3.4. Retrieving a secret from a standard user vault in IdM using Ansible

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Open your inventory file and mention, in a clearly defined section, the IdM client onto which you want to retrieve the secret. For example, to instruct Ansible to retrieve the secret onto host01.idm.example.com, enter:

   [ipahost]
   host01.idm.example.com

3. Make a copy of the retrive-data-symmetric-vault.yml Ansible playbook file from the relevant collections directory. Replace "symmetric" with "standard". For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/vault/retrive-data-symmetric-vault.yml retrieve-data-standard-vault.yml-copy.yml

4. Open the retrieve-data-standard-vault.yml-copy.yml file for editing.
5. Adapt the file by setting the hosts variable to ipahost.

6. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipavault task section:

   • Set the ipaadmin_principal variable to idm_user.
   • Set the ipaadmin_password variable to the password of idm_user.
   • Set the user variable to idm_user.
   • Set the name variable to my_vault.
   • Set the out variable to the full path of the file into which you want to export the secret.

   • Set the state variable to retrieved.

     This the modified Ansible playbook file for the current example:

   ---
   - name: Tests
     hosts: ipahost
     gather_facts: false
   
     tasks:
     - freeipa.ansible_freeipa.ipavault:
         ipaadmin_principal: idm_user
         ipaadmin_password: idm_user_password
         user: idm_user
         name: my_vault
         out: /tmp/password_exported.txt
         state: retrieved

7. Save the file.

8. Run the playbook:

   $ ansible-playbook -v -i inventory retrieve-data-standard-vault.yml-copy.yml

Verification

1. SSH to host01 as user01:

   $ ssh user01@host01.idm.example.com

2. View the file specified by the out variable in the Ansible playbook file:

   $ vim /tmp/password_exported.txt