27.3. Using Ansible to ensure that a condition is absent from an IdM user group automember rule

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the automember-hostgroup-rule-absent.yml Ansible playbook file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/automember/ directory and name it, for example, automember-usergroup-rule-absent.yml:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/automember/automember-hostgroup-rule-absent.yml automember-usergroup-rule-absent.yml

3. Open the automember-usergroup-rule-absent.yml file for editing.

4. Adapt the file by modifying the following parameters:

   • Rename the playbook to correspond to your use case, for example: Automember user group rule member absent.
   • Rename the task to correspond to your use case, for example: Ensure an automember condition for a user group is absent.

   • Set the following variables in the freeipa.ansible_freeipa.ipaautomember task section:

     • Set the ipaadmin_password variable to the password of the IdM admin.
     • Set the name variable to testing_group.
     • Set the automember_type variable to group.
     • Ensure that the state variable is set to absent.
     • Ensure that the action variable is set to member.
     • Set the inclusive key variable to initials.
     • Set the inclusive expression variable to dp.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Automember user group rule member absent
     hosts: ipaserver
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure an automember condition for a user group is absent
       freeipa.ansible_freeipa.ipaautomember:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: testing_group
         automember_type: group
         state: absent
         action: member
         inclusive:
           - key: initials
             expression: dp

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory automember-usergroup-rule-absent.yml

Verification

1. Log in as an IdM administrator.

   $ kinit admin

2. View the automember group:

   $ ipa automember-show --type=group testing_group
    Automember Rule: testing_group