92 lines
2.3 KiB
YAML
92 lines
2.3 KiB
YAML
## Install and configure slapd.
|
|
---
|
|
- name: preseed ldap domain
|
|
debconf:
|
|
name: slapd
|
|
question: slapd/domain
|
|
value: "{{ ansible_domain }}"
|
|
vtype: string
|
|
|
|
- name: preseed slapd admin password1
|
|
debconf:
|
|
name: slapd
|
|
question: slapd/password1
|
|
value: "{{ ldap_admin_pwd }}"
|
|
vtype: password
|
|
no_log: true
|
|
|
|
- name: preseed slapd admin password2
|
|
debconf:
|
|
name: slapd
|
|
question: slapd/password2
|
|
value: "{{ ldap_admin_pwd }}"
|
|
vtype: password
|
|
no_log: true
|
|
|
|
- name: dump admin password
|
|
shell:
|
|
cmd: echo -n "{{ ldap_admin_pwd }}" > "{{ ldap_admin_pwd_file }}" ; chmod 0600 "{{ ldap_admin_pwd_file }}"
|
|
creates: "{{ ldap_admin_pwd_file }}"
|
|
no_log: true
|
|
|
|
- name: install packages for LDAP
|
|
apt:
|
|
name:
|
|
- slapd
|
|
- ldap-utils
|
|
- ldapvi
|
|
- python3-ldap
|
|
- ssl-cert
|
|
state: latest # noqa package-latest
|
|
|
|
- name: add openldap to the ssl-cert group
|
|
user:
|
|
name: openldap
|
|
groups: ssl-cert
|
|
append: true
|
|
notify: restart slapd
|
|
|
|
- name: make initial slapd configuration available
|
|
copy:
|
|
src: slapd-config.ldif
|
|
dest: /etc/ldap/slapd.d/
|
|
mode: 0644
|
|
|
|
- name: make slapd TLS configuration available
|
|
template:
|
|
src: slapd-TLS.ldif
|
|
dest: /etc/ldap/slapd.d/
|
|
mode: 0644
|
|
|
|
- name: activate ppolicy schema
|
|
command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ppolicy.ldif # noqa no-changed-when
|
|
|
|
- name: initialize slapd if it has just been installed
|
|
command: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-config.ldif # noqa no-changed-when
|
|
|
|
- name: configure LDAP TLS
|
|
command: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/slapd.d/slapd-TLS.ldif # noqa no-changed-when
|
|
|
|
- name: add URI to ldap.conf
|
|
lineinfile:
|
|
dest: /etc/ldap/ldap.conf
|
|
line: "URI ldapi:///"
|
|
insertafter: "#URI.*"
|
|
|
|
- name: add BASE to ldap.conf
|
|
lineinfile:
|
|
dest: /etc/ldap/ldap.conf
|
|
line: "BASE {{ basedn }}"
|
|
insertafter: "#BASE.*"
|
|
|
|
- name: check against self signed certificate
|
|
replace:
|
|
path: /etc/ldap/ldap.conf
|
|
regexp: "^(TLS_CACERT\\s+/etc/ssl/certs/ca-certificates.crt)$"
|
|
replace: '#\1\nTLS_CACERT\t{{ certpub }}'
|
|
|
|
- name: enable pam-mkhomedir
|
|
command: pam-auth-update --enable mkhomedir
|
|
when: foo_pwd is defined and foo_pwd | length > 0
|
|
|
|
## Use 'sudo ldapvi -Y EXTERNAL -h ldapi:/// -b "cn=config"' to modify certificate and key.
|