Chapter 21. Ensuring the presence of host-based access control rules in IdM using Ansible playbooks

Procedure

1. Create an inventory file, for example inventory.file, and define ipaserver in it:

   [ipaserver]
   server.idm.example.com

2. Create your Ansible playbook file that defines the HBAC policy whose presence you want to ensure. To simplify this step, you can copy and modify the example in the /usr/share/doc/ansible-freeipa/playbooks/hbacrule/ensure-hbacrule-allhosts-present.yml file:

   ---
   - name: Playbook to handle hbacrules
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     # Ensure idm_user can access client.idm.example.com via the sshd service
     - ipahbacrule:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: login
         user: idm_user
         host: client.idm.example.com
         hbacsvc:
         - sshd
         state: present

3. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-new-hbacrule-present.yml

Verification

1. Log in to the IdM Web UI as administrator.
2. Navigate to Policy Host-Based-Access-Control HBAC Test.
3. In the Who tab, select idm_user.
4. In the Accessing tab, select client.idm.example.com.
5. In the Via service tab, select sshd.
6. In the Rules tab, select login.
7. In the Run test tab, click the Run test button. If you see ACCESS GRANTED, the HBAC rule is implemented successfully.