ovirt-aaa-ldap
oVirt AAA LDAP
This role deploy oVirt AAA LDAP configuration.
Requirements
Just Ansible.
Role Variables
aaa_profile_type: Define profile type, one of:
- 389ds
- iplanet
- rfc2307-389ds
- rfc2307-generic
- rfc2307-openldap
- rfc2307-rhds
- ad
- ipa
- openldap
- rfc2307-edir
- rhds
aaa_user: User which should be used to search users for auhtorization.
aaa_password: Password of the search user.
aaa_profile_name: Name of the profile (visible in login page).
aaa_ldap: List of LDAP servers or LDAP domain. When more servers are specified, failover policy will be used.
aaa_ldap_is_domain: Whether aaa_ldap is domain with servers discovered via SRV records or not. Default is false (with exception of aaa_profile_type set to
ad
, then default is true)aaa_base_dn: Custom base DN in case user want to set special.
aaa_legacy_api_authn: Whether to include
/ovirt-engine/api
among paths that trigger HTTP authentication (was necessary before oVirt 4.0). Disabled by defaultaaa_sso_keytab: Path to keytab on ansible control machine which stores principal to use for SSO. This parameter or aaa_sso_remote_keytab is required in case SSO should be deployed. Keytab will be copied to
/etc/httpd/http.keytab
aaa_sso_remote_keytab: Path to keytab already present on target machine. Must be accessible and readable by apache.
For example to obtain HTTP keytab for oVirt engine in IPA use following command
$ ipa-getkeytab --server=ipa.example.com --principal=HTTP/ovirt.example.com --keytab=ovirt.keytab
Dependencies
No.
Example Playbook
This is example of how to deploy IPA with single server:
- name: Deploy oVirt AAA IPA
hosts: localhost
gather_facts: no
vars:
aaa_profile_type: ipa
aaa_user: uid=search,cn=users,cn=accounts,dc=example,dc=com
aaa_password: password
aaa_profile_name: ipa
aaa_ldap:
- ldap.example.com
roles:
- machacekondra.ovirt-aaa-ldap
This is example of how to deploy IPA with failover servers:
- name: Deploy oVirt AAA IPA failover
hosts: localhost
gather_facts: no
vars:
aaa_profile_type: ipa
aaa_user: uid=search,cn=users,cn=accounts,dc=example,dc=com
aaa_password: password
aaa_profile_name: ipa
aaa_ldap:
- ldap1.example.com
- ldap2.example.com
roles:
- machacekondra.ovirt-aaa-ldap
This is example of how to deploy IPA with SSO:
- name: Deploy oVirt AAA IPA SSO
hosts: localhost
gather_facts: no
vars:
aaa_profile_type: ipa
aaa_user: uid=search,cn=users,cn=accounts,dc=example,dc=com
aaa_password: password
aaa_profile_name: ipa
aaa_ldap:
- ldap1.example.com
- ldap2.example.com
aaa_sso_keytab: /path/to/ovirt.keytab
roles:
- machacekondra.ovirt-aaa-ldap
License
BSD
Author Information
Ondra Machacek (@machacekondra)
ansible-galaxy install machacekondra/ansible-role-ovirt-aaa-ldap