence of an externally-signed certificate in an IdM service entry. Allow IdM users and hosts to retrieve and create the service keytab. For details, see: Allowing IdM users, groups, hosts, or host groups to create a keytab of a service. Allowing IdM users, groups, hosts, or host groups to retrieve a keytab of a service. Allow IdM users and hosts to add a Kerberos alias to a service. For details, see: Ensuring the presence of a Kerberos principal alias for a service. Check that a service is not present on an IdM client and automatically remove that service if it is present. For details, see: Ensuring the absence of an HTTP service in IdM on an IdM client. 26.1. Ensuring the presence of an HTTP service in IdM using an Ansible playbook Follow this procedure to ensure the presence of an HTTP server in IdM using an Ansible playbook. Prerequisites The system to host the HTTP service is an IdM client. You have the IdM administrator password. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present.yml Ansible playbook file. For example: Open the /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-copy.yml Ansible playbook file for editing: Adapt the file: Change the IdM administrator password defined by the ipaadmin_password variable. Change the name of your IdM client on which the HTTP service is running, as defined by the name variable of the ipaservice task. Save and exit the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log into the IdM Web UI as IdM administrator. Navigate to Identity Services . If HTTP/client.idm.example.com@IDM.EXAMPLE.COM is listed in the Services list, the Ansible playbook has been successfully added to IdM. Additional resources To secure the communication between the HTTP server and browser clients, see adding TLS encryption to an Apache HTTP Server . To request a certificate for the HTTP service, see the procedure described in Obtaining an IdM certificate for a service using certmonger . 26.2. Ensuring the presence of multiple services in IdM on an IdM client using a single Ansible task You can use the ansible-freeipa ipaservice module to add, modify, and delete multiple Identity Management (IdM) services with a single Ansible task. For that, use the services option of the ipaservice module. Using the services option, you can also specify multiple service variables that only apply to a particular service. Define this service by the name variable, which is the only mandatory variable for the services option. Complete this procedure to ensure the presence of the HTTP/client01.idm.example.com@IDM.EXAMPLE.COM and the ftp/client02.idm.example.com@IDM.EXAMPLE.COM services in IdM with a single task. Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. You have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server in the ~/ MyPlaybooks / directory. You are using RHEL 9.3 and later. You have stored your ipaadmin_password in the secret.yml Ansible vault. Procedure Create your Ansible playbook file add-http-and-ftp-services.yml with the following content: Run the playbook: Additional resources The service module in ansible-freeipa upstream docs 26.3. Ensuring the presence of an HTTP service in IdM on a non-IdM client using an Ansible playbook Follow this procedure to ensure the presence of an HTTP server in IdM on a host that is not an IdM client using an Ansible playbook. By adding the HTTP server to IdM you are also adding the host to IdM. Prerequisites You have installed an HTTP service on your host. The host on which you have set up HTTP is not an IdM client. Otherwise, follow the steps in enrolled the HTTP service into IdM. You have the IdM administrator password. The DNS A record - or the AAAA record if IPv6 is used - for the host is available. If the server runs RHEL 9.2 or later and the FIPS mode is enabled, clients must either support the Extended Master Secret (EMS) extension or use TLS 1.3. TLS 1.2 connections without EMS fail. For more information, see the Red Hat Knowledgebase solution TLS extension "Extended Master Secret" enforced . Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-without-host-check.yml Ansible playbook file. For example: Open the copied file, /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-without-host-check-copy.yml , for editing. Locate the ipaadmin_password and name variables in the ipaservice task: Adapt the file: Set the ipaadmin_password variable to your IdM administrator password. Set the name variable to the name of the host on which the HTTP service is running. Save and exit the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log into the IdM Web UI as IdM administrator. Navigate to Identity Services . You can now see HTTP/client.idm.example.com@IDM.EXAMPLE.COM listed in the Services list. Additional resources To secure the communication, see adding TLS encryption to an Apache HTTP Server . 26.4. Ensuring the presence of an HTTP service on an IdM client without DNS using an Ansible playbook Follow this procedure to ensure the presence of an HTTP server running on an IdM client that has no DNS entry using an Ansible playbook. The scenario implied is that the IdM host has no DNS A entry available - or no DNS AAAA entry if IPv6 is used instead of IPv4. Prerequisites The system to host the HTTP service is enrolled in IdM. The DNS A or DNS AAAA record for the host may not exist. Otherwise, if the DNS record for the host does exist, follow the procedure in Ensuring the presence of an HTTP service in IdM using an Ansible playbook. You have the IdM administrator password. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-with-host-force.yml Ansible playbook file. For example: Open the copied file, /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-with-host-force-copy.yml , for editing. Locate the ipaadmin_password and name variables in the ipaservice task: Adapt the file: Set the ipaadmin_password variable to your IdM administrator password. Set the name variable to the name of the host on which the HTTP service is running. Save and exit the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log into the IdM Web UI as IdM administrator. Navigate to Identity Services . You can now see HTTP/client.idm.example.com@IDM.EXAMPLE.COM listed in the Services list. Additional resources To secure the communication, see adding TLS encryption to an Apache HTTP Server . 26.5. Ensuring the presence of an externally signed certificate in an IdM service entry using an Ansible playbook Follow this procedure to use the ansible-freeipa service module to ensure that a certificate issued by an external certificate authority (CA) is attached to the IdM entry of the HTTP service. Having the certificate of an HTTP service signed by an external CA rather than the IdM CA is particularly useful if your IdM CA uses a self-signed certificate. Prerequisites You have installed an HTTP service on your host. You have enrolled the HTTP service into IdM. You have the IdM administrator password. You have an externally signed certificate whose Subject corresponds to the principal of the HTTP service. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-certificate-present.yml file, for example: Optional: If the certificate is in the Privacy Enhanced Mail (PEM) format, convert the certificate to the Distinguished Encoding Rules (DER) format for easier handling through the command line (CLI): Decode the DER file to standard output using the base64 command. Use the -w0 option to disable wrapping: Copy the certificate from the standard output to the clipboard. Open the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-certificate-present-copy.yml file for editing and view its contents: Adapt the file: Replace the certificate, defined using the certificate variable, with the certificate you copied from the CLI. Note that if you use the certificate: variable with the "|" pipe character as indicated, you can enter the certificate THIS WAY rather than having it to enter it in a single line. This makes reading the certificate easier. Change the IdM administrator password, defined by the ipaadmin_password variable. Change the name of your IdM client on which the HTTP service is running, defined by the name variable. Change any other relevant variables. Save and exit the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log into the IdM Web UI as IdM administrator. Navigate to Identity Services . Click the name of the service with the newly added certificate, for example HTTP/client.idm.example.com . In the Service Certificate section on the right, you can now see the newly added certificate. 26.6. Using an Ansible playbook to allow IdM users, groups, hosts, or host groups to create a keytab of a service A keytab is a file containing pairs of Kerberos principals and encrypted keys. Keytab files are commonly used to allow scripts to automatically authenticate using Kerberos, without requiring human interaction or access to password stored in a plain-text file. The script is then able to use the acquired credentials to access files stored on a remote system. As an Identity Management (IdM) administrator, you can allow other users to retrieve or even create a keytab for a service running in IdM. By allowing specific users and user groups to create keytabs, you can delegate the administration of the service to them without sharing the IdM administrator password. This delegation provides a more fine-grained system administration. Follow this procedure to allow specific IdM users, user groups, hosts, and host groups to create a keytab for the HTTP service running on an IdM client. Specifically, it describes how you can allow the user01 IdM user to create a keytab for the HTTP service running on an IdM client named client.idm.example.com . Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You have enrolled the HTTP service into IdM. The system to host the HTTP service is an IdM client. The IdM users and user groups that you want to allow to create the keytab exist in IdM. The IdM hosts and host groups that you want to allow to create the keytab exist in IdM. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_create_keytab-present.yml Ansible playbook file. For example: Open the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_create_keytab-present-copy.yml Ansible playbook file for editing. Adapt the file by changing the following: The IdM administrator password specified by the ipaadmin_password variable. The name of your IdM client on which the HTTP service is running. In the current example, it is HTTP/client.idm.example.com The names of IdM users that are listed in the allow_create_keytab_user: section. In the current example, it is user01 . The names of IdM user groups that are listed in the allow_create_keytab_group: section. The names of IdM hosts that are listed in the allow_create_keytab_host: section. The names of IdM host groups that are listed in the allow_create_keytab_hostgroup: section. The name of the task specified by the name variable in the tasks section. After being adapted for the current example, the copied file looks like this: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification SSH to an IdM server as an IdM user that has the privilege to create a keytab for the particular HTTP service: Use the ipa-getkeytab command to generate the new keytab for the HTTP service: The -s option specifies a Key Distribution Center (KDC) server to generate the keytab. The -p option specifies the principal whose keytab you want to create. The -k option specifies the keytab file to append the new key to. The file will be created if it does not exist. If the command does not result in an error, you have successfully created a keytab of HTTP/client.idm.example.com as user01 . 26.7. Using an Ansible playbook to allow IdM users, groups, hosts, or host groups to retrieve a keytab of a service A keytab is a file containing pairs of Kerberos principals and encrypted keys. Keytab files are commonly used to allow scripts to automatically authenticate using Kerberos, without requiring human interaction or access to a password stored in a plain-text file. The script is then able to use the acquired credentials to access files stored on a remote system. As IdM administrator, you can allow other users to retrieve or even create a keytab for a service running in IdM. Follow this procedure to allow specific IdM users, user groups, hosts, and host groups to retrieve a keytab for the HTTP service running on an IdM client. Specifically, it describes how to allow the user01 IdM user to retrieve the keytab of the HTTP service running on client.idm.example.com . Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You have enrolled the HTTP service into IdM. The IdM users and user groups that you want to allow to retrieve the keytab exist in IdM. The IdM hosts and host groups that you want to allow to retrieve the keytab exist in IdM. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_retrieve_keytab-present.yml Ansible playbook file. For example: Open the copied file, /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_retrieve_keytab-present-copy.yml , for editing: Adapt the file: Set the ipaadmin_password variable to your IdM administrator password. Set the name variable of the ipaservice task to the principal of the HTTP service. In the current example, it is HTTP/client.idm.example.com Specify the names of IdM users in the allow_retrieve_keytab_group: section. In the current example, it is user01 . Specify the names of IdM user groups in the allow_retrieve_keytab_group: section. Specify the names of IdM hosts in the allow_retrieve_keytab_group: section. Specify the names of IdM host groups in the allow_retrieve_keytab_group: section. Specify the name of the task using the name variable in the tasks section. After being adapted for the current example, the copied file looks like this: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification SSH to an IdM server as an IdM user with the privilege to retrieve a keytab for the HTTP service: Use the ipa-getkeytab command with the -r option to retrieve the keytab: The -s option specifies a Key Distribution Center (KDC) server from which you want to retrieve the keytab. The -p option specifies the principal whose keytab you want to retrieve. The -k option specifies the keytab file to which you want to append the retrieved key. The file will be created if it does not exist. If the command does not result in an error, you have successfully retrieved a keytab of HTTP/client.idm.example.com as user01 . 26.8. Ensuring the presence of a Kerberos principal alias of a service using an Ansible playbook In some scenarios, it is beneficial for IdM administrator to enable IdM users, hosts, or services to authenticate against Kerberos applications using a Kerberos principal alias. These scenarios include: The user name changed, but the user should be able to log into the system using both the and new user names. The user needs to log in using the email address even if the IdM Kerberos realm differs from the email domain. Follow this procedure to create the principal alias of HTTP/mycompany.idm.example.com for the HTTP service running on client.idm.example.com . Prerequisites On the control node: You are using Ansible version 2.14 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. You have set up an HTTP service on your host. You have enrolled the HTTP service into IdM. The host on which you have set up HTTP is an IdM client. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-principal-present.yml Ansible playbook file. For example: Open the /usr/share/doc/ansible-freeipa/playbooks/service/service-member-principal-present-copy.yml Ansible playbook file for editing. Adapt the file by changing the following: The IdM administrator password specified by the ipaadmin_password variable. The name of the service specified by the name variable. This is the canonical principal name of the service. In the current example, it is HTTP/client.idm.example.com . The Kerberos principal alias specified by the principal variable. This is the alias you want to add to the service defined by the name variable. In the current example, it is host/mycompany.idm.example.com . The name of the task specified by the name variable in the tasks section. After being adapted for the current example, the copied file looks like this: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: If running the playbook results in 0 unreachable and 0 failed tasks, you have successfully created the host/mycompany.idm.example.com Kerberos principal for the HTTP/client.idm.example.com service. Additional resources Managing Kerberos principal aliases for users, hosts, and services 26.9. Ensuring the absence of an HTTP service in IdM using an Ansible playbook Follow this procedure to unenroll a service from IdM. More specifically, it describes how to use an Ansible playbook to ensure the absence of an HTTP server named HTTP/client.idm.example.com in IdM. Prerequisites You have the IdM administrator password. Procedure Create an inventory file, for example inventory.file : Open the inventory.file and define the IdM server that you want to configure in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com , enter: Make a copy of the /usr/share/doc/ansible-freeipa/playbooks/service/service-is-absent.yml Ansible playbook file. For example: Open the /usr/share/doc/ansible-freeipa/playbooks/service/service-is-absent-copy.yml Ansible playbook file for editing. Adapt the file by changing the following: The IdM administrator password defined by the ipaadmin_password variable. The Kerberos principal of the HTTP service, as defined by the name variable of the ipaservice task. After being adapted for the current example, the copied file looks like this: Save and exit the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Verification Log into the IdM Web UI as IdM administrator. Navigate to Identity Services . If you cannot see the HTTP/client.idm.example.com@IDM.EXAMPLE.COM service in the Services list, you have successfully ensured its absence in IdM. 26.10. Additional resources See the README-service.md Markdown file in the /usr/share/doc/ansible-freeipa/ directory. See sample playbooks in the /usr/share/doc/ansible-freeipa/playbooks/config directory.
touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-copy.yml --- - name: Playbook to manage IPA service. hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: # Ensure service is present - ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/client.idm.example.com ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-copy.yml --- - name: Playbook to add multiple services in a single task hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Add HTTP and ftp services ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" services: - name: HTTP/client01.idm.example.com@IDM.EXAMPLE.COM - name: ftp/client02.idm.example.com@IDM.EXAMPLE.COM ansible-playbook --vault-password-file=password_file -v -i inventory add-http-and-ftp-services.yml touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-without-host-check.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-without-host-check-copy.yml --- - name: Playbook to manage IPA service. hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: # Ensure service is present - ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/www2.example.com skip_host_check: true ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-without-host-check-copy.yml touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-with-host-force.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-with-host-force-copy.yml --- - name: Playbook to manage IPA service. hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: # Ensure service is present - ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/ihavenodns.info force: true ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-is-present-with-host-force-copy.yml touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-member-certificate-present.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-member-certificate-present-copy.yml openssl x509 -outform der -in cert1.pem -out cert1.der base64 cert1.der -w0 MIIC/zCCAeegAwIBAgIUV74O+4kXeg21o4vxfRRtyJm --- - name: Service certificate present. hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: # Ensure service certificate is present - ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/client.idm.example.com certificate: | - MIICBjCCAW8CFHnm32VcXaUDGfEGdDL/ [...] action: member state: present ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-member-certificate-present-copy.yml touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_create_keytab-present.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_create_keytab-present-copy.yml --- - name: Service member allow_create_keytab present hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Service HTTP/client.idm.example.com members allow_create_keytab present for user01 ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/client.idm.example.com allow_create_keytab_user: - user01 action: member ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_create_keytab-present-copy.yml ssh user01@server.idm.example.com Password: ipa-getkeytab -s server.idm.example.com -p HTTP/client.idm.example.com -k /etc/httpd/conf/krb5.keytab touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_retrieve_keytab-present.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_retrieve_keytab-present-copy.yml --- - name: Service member allow_retrieve_keytab present hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Service HTTP/client.idm.example.com members allow_retrieve_keytab present for user01 ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/client.idm.example.com allow_retrieve_keytab_user: - user01 action: member ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-member-allow_retrieve_keytab-present-copy.yml ssh user01@server.idm.example.com Password: ipa-getkeytab -r -s server.idm.example.com -p HTTP/client.idm.example.com -k /etc/httpd/conf/krb5.keytab touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-member-principal-present.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-member-principal-present-copy.yml --- - name: Service member principal present hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Service HTTP/client.idm.example.com member principals host/mycompany.idm.exmaple.com present ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/client.idm.example.com principal: - host/mycompany.idm.example.com action: member ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-member-principal-present-copy.yml touch inventory.file [ipaserver] server.idm.example.com cp /usr/share/doc/ansible-freeipa/playbooks/service/service-is-absent.yml /usr/share/doc/ansible-freeipa/playbooks/service/service-is-absent-copy.yml --- - name: Playbook to manage IPA service. hosts: ipaserver gather_facts: false vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: # Ensure service is absent - ipaservice: ipaadmin_password: "{{ ipaadmin_password }}" name: HTTP/client.idm.example.com state: absent ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory /inventory.file /usr/share/doc/ansible-freeipa/playbooks/service/service-is-absent-copy.yml