51.4. Using Ansible to enable an AD user to administer IdM

Procedure

1. On your Ansible control node, create an enable-ad-admin-to-administer-idm.yml playbook with a task to add the ad_user@ad.example.com user override to the Default Trust View:

   ---
   - name: Enable AD administrator to act as a FreeIPA admin
     hosts: ipaserver
     become: false
     gather_facts: false
   
     tasks:
     - name: Ensure idoverride for ad_user@ad.example.com in 'Default Trust View'
       ipaidoverrideuser:
         ipaadmin_password: "{{ ipaadmin_password }}"
         idview: "Default Trust View"
         anchor: ad_user@ad.example.com

   In the example:

   • ad_user@ad.example.com is the user ID override of an AD user that is stored in the AD domain with which a trust has been established.

2. Use another playbook task in the same playbook to add the AD administrator user ID override to the admins group:

     - name: Add the AD administrator as a member of admins
       ipagroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: admins
         idoverrideuser:
         - ad_user@ad.example.com

   In the example:

   • admins is the name of the default IdM POSIX group to which you are adding the ad_user@ad.example.com ID override. Members of this group have full administrator privileges.
3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory enable-ad-admin-to-administer-idm.yml

Verification

1. Log in to the IdM client as the AD Administrator:

   $ ssh ad_user@ad.example.com@client.idm.example.com

2. Verify that you have obtained a valid ticket-granting ticket (TGT):

   $ klist
   Ticket cache: KCM:325600500:99540
   Default principal: ad_user@AD.EXAMPLE.COM
   Valid starting Expires Service principal
   02/04/2024 11:54:16 02/04/2024 21:54:16 krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM
   renew until 02/05/2024 11:54:16

3. Verify your admin privileges in IdM:

   $ ipa user-add testuser --first=test --last=user
   ------------------------
   Added user "tuser"
   ------------------------
     User login: tuser
     First name: test
     Last name: user
     Full name: test user
   [...]