- name: Install kerberos packages
  apt:
    name: krb5-user
    state: latest

- name: Kerberize sshd server
  ansible.builtin.copy:
    dest: /etc/ssh/sshd_config.d/kerberize.conf
    content: |
      GSSAPIAuthentication yes
  notify: "reload sshd"

- name: Kerberize ssh client, authenticate and delegate credentials
  ansible.builtin.copy:
    dest: /etc/ssh/ssh_config.d/kerberize.conf
    content: |
      GSSAPIAuthentication yes
      GSSAPIDelegateCredentials yes

- name: Check if firefox is available
  stat: path=/etc/firefox-esr/firefox-esr.js
  register: firefox

- name: Kerberize firefox for sites in the local domain
  lineinfile:
    dest: /etc/firefox-esr/firefox-esr.js
    line: "{{ item }}"
  with_items:
    - '// kerberize for sites in the local domain:'
    - 'pref("network.negotiate-auth.delegation-uris", "{{ kerberize_uris | default(ansible_domain) }}");'
    - 'pref("network.negotiate-auth.trusted-uris", "{{ kerberize_uris | default(ansible_domain) }}");'
  when: firefox.stat.exists

- name: Ensures /etc/chromium/policies/managed dir exists
  file:
    path: "/etc/chromium/policies/managed"
    state: directory

- name: Kerberize chromium for sites in the local domain
  copy:
    dest: /etc/chromium/policies/managed/idam.json
    content: |
      {
        "AuthServerAllowlist": "idam.steinbeis.schule"
      }