Documentation

ipa_role - Manage FreeIPA role

New in version 2.3.

Synopsis

  • Add, modify and delete a role within FreeIPA server using FreeIPA API

Options

parameter required default choices comments
cn
yes
Role name.
Can not be changed as it is the unique identifier.

aliases: name
description
no
A description of this role-group.
group
no
List of group names assign to this role.
If an empty list is passed all assigned groups will be unassigned from the role.
If option is omitted groups will not be checked or changed.
If option is passed all assigned groups that are not passed will be unassigned from the role.
host
no
List of host names to assign.
If an empty list is passed all assigned hosts will be unassigned from the role.
If option is omitted hosts will not be checked or changed.
If option is passed all assigned hosts that are not passed will be unassigned from the role.
hostgroup
no
List of host group names to assign.
If an empty list is passed all assigned host groups will be removed from the role.
If option is omitted host groups will not be checked or changed.
If option is passed all assigned hostgroups that are not passed will be unassigned from the role.
ipa_host
no ipa.example.com
IP or hostname of IPA server
ipa_pass
yes
Password of administrative user
ipa_port
no 443
Port of IPA server
ipa_prot
no https
  • http
  • https
Protocol used by IPA server
ipa_user
no admin
Administrative account used on IPA server
privilege
(added in 2.4)
no None
List of privileges granted to the role.
If an empty list is passed all assigned privileges will be removed.
If option is omitted privileges will not be checked or changed.
If option is passed all assigned privileges that are not passed will be removed.
service
no
List of service names to assign.
If an empty list is passed all assigned services will be removed from the role.
If option is omitted services will not be checked or changed.
If option is passed all assigned services that are not passed will be removed from the role.
state
no present
  • present
  • absent
State to ensure
user
no
List of user names to assign.
If an empty list is passed all assigned users will be removed from the role.
If option is omitted users will not be checked or changed.
validate_certs
no True
This only applies if ipa_prot is https.
If set to no, the SSL certificates will not be validated.
This should only set to no used on personally controlled sites using self-signed certificates.

Examples

# Ensure role is present
- ipa_role:
    name: dba
    description: Database Administrators
    state: present
    user:
    - pinky
    - brain
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

# Ensure role with certain details
- ipa_role:
    name: another-role
    description: Just another role
    group:
    - editors
    host:
    - host01.example.com
    hostgroup:
    - hostgroup01
    privilege:
    - Group Administrators
    - User Administrators
    service:
    - service01

# Ensure role is absent
- ipa_role:
    name: dba
    state: absent
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

Return Values

Common return values are documented here Return Values, the following are the fields unique to this module:

name description returned type sample
role Role as returned by IPA API. always dict


Status

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Support

This module is community maintained without core committer oversight.

For more information on what this means please read Module Support

For help in developing on modules, should you be so inclined, please read Community Information & Contributing, Testing Ansible and Developing Modules.