26.2. Setting the parameters of the inventory file for the autodiscovery client installation mode

Procedure

1. Open your inventory file for editing.

2. Specify the fully-qualified hostname (FQDN) of the host to become an IdM client. The fully qualified domain name must be a valid DNS name:

   • Only numbers, alphabetic characters, and hyphens (-) are allowed. For example, underscores are not allowed and can cause DNS failures.

   • The host name must be all lower-case. No capital letters are allowed.

     If the SRV records are set properly in the IdM DNS zone, the script automatically discovers all the other required values.

     Example of a simple inventory hosts file with only the client FQDN defined

     [ipaclients]
     client.idm.example.com
     [...]

3. Specify the credentials for enrolling the client. The following authentication methods are available:

   • The password of a user authorized to enroll clients. This is the default option.

     • Use the Ansible Vault to store the password, and reference the Vault file from the playbook file, for example install-client.yml, directly:

       Example playbook file using principal from inventory file and password from an Ansible Vault file

       - name: Playbook to configure IPA clients with username/password
         hosts: ipaclients
         become: true
         vars_files:
         - playbook_sensitive_data.yml
       
         roles:
         - role: freeipa.ansible_freeipa.ipaclient
           state: present

     • Less securely, provide the credentials of admin using the ipaadmin_password option in the [ipaclients:vars] section of the inventory/hosts file. Alternatively, to specify a different authorized user, use the ipaadmin_principal option for the user name, and the ipaadmin_password option for the password. The inventory/hosts inventory file and the install-client.yml playbook file can then look as follows:

       Example inventory hosts file

       [...]
       [ipaclients:vars]
       ipaadmin_principal=my_admin
       ipaadmin_password=Secret123

       Example Playbook using principal and password from inventory file

       - name: Playbook to unconfigure IPA clients
         hosts: ipaclients
         become: true
       
         roles:
         - role: freeipa.ansible_freeipa.ipaclient
           state: true

   • The client keytab from the previous enrollment if it is still available.

     This option is available if the system was previously enrolled as an Identity Management client. To use this authentication method, uncomment the #ipaclient_keytab option, specifying the path to the file storing the keytab, for example in the [ipaclient:vars] section of inventory/hosts.

   • A random, one-time password (OTP) to be generated during the enrollment. To use this authentication method, use the ipaclient_use_otp=true option in your inventory file. For example, you can uncomment the ipaclient_use_otp=true option in the [ipaclients:vars] section of the inventory/hosts file. Note that with OTP you must also specify one of the following options:

     • The password of a user authorized to enroll clients, for example by providing a value for ipaadmin_password in the [ipaclients:vars] section of the inventory/hosts file.
     • The admin keytab, for example by providing a value for ipaadmin_keytab in the [ipaclients:vars] section of inventory/hosts.

4. Optional: Specify the DNS resolver using the ipaclient_configure_dns_resolve and ipaclient_dns_servers options (if available) to simplify cluster deployments. This is especially useful if your IdM deployment is using integrated DNS:

   An inventory file snippet specifying a DNS resolver:

   [...]
   [ipaclients:vars]
   ipaadmin_password: "{{ ipaadmin_password }}"
   ipaclient_domain=idm.example.com
   ipaclient_configure_dns_resolver=true
   ipaclient_dns_servers=192.168.100.1

   注意

   The ipaclient_dns_servers list must contain only IP addresses. Host names are not allowed.

5. You can also specify the ipaclient_subid: true option to have subid ranges configured for IdM users on the IdM level.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README.md file on the control node.