Chapter 14. Removing the trust using Ansible

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create an del-trust.yml playbook with the following content:

   ---
   - name: Playbook to delete trust
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
       - name: ensure the trust is absent
         ipatrust:
           ipaadmin_password: "{{ ipaadmin_password }}"
           realm: ad.example.com
           state: absent

   In the example, realm defines the AD realm name string.

3. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-trust.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/trust directory on the control node.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory del-trust.yml

   Note

   Removing the trust configuration does not automatically remove the ID range IdM has created for AD users. This way, if you add the trust again, the existing ID range is re-used. Also, if AD users have created files on an IdM client, their POSIX IDs are preserved in the file metadata.

   To remove all information related to an AD trust, remove the AD user ID range after removing the trust configuration and trust object:

   # ipa idrange-del AD.EXAMPLE.COM_id_range
   # systemctl restart sssd