Chapter 21. Using Ansible to configure a system account in IdM to change user passwords without requiring a reset

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create a configure-system-account-to-change-user-passwords.yml playbook with the following content:

   ---
   - name: Configure a system account in IdM to change user passwords without requiring a reset
     hosts: ipaserver
     become: false
     gather_facts: false
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure sysaccount my-app is present with a random password
       freeipa.ansible_freeipa.ipasysaccount:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: my-app
         random: true
       register: sysaccount_result
   
     - name: Print the generated random password
       ansible.builtin.debug:
         var: sysaccount_result.sysaccount.randompassword
   
     - name: Ensure privilege my-app password change privilege is present with the password change permission
       freeipa.ansible_freeipa.ipaprivilege:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: my-app password change privilege
         permission:
         - "System: Change User password"
   
     - name: Ensure role my-app role is present with the privilege and system account as member
       freeipa.ansible_freeipa.iparole:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: my-app role
         privilege:
         - my-app password change privilege
         sysaccount:
         - my-app
   
     - name: Ensure sysaccount my-app can change passwords without requiring a reset
       freeipa.ansible_freeipa.ipasysaccount:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: my-app
         privileged: true

3. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-sysaccount.md and /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-role.md files on the control node.

4. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory configure-system-account-to-change-user-passwords.yml

Verification

1. Verify that the system account exists and is configured as privileged:

   $ ipa sysaccount-show my-app
     System account login: my-app
     Privileged: True

2. Verify that the role has the correct privilege and system account member:

   $ ipa role-show 'my-app role'
     Role name: my-app role
     Privileges: my-app password change privilege
     System accounts: my-app

3. Using your external credential-management system, change an IdM user’s password.

4. Log in to IdM as the IdM user:

   $ kinit idmuser

5. When prompted, enter the new password:

   idmuser's password:

6. Verify that you have idmuser's Kerberos ticket-granting ticket:

   $ klist

   Credentials cache: API:0A481BBD-C3AA-473D-B43A-42CD19C7F045
           Principal: idmuser@IDM.EXAMPLE.COM
   
     Issued                Expires               Principal
   Feb 23 16:06:56 2026  Feb 24 02:04:54 2026  krbtgt/IDM.EXAMPLE.COM@IDM.EXAMPLE.COM

   The output confirms that you have a valid Kerberos ticket. You were able to log in without having to reset idmuser's password.