Hi, I searched the interwebs but didn't find definite answer. We are enrolling clients with ansible like this: shell: ipa-client-install -U {{ ipa_extra_params }} --domain={{ ipa_domain }} --principal={{ ipa_admin_user }} --password={{ ipa_admin_password }} --mkhomedir --force-join --hostname={{ instance_hostname.stdout }}.{{ ipa_domain }} This works fine. After enrolling we want to edit the attributes of the newly enrolled host. We do that like this: shell: echo {{ ipa_admin_password }} | kinit enroller@{{ ipa_domain|upper }} && ipa host-mod --setattr=userclass="{{ host_user_class }}" {{ instance_hostname.stdout }}.{{ ipa_domain }} This also works fine but we don't love the fact that we echo the password to kinit. I know that there is the keytab route but that would require moving the keytab file to the host first. While this is not in any way impossible, we would like to "see all the cards". What would be the best practice(tm) for this? _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...

Yeah. Ansible Tower would solve this neatly but alas, we don't run one (although I wish we were). We will go with the currect set up for the time being. After all, it is not that huge of a deal. If anyone has a suggestion how to do this better, please feel free to share it.

On Mar 18, 2020, at 11:05:15 AM, Kimmo Rantala via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; wrote: There was a question from Angus that he did not CC here but I think he kind of asked what I/we are trying to do and told that Foreman is a bit like ansible. I thought it would be fair to tell what is the goal here. We are enrolling clients and we set the userclass attribute to a certain value to then assign the host to host groups with automember rules. This host group is for the environment, customer etc. so the correct users get the correct privileges to the hosts. We have the ansible playbooks in bitbucket but currently the playbooks are ran on peoples' workstations that may or may not be enrolled to the same IPA domain. Yes, I know this is sub-optimal but this is the current situation. I, myself, want some kind of centralized solution to this in the (preferably near) future. I know that people could use kinit on their workstations to obtain a ticket. That would require that me and my team would need to teach the various actors (who sometimes have surprising lack of knowledge in basic IT stuff) the basic operations of Kerberos. The current style works and we are refining it. Gonna take a look at ansible-freeipa again. Looked at it ages ago. _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...