playbook.yml

---
- hosts: all
  become: true

  roles:
    - geerlingguy.repo-epel

  tasks:
  - name: Add server to /etc/hosts
    lineinfile:
      dest: /etc/hosts
      line: '10.0.0.10	auth.example.org auth'
      state: present

  - name: Add client to /etc/hosts
    lineinfile:
      dest: /etc/hosts
      line: '10.0.0.100	somebox.example.org somebox'
      state: present

  - name: Install LDAP client
    package:
      name: openldap-clients
      state: present


- hosts: auth
  become: true

  tasks:
  - name: Install openldap server
    package:
      name: openldap-servers
      state: present

  - name: Start LDAP service
    service:
      name: slapd
      state: started
      enabled: true

  - name: Install Python LDAP support
    package:
      name: python-ldap
      state: present

  - name: Configure LDAP base
    ldap_attr:
      dn: olcDatabase={2}hdb,cn=config
      name: olcSuffix
      values: "dc=example,dc=org"
      state: exact

  - name: Configure LDAP RootDN
    ldap_attr:
      dn: olcDatabase={2}hdb,cn=config
      name: olcRootDN
      values: "cn=admin,dc=example,dc=org"
      state: exact

  - name: Configure LDAP RootDN password
    ldap_attr:
      dn: olcDatabase={2}hdb,cn=config
      name: olcRootPW
      values: "{SSHA}0TtWtaWnyCNw59LLdzAauF8+drxl2olj"
      state: exact

  # May not be the best thing, but since we're configuring with Ansible
  # without this, you'd have to provide auth (base dn/pw) in all of the
  # ldap_entry addition
  # https://serverfault.com/questions/490624/why-cant-i-create-my-first-object-in-my-open-ldap-server
  - name: Allow domain socket write access to LDAP tree
    ldap_attr:
      dn: olcDatabase={2}hdb,cn=config
      name: olcAccess
      values:
      - >-
        {0}to *
         by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
         by * read
      state: exact

  - name: Create top of LDAP tree
    ldap_entry:
      dn: dc=example,dc=org
      objectClass:
        - dcObject
        - organization
      attributes:
        o: example
        dc: example

  - name: Create OU for users
    ldap_entry:
      dn: ou=users,dc=example,dc=org
      objectClass: organizationalUnit

  - name: Create OU for groups
    ldap_entry:
      dn: ou=groups,dc=example,dc=org
      objectClass: organizationalUnit

  - name: Check installed schemas
    find:
      paths: /etc/openldap/slapd.d/cn=config/cn=schema
    register: findschemas

  - name: Create list of found schemas
    set_fact:
      installedschemas: "{{ findschemas.files | map(attribute='path') | map('basename') | map('regex_replace','cn={.*}(.*).ldif','\\1') | list }}"
      # files is a dict of "stat" results. The first map just pulls out the path.
      # the 2nd map applies basename to all those results to get just the filename
      # the installed schema is cn={#}NAME.ldif, so we use a regex_replace to get just NAME

  - name: Install cosine schema
    shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
    when: not ( "cosine" in installedschemas )

  - name: Install inetorgperson schema
    shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
    when: not ( "inetorgperson" in installedschemas )

  - name: Install nis schema
    shell: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
    when: not ( "nis" in installedschemas )

  # Place restrictions on userPassword attribute
  # http://www.openldap.org/doc/admin24/guide.html#Basic ACLs
  - name:  Restrict access to userPassword attribute
    ldap_attr:
      dn: olcDatabase={2}hdb,cn=config
      name: olcAccess
      values:
      - >-
        {0}to attrs=userPassword
          by self =xw
          by anonymous auth
          by * none
      state: present

  - name: Create faculty/staff group
    ldap_entry:
      dn: cn=facstaff,ou=groups,dc=example,dc=org
      objectClass: posixGroup
      attributes:
        cn: facstaff
        gidNumber: 10000

  - name: Create student group
    ldap_entry:
      dn: cn=student,ou=groups,dc=example,dc=org
      objectClass: posixGroup
      attributes:
        cn: student
        gidNumber: 10001

  - name: Create Nick Danger
    ldap_entry:
      dn: uid=danger,ou=users,dc=example,dc=org
      objectClass:
        - account
        - posixAccount
        - shadowAccount
      attributes:
        cn: danger
        uid: danger
        gecos: "Nick Danger"
        uidNumber: 10000
        gidNumber: 10000
        homeDirectory: /home/danger
        # Generated with: slappasswd -s nicksyourbuddy
        userPassword: "{SSHA}AslzrpM+OR/qAoeoOsnqfElGAZqTz3Ny"
        loginShell: /bin/bash

  - name: Create Josh Isaknob
    ldap_entry:
      dn: uid=isaknob,ou=users,dc=example,dc=org
      objectClass:
        - account
        - posixAccount
        - shadowAccount
      attributes:
        cn: isaknob
        uid: isaknob
        gecos: "Josh Isaknob"
        uidNumber: 10001
        gidNumber: 10001
        homeDirectory: /home/isaknob
        # Generated with: slappasswd -s mmmveggies
        userPassword: "{SSHA}32o227wHOoR7Oz0GGX/O++Gihkc6z7s4"
        loginShell: /bin/bash

  - name: Johnny Hashmark
    ldap_entry:
      dn: uid=hashmark,ou=users,dc=example,dc=org
      objectClass:
        - account
        - posixAccount
        - shadowAccount
      attributes:
        cn: hashmark
        uid: hashmark
        gecos: "Johnny Hashmark"
        uidNumber: 10002
        gidNumber: 10001
        homeDirectory: /home/hashmark
        # Generated with: slappasswd -s 'cucumber!!'
        userPassword: "{SSHA}0yn3FQE7W8Tw429wtpUuRnoRJr7pzg2h"
        loginShell: /bin/bash

  - name: Fetch generated self-signed OpenLDAP cert
    command: certutil -L -d /etc/openldap/certs -a -n 'OpenLDAP Server'
    register: openldap_cert
    changed_when: false

  - name: Copy server cert to client
    copy:
      content: "{{ openldap_cert.stdout }}\n"
      dest: /etc/openldap/certs/auth.example.org.pem
      owner: root
      group: root
      mode: 0644
    delegate_to: somebox

- hosts: somebox
  become: true

  tasks:
  - name: Get contents of server cert
    slurp:
      src: /etc/openldap/certs/auth.example.org.pem
    register: servercert

  - name: Check if the server cert is in the cert db
    shell: certutil -L -d /etc/openldap/certs -n 'OpenLDAP Server' -a
    register: certonclient
    changed_when: false
    failed_when: false

  - name: Check trust settings for server cert
    shell: certutil -L -d /etc/openldap/certs | awk '/OpenLDAP Server/ { print $NF }'
    register: trustsettings
    changed_when: false
    when: certonclient.rc == 0

  - name: Remove server cert from trust store if its not correct
    command: certutil -D -d /etc/openldap/certs -n 'OpenLDAP Server'
    when: certonclient.rc == 0 and certonclient.stdout | replace('\n', '')  != servercert['content'] | b64decode | replace('\n', '') 

  - name: Install server cert to client OpenLDAP cert db
    shell: certutil -A -d /etc/openldap/certs -n 'OpenLDAP Server' -t CT -a -i /etc/openldap/certs/auth.example.org.pem
    when: ( certonclient.rc != 0 ) or ( trustsettings.stdout != 'CT,,' )

  - name: Install sssd packages
    package:
      name: "{{ item }}"
      state: present
    with_items:
      - sssd
      - sssd-ldap

  - name: Install sssd config
    copy:
      src: sssd.conf
      dest: /etc/sssd/sssd.conf
      owner: root
      group: root
      mode: 0600
    notify: Restart sssd

  - name: Start sssd service
    service:
      name: sssd
      state: started
      enabled: true

  - name: Enable sssd auth
    lineinfile:
      path: /etc/sysconfig/authconfig
      regexp: '^USESSSDAUTH='
      line: 'USESSSDAUTH=yes'
    notify: Update authconfig

  - name: Enable mkhomedir
    lineinfile:
      path: /etc/sysconfig/authconfig
      regexp: '^USEMKHOMEDIR='
      line: 'USEMKHOMEDIR=yes'
    notify: Update authconfig

  handlers:
  - name: Restart sssd
    service:
      name: sssd
      state: restarted

  - name: Update authconfig
    command: /sbin/authconfig --updateall