Skip to content

Commit f928bb2

Browse files
wmudgewmudge
committed
Add FreeIPA users role
Signed-off-by: Webster Mudge <[email protected]>
1 parent 8725267 commit f928bb2

File tree

11 files changed

+895
-0
lines changed

11 files changed

+895
-0
lines changed

‎roles/freeipa_server_users/README.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# freeipa_server_users
2+
3+
Create superusers in FreeIPA.
4+
5+
This role creates superuser accounts in a FreeIPA environment. It's used to establish administrative accounts that are then added to a specified group, typically the **admins** group, to ensure they have the necessary permissions. The role is highly configurable, allowing you to define one or more superusers with their personal details and passwords.
6+
7+
## Requirements
8+
9+
- A running and accessible **FreeIPA server**.
10+
- The `ipaadmin_principal` must have permissions to create users and manage groups within the FreeIPA environment.
11+
- Network connectivity from the Ansible controller (or the execution host) to the FreeIPA server.
12+
13+
## Dependencies
14+
15+
None.
16+
17+
## Parameters
18+
19+
| Variable | Type | Required | Default | Description |
20+
| --- | --- | --- | --- | --- |
21+
| `superuser_accounts` | `list` of `dict` | `False` | `[{'user': 'superuser', 'given_name': 'Cloudera', 'surname': 'Labs', 'password': 'superuser', 'display_name': 'Cloudera Labs Superuser'}]` | A list of superuser accounts to create. Each dictionary requires `user`, `given_name`, `surname`, and `password`. `display_name` is optional. |
22+
| `superuser_group` | `str` | `False` | `admins` | The group to which the new superuser accounts will be added. |
23+
| `ipaadmin_password` | `str` | `True` | | The password for the **FreeIPA** admin principal. This should be stored securely, for example, using Ansible Vault. |
24+
| `ipaadmin_principal` | `str` | `False` | `admin` | The principal (username) for authenticating to the **FreeIPA** server. |
25+
| `ipaserver_host` | `str` | `False` | `inventory_hostname` | The hostname or IP address of the **FreeIPA** server. |
26+
27+
## Example Playbook
28+
29+
```yaml
30+
- hosts: ipaserver_host
31+
tasks:
32+
- name: Create default superuser
33+
ansible.builtin.import_role:
34+
name: cloudera.exe.freeipa_server_users
35+
vars:
36+
ipaadmin_password: "MySuperSecretAdminPassword" # Use Ansible Vault
37+
# All other values will use their defaults.
38+
39+
- name: Create multiple superusers and add to a custom group
40+
ansible.builtin.import_role:
41+
name: cloudera.exe.freeipa_server_users
42+
vars:
43+
ipaadmin_password: "MySuperSecretAdminPassword" # Use Ansible Vault
44+
superuser_group: "power_users"
45+
superuser_accounts:
46+
- user: "ops_admin"
47+
given_name: "Operations"
48+
surname: "Admin"
49+
password: "OpsAdminPassword123"
50+
- user: "dev_admin"
51+
given_name: "Development"
52+
surname: "Admin"
53+
password: "DevAdminPassword456"
54+
```
55+
56+
## License
57+
58+
```
59+
Copyright 2025 Cloudera, Inc.
60+
61+
Licensed under the Apache License, Version 2.0 (the "License");
62+
you may not use this file except in compliance with the License.
63+
You may obtain a copy of the License at
64+
65+
https://www.apache.org/licenses/LICENSE-2.0
66+
67+
Unless required by applicable law or agreed to in writing, software
68+
distributed under the License is distributed on an "AS IS" BASIS,
69+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
70+
See the License for the specific language governing permissions and
71+
limitations under the License.
72+
```

‎roles/freeipa_server_users/defaults/main.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
superuser_accounts:
17+
- user: superuser
18+
given_name: Cloudera
19+
surname: Labs
20+
password: superuser
21+
display_name: Cloudera Labs Superuser
22+
23+
superuser_group: admins
24+
25+
ipaadmin_principal: admin
26+
ipaadmin_password: "{{ undef(hint='Please define the FreeIPA adminstrator principal password') }}"
27+
ipaserver_host: "{{ inventory_hostname }}"

‎roles/freeipa_server_users/meta/argument_specs.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
# Copyright 2024 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
argument_specs:
17+
main:
18+
short_description: Set up superusers in FreeIPA
19+
description: |
20+
Creates superusers in FreeIPA and adds them to a specified group.
21+
author: Cloudera Labs
22+
options:
23+
superuser_accounts:
24+
description: List of superuser accounts to create, with details such as username, display name, given name, surname, and password.
25+
type: list
26+
elements: dict
27+
options:
28+
user:
29+
description:
30+
- Username for the superuser account.
31+
required: true
32+
given_name:
33+
description:
34+
- Given (first) name for the superuser account.
35+
required: true
36+
surname:
37+
description:
38+
- Surname (last name) for the superuser account.
39+
required: true
40+
password:
41+
description:
42+
- Password for the superuser account.
43+
required: true
44+
display_name:
45+
description:
46+
- Display name for the superuser account.
47+
default:
48+
- user: superuser
49+
given_name: Cloudera
50+
surname: Labs
51+
password: superuser
52+
display_name: Cloudera Labs Superuser
53+
superuser_group:
54+
description: The group to which the superusers will be added.
55+
type: str
56+
default: admins
57+
ipaadmin_password:
58+
description: The password for IPA admin authentication.
59+
type: str
60+
required: true
61+
ipaadmin_principal:
62+
description: The principal for IPA admin authentication.
63+
type: str
64+
default: admin
65+
ipaserver_host:
66+
description: The IPA server host.
67+
type: str
68+
default: C(inventory_hostname)

‎roles/freeipa_server_users/molecule/default/converge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
# Copyright 2024 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
- name: Converge
17+
hosts: all
18+
gather_facts: false
19+
become: true
20+
tasks:
21+
- name: Ensure FreeIPA Superuser
22+
ansible.builtin.import_role:
23+
name: freeipa_server_users

0 commit comments

Comments
 (0)