Skip to content

Commit b15c3c8

Browse files
wmudgewmudge
authored
Add FreeIPA users role (#258)
Signed-off-by: Webster Mudge <[email protected]>
1 parent 0db4756 commit b15c3c8

File tree

11 files changed

+896
-0
lines changed

11 files changed

+896
-0
lines changed

‎roles/freeipa_server_users/README.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# freeipa_server_users
2+
3+
Create superusers in FreeIPA.
4+
5+
This role creates superuser accounts in a FreeIPA environment. It's used to establish administrative accounts that are then added to a specified group, typically the **admins** group, to ensure they have the necessary permissions. The role is highly configurable, allowing you to define one or more superusers with their personal details and passwords.
6+
7+
## Requirements
8+
9+
- A running and accessible **FreeIPA server**.
10+
- The `ipaadmin_principal` must have permissions to create users and manage groups within the FreeIPA environment.
11+
- Network connectivity from the Ansible controller (or the execution host) to the FreeIPA server.
12+
13+
## Dependencies
14+
15+
None.
16+
17+
## Parameters
18+
19+
| Variable | Type | Required | Default | Description |
20+
| --- | --- | --- | --- | --- |
21+
| `superuser_accounts` | `list` of `dict` | `False` | `[{'user': 'superuser', 'given_name': 'Cloudera', 'surname': 'Labs', 'password': 'superuser', 'display_name': 'Cloudera Labs Superuser'}]` | A list of superuser accounts to create. Each dictionary requires `user`, `given_name`, `surname`, and `password`. `display_name` is optional. |
22+
| `superuser_group` | `str` | `False` | `admins` | The group to which the new superuser accounts will be added. |
23+
| `ipaadmin_password` | `str` | `True` | | The password for the **FreeIPA** admin principal. This should be stored securely, for example, using Ansible Vault. |
24+
| `ipaadmin_principal` | `str` | `False` | `admin` | The principal (username) for authenticating to the **FreeIPA** server. |
25+
| `ipaserver_host` | `str` | `False` | `inventory_hostname` | The hostname or IP address of the **FreeIPA** server. |
26+
27+
## Example Playbook
28+
29+
```yaml
30+
- hosts: ipaserver_host
31+
tasks:
32+
- name: Create default superuser
33+
ansible.builtin.import_role:
34+
name: cloudera.exe.freeipa_server_users
35+
vars:
36+
ipaadmin_password: "MySuperSecretAdminPassword" # Use Ansible Vault
37+
# All other values will use their defaults.
38+
39+
- name: Create multiple superusers and add to a custom group
40+
ansible.builtin.import_role:
41+
name: cloudera.exe.freeipa_server_users
42+
vars:
43+
ipaadmin_password: "MySuperSecretAdminPassword" # Use Ansible Vault
44+
superuser_group: "power_users"
45+
superuser_accounts:
46+
- user: "ops_admin"
47+
given_name: "Operations"
48+
surname: "Admin"
49+
password: "OpsAdminPassword123"
50+
- user: "dev_admin"
51+
given_name: "Development"
52+
surname: "Admin"
53+
password: "DevAdminPassword456"
54+
```
55+
56+
## License
57+
58+
```
59+
Copyright 2025 Cloudera, Inc.
60+
61+
Licensed under the Apache License, Version 2.0 (the "License");
62+
you may not use this file except in compliance with the License.
63+
You may obtain a copy of the License at
64+
65+
https://www.apache.org/licenses/LICENSE-2.0
66+
67+
Unless required by applicable law or agreed to in writing, software
68+
distributed under the License is distributed on an "AS IS" BASIS,
69+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
70+
See the License for the specific language governing permissions and
71+
limitations under the License.
72+
```

‎roles/freeipa_server_users/defaults/main.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
superuser_accounts:
17+
- user: superuser
18+
given_name: Cloudera
19+
surname: Labs
20+
password: superuser
21+
display_name: Cloudera Labs Superuser
22+
23+
superuser_group: admins
24+
25+
ipaadmin_principal: admin
26+
ipaadmin_password: "{{ undef(hint='Please define the FreeIPA adminstrator principal password') }}"
27+
ipaserver_host: "{{ inventory_hostname }}"

‎roles/freeipa_server_users/meta/argument_specs.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
# Copyright 2024 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
argument_specs:
17+
main:
18+
short_description: Set up superusers in FreeIPA
19+
description: |
20+
Creates superusers in FreeIPA and adds them to a specified group.
21+
author: Cloudera Labs
22+
version_added: 3.0.0
23+
options:
24+
superuser_accounts:
25+
description: List of superuser accounts to create, with details such as username, display name, given name, surname, and password.
26+
type: list
27+
elements: dict
28+
options:
29+
user:
30+
description:
31+
- Username for the superuser account.
32+
required: true
33+
given_name:
34+
description:
35+
- Given (first) name for the superuser account.
36+
required: true
37+
surname:
38+
description:
39+
- Surname (last name) for the superuser account.
40+
required: true
41+
password:
42+
description:
43+
- Password for the superuser account.
44+
required: true
45+
display_name:
46+
description:
47+
- Display name for the superuser account.
48+
default:
49+
- user: superuser
50+
given_name: Cloudera
51+
surname: Labs
52+
password: superuser
53+
display_name: Cloudera Labs Superuser
54+
superuser_group:
55+
description: The group to which the superusers will be added.
56+
type: str
57+
default: admins
58+
ipaadmin_password:
59+
description: The password for IPA admin authentication.
60+
type: str
61+
required: true
62+
ipaadmin_principal:
63+
description: The principal for IPA admin authentication.
64+
type: str
65+
default: admin
66+
ipaserver_host:
67+
description: The IPA server host.
68+
type: str
69+
default: C(inventory_hostname)

‎roles/freeipa_server_users/molecule/default/converge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
# Copyright 2024 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
- name: Converge
17+
hosts: all
18+
gather_facts: false
19+
become: true
20+
tasks:
21+
- name: Ensure FreeIPA Superuser
22+
ansible.builtin.import_role:
23+
name: freeipa_server_users

0 commit comments

Comments
 (0)