36.9. 使用 Ansible 覆盖特定主机上 IdM 用户的登录名称和主目录

步骤

1. 使用以下内容创建 Ansible playbook 文件 add-idoverrideuser-with-name-and-homedir.yml ：

   ---
   - name: Playbook to manage idoverrideuser
     hosts: ipaserver
     become: false
     gather_facts: false
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
   
     tasks:
     - name: Ensure idview_for_host1 is present
       idview:
         ipaadmin_password: ”{{ ipaadmin_password }}"
         name: idview_for_host1
     - name: Ensure idview_for_host1 is applied to host1.idm.example.com
       idview:
         ipaadmin_password: ”{{ ipaadmin_password }}"
         name: idview_for_host1
         host: host1.idm.example.com
         action: member
     - name: Ensure idm_user is present in idview_for_host1 with homedir /home/user_1234 and name user_1234
       ipaidoverrideuser:
         ipaadmin_password: ”{{ ipaadmin_password }}"
         idview: idview_for_host1
         anchor: idm_user
         name: user_1234
         homedir: /home/user_1234

2. 运行 playbook。指定 playbook 文件，存储保护 secret.yml 文件的密码，以及清单文件：

   $ ansible-playbook --vault-password-file=password_file -v -i <path_to_inventory_directory>/inventory <path_to_playbooks_directory>/add-idoverrideuser-with-name-and-homedir.yml

3. [可选] 如果您有 root 凭证，您可以立即将新配置应用到 host1.idm.example.com 系统：

   1. 以 root 身份通过 SSH 连接到系统：

      $ ssh root@host1
      Password:

   2. 清除 SSSD 缓存：

      root@host1 ~]# sss_cache -E

   3. 重启 SSSD 守护进程：

      root@host1 ~]# systemctl restart sssd

验证

1. 以 idm_user用户身份，通过 SSH 连接到 host1:

   [root@r8server ~]# ssh idm_user@host1.idm.example.com
   Password:
   
   Last login: Sun Jun 21 22:34:25 2020 from 192.168.122.229
   [user_1234@host1 ~]$

2. 打印工作目录：

   [user_1234@host1 ~]$ pwd
   /home/user_1234/