Ansible Role for Active Directory Membership

This role helps manage the membership of a Windows Active Directory (AD) for managed hosts.

• Ansible Role for Active Directory Membership
  • License
  • Author Information
  • Requirements
  • Dependencies
  • Compatibility
  • Role Variables
  • Example Playbook
  • Useful Shell Commands
  • Additional Documentation Resources
  • Testing with Molecule
  • CI/CD with Travis CI
  • Useful Links

License

MIT / BSD

Author Information

• Created and maintained by: Kasra Amirsarvari
• Author on Ansible Galaxy: https://galaxy.ansible.com/caseraw
• User on Dockerhub: https://hub.docker.com/u/caseraw

Requirements

• A package manager should be set up with the right sources and repositories.
• The user running this role must have permissions to:
  • Install and remove packages.
  • Edit configuration files like /etc/krb5.conf and /etc/sssd/sssd.conf.
  • Manage systemd services for realmd, sssd, and addjobd.
• Network access to the Windows Domain Controller must be available.

Dependencies

None

Compatibility

Works with the following operating systems:

• CentOS 7
• CentOS 8
• RHEL 7.x
• RHEL 8.x

Role Variables

Example Playbook

---
- name: Manage AD membership for a Windows host
  become: True
  gather_facts: True
  vars_files:
    - /path/to/vault/file.yml
  tasks:
    - import_role:
        name: ansible_role_ad_membership
      vars:
        role_ad_membership_required_packages:
          - openldap-clients
          - krb5-workstation
          - krb5-libs
          - adcli
          - realmd
          - authconfig
          - samba-client
          - samba-common
          - samba-common-tools
          - sssd
          - sssd-ad
          - sssd-krb5
          - oddjob
          - oddjob-mkhomedir
        role_ad_membership_use_global_domain_controller: False
        role_ad_membership_ad_controller_random_selection: False
        role_ad_membership_ad_controllers:
          - ad1.example.com
          - ad2.example.com
        role_ad_membership_computer_ou: OU=Servers,DC=example,DC=com
        role_ad_membership_netbios_max_length: 15
        role_ad_membership_leave_ad: False
        role_ad_membership_allowed_group_list_default:
          - Special-Group-01
          - super_special_group_01
        role_ad_membership_allowed_group_list_something:
          - Special-Group-02
          - super_special_group_02
        role_ad_membership_allowed_group_list_something_else:
          - Special-Group-03
          - super_special_group_03

...

Useful Shell Commands

Find the AD controller and domain details.

dig -t SRV _ldap._tcp.ad.example.com
dig -t SRV _ldap._tcp.dc._msdcs.ad.example.com

Additional Documentation Resources

For more details about sssd and how to use it, check these links:

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/sssd-integration-intro

Testing with Molecule

This role is tested locally using Molecule. The configuration can be found at: molecule/default. Molecule tests are run using the docker driver on Dockerhub images made for this:

• CentOS
• Fedora

For complex configurations, you might need a full OS instead of a minimal container. In such cases, use Molecule's Vagrant driver with the libvirt provider. Your Molecule driver and platform configuration could look like:

driver:
  name: vagrant
  provider:
    name: libvirt
platforms:
  - name: ansible_role_ad_membership-ansible-molecule-centos-7
    box: centos/7
    memory: 1024
    cpus: 1

CI/CD with Travis CI

This role uses Travis CI for online testing with Molecule and sends notifications to import the role into Ansible Galaxy once tests pass. The Travis CI configuration file is located in the root of the Ansible role as .travis.yml.

Useful Links

• GitHub repository: https://github.com/Caseraw/ansible_role_ad_membership
• Travis CI build status: https://travis-ci.org/Caseraw/ansible_role_ad_membership
• Ansible Galaxy role: https://galaxy.ansible.com/caseraw/ansible_role_ad_membership