community.general.ipa_group module – Manage FreeIPA group

Note

This module is part of the community.general collection (version 8.6.7).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.ipa_group.

Synopsis

  • Add, modify and delete group within IPA server

Aliases: identity.ipa.ipa_group

Parameters

Parameter

Comments

append

boolean

added in community.general 4.0.0

If true, add the listed user and group to the group members.

If false, only the listed user and group will be group members, removing any other members.

Choices:

  • false ← (default)

  • true

cn

aliases: name

string / required

Canonical name.

Can not be changed as it is the unique identifier.

description

string

Description of the group.

external

boolean

Allow adding external non-IPA members from trusted domains.

Choices:

  • false

  • true

external_user

list / elements=string

added in community.general 6.3.0

List of external users assigned to this group.

Behaves identically to user with respect to append attribute.

List entries can be in DOMAIN\\username or SID format.

Unless SIDs are provided, the module will always attempt to make changes even if the group already has all the users. This is because only SIDs are returned by IPA query.

external=true is needed for this option to work.

gidnumber

aliases: gid

string

GID (use this option to set it manually).

group

list / elements=string

List of group names assigned to this group.

If append=false and an empty list is passed all groups will be removed from this group.

Groups that are already assigned but not passed will be removed.

If append=true the listed groups will be assigned without removing other groups.

If option is omitted assigned groups will not be checked or changed.

ipa_host

string

IP or hostname of IPA server.

If the value is not specified in the task, the value of environment variable IPA_HOST will be used instead.

If both the environment variable IPA_HOST and the value are not specified in the task, then DNS will be used to try to discover the FreeIPA server.

The relevant entry needed in FreeIPA is the ipa-ca entry.

If neither the DNS entry, nor the environment IPA_HOST, nor the value are available in the task, then the default value will be used.

Default: "ipa.example.com"

ipa_pass

string

Password of administrative user.

If the value is not specified in the task, the value of environment variable IPA_PASS will be used instead.

Note that if the urllib_gssapi library is available, it is possible to use GSSAPI to authenticate to FreeIPA.

If the environment variable KRB5CCNAME is available, the module will use this kerberos credentials cache to authenticate to the FreeIPA server.

If the environment variable KRB5_CLIENT_KTNAME is available, and KRB5CCNAME is not; the module will use this kerberos keytab to authenticate.

If GSSAPI is not available, the usage of ipa_pass is required.

ipa_port

integer

Port of FreeIPA / IPA server.

If the value is not specified in the task, the value of environment variable IPA_PORT will be used instead.

If both the environment variable IPA_PORT and the value are not specified in the task, then default value is set.

Default: 443

ipa_prot

string

Protocol used by IPA server.

If the value is not specified in the task, the value of environment variable IPA_PROT will be used instead.

If both the environment variable IPA_PROT and the value are not specified in the task, then default value is set.

Choices:

  • "http"

  • "https" ← (default)

ipa_timeout

integer

Specifies idle timeout (in seconds) for the connection.

For bulk operations, you may want to increase this in order to avoid timeout from IPA server.

If the value is not specified in the task, the value of environment variable IPA_TIMEOUT will be used instead.

If both the environment variable IPA_TIMEOUT and the value are not specified in the task, then default value is set.

Default: 10

ipa_user

string

Administrative account used on IPA server.

If the value is not specified in the task, the value of environment variable IPA_USER will be used instead.

If both the environment variable IPA_USER and the value are not specified in the task, then default value is set.

Default: "admin"

nonposix

boolean

Create as a non-POSIX group.

Choices:

  • false

  • true

state

string

State to ensure

Choices:

  • "absent"

  • "present" ← (default)

user

list / elements=string

List of user names assigned to this group.

If append=false and an empty list is passed all users will be removed from this group.

Users that are already assigned but not passed will be removed.

If append=true the listed users will be assigned without removing other users.

If option is omitted assigned users will not be checked or changed.

validate_certs

boolean

This only applies if ipa_prot is https.

If set to false, the SSL certificates will not be validated.

This should only set to false used on personally controlled sites using self-signed certificates.

Choices:

  • false

  • true ← (default)

Attributes

Attribute

Support

Description

check_mode

Support: full

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: none

Will return details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Examples

- name: Ensure group is present
  community.general.ipa_group:
    name: oinstall
    gidnumber: '54321'
    state: present
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure that groups sysops and appops are assigned to ops but no other group
  community.general.ipa_group:
    name: ops
    group:
    - sysops
    - appops
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure that users linus and larry are assign to the group, but no other user
  community.general.ipa_group:
    name: sysops
    user:
    - linus
    - larry
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure that new starter named john is member of the group, without removing other members
  community.general.ipa_group:
    name: developers
    user:
    - john
    append: true
    state: present
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Add external user to a group
  community.general.ipa_group:
   name: developers
   external: true
   append: true
   external_user:
   - S-1-5-21-123-1234-12345-63421
   ipa_host: ipa.example.com
   ipa_user: admin
   ipa_pass: topsecret

- name: Add a user from MYDOMAIN
  community.general.ipa_group:
   name: developers
   external: true
   append: true
   external_user:
   - MYDOMAIN\\john
   ipa_host: ipa.example.com
   ipa_user: admin
   ipa_pass: topsecret

- name: Ensure group is absent
  community.general.ipa_group:
    name: sysops
    state: absent
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

group

dictionary

Group as returned by IPA API

Returned: always

Authors

  • Thomas Krahn (@Nosmoht)