26.4. Authorization options for IdM client enrollment using an Ansible playbook

You can authorize IdM client enrollment by using any of the following methods:

It is possible to have the OTP generated by an IdM administrator before the IdM client installation. In that case, you do not need any credentials for the installation other than the OTP itself.

The following are sample inventory files for these methods:

[ipaclients:vars]
ipaadmin_password=Secret123
ipaclient_use_otp=true

[ipaclients:vars]
ipaclient_otp=<W5YpARl=7M.>

[ipaclients:vars]
ipaadmin_keytab=/root/admin.keytab
ipaclient_use_otp=true

[ipaclients:vars]
ipaclient_keytab=/root/krb5.keytab

[ipaclients:vars]
ipaadmin_password=Secret123

[ipaclients:vars]
[...]

If you are using the password of an admin user stored in an Ansible vault file, the corresponding playbook file must have an additional vars_files directive:

[ipaclients:vars]
[...]

- name: Playbook to configure IPA clients
  hosts: ipaclients
  become: true
  vars_files:
  - ansible_vault_file.yml

  roles:
  - role: freeipa.ansible_freeipa.ipaclient
    state: present

In all the other authorization scenarios described above, a basic playbook file could look as follows:

- name: Playbook to configure IPA clients
  hosts: ipaclients
  become: true

  roles:
  - role: freeipa.ansible_freeipa.ipaclient
    state: true