36.12. Using Ansible to give a user ID override access to the local sound card on an IdM client

Procedure

1. On client.idm.example.com, add [SUCCESS=merge] to the /etc/nsswitch.conf file:

   [...]
   # Allow initgroups to default to the setting for group.
   initgroups: sss [SUCCESS=merge] files

2. Identify the GID of the local audio group:

   $ getent group audio
   ---------------------
   audio:x:63

3. On your Ansible control node, create an add-aduser-to-audio-group.yml playbook with a task to add the aduser@addomain.com user override to the Default Trust View:

   ---
   - name: Playbook to manage idoverrideuser
     hosts: ipaserver
     become: false
   
     tasks:
     - name: Add aduser@addomain.com user to the Default Trust View
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: "Default Trust View"
         anchor: aduser@addomain.com

4. Use another playbook task in the same playbook to add the group audio to IdM with the GID of 63. Add the aduser idoverrideuser to the group:

     - name: Add the audio group with the aduser member and GID of 63
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: audio
         idoverrideuser:
         - aduser@addomain.com
         gidnumber: 63

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-aduser-to-audio-group.yml

Verification

1. Log in to the IdM client as the AD user:

   $ ssh aduser@addomain.com@client.idm.example.com

2. Verify the group membership of the AD user:

   $ id aduser@addomain.com
   uid=702801456(aduser@addomain.com) gid=63(audio) groups=63(audio)