diff -up ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py
--- ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py 2022-10-07 16:51:35.750411448 +0200
@@ -182,6 +182,9 @@ options:
skip_conncheck:
description: Skip connection check to remote master
required: yes
+ sid_generation_always:
+ description: Enable SID generation always
+ required: yes
author:
- Thomas Woerner
'''
@@ -275,6 +278,8 @@ def main():
# additional
server=dict(required=True),
skip_conncheck=dict(required=False, type='bool'),
+ sid_generation_always=dict(required=False, type='bool',
+ default=False),
),
supports_check_mode=True,
)
@@ -350,6 +355,7 @@ def main():
# '_hostname_overridden')
options.server = ansible_module.params.get('server')
options.skip_conncheck = ansible_module.params.get('skip_conncheck')
+ sid_generation_always = ansible_module.params.get('sid_generation_always')
# init #
@@ -755,7 +761,7 @@ def main():
ansible_log.debug("-- CHECK ADTRUST --")
- if options.setup_adtrust:
+ if options.setup_adtrust or sid_generation_always:
adtrust.install_check(False, options, remote_api)
except errors.ACIError:
diff -up ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py
--- ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py 2022-10-07 16:44:59.008094369 +0200
@@ -71,6 +71,9 @@ options:
setup_ca:
description: Configure a dogtag CA
required: no
+ setup_adtrust:
+ description: Configure AD trust capability
+ required: yes
config_master_host_name:
description: The config master_host_name setting
required: no
@@ -112,6 +115,7 @@ def main():
ccache=dict(required=True),
_top_dir=dict(required=True),
setup_ca=dict(required=True, type='bool'),
+ setup_adtrust=dict(required=True, type='bool'),
config_master_host_name=dict(required=True),
),
supports_check_mode=True,
@@ -140,6 +144,7 @@ def main():
os.environ['KRB5CCNAME'] = ccache
options._top_dir = ansible_module.params.get('_top_dir')
options.setup_ca = ansible_module.params.get('setup_ca')
+ options.setup_adtrust = ansible_module.params.get('setup_adtrust')
config_master_host_name = ansible_module.params.get(
'config_master_host_name')
adtrust.netbios_name = ansible_module.params.get('adtrust_netbios_name')
diff -up ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py
--- ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py 2022-10-07 16:50:45.621497736 +0200
@@ -144,7 +144,7 @@ from ansible.module_utils.ansible_ipa_re
ansible_module_get_parsed_ip_addresses, service,
redirect_stdout, create_ipa_conf, ipautil,
x509, validate_domain_name, common_check,
- IPA_PYTHON_VERSION
+ IPA_PYTHON_VERSION, adtrustinstance
)
@@ -271,6 +271,14 @@ def main():
# # options.setup_adtrust = False
# # ansible_module.warn(msg="adtrust is not supported, disabling")
+ sid_generation_always = False
+ if not options.setup_adtrust:
+ # pylint: disable=deprecated-method
+ argspec = inspect.getargspec(adtrustinstance.ADTRUSTInstance.__init__)
+ # pylint: enable=deprecated-method
+ if "fulltrust" in argspec.args:
+ sid_generation_always = True
+
# if options.setup_kra and not kra_imported:
# # if "kra" not in options._allow_missing:
# ansible_module.fail_json(msg="kra can not be imported")
@@ -472,6 +480,7 @@ def main():
# additional
client_enrolled=client_enrolled,
change_master_for_certmonger=change_master_for_certmonger,
+ sid_generation_always=sid_generation_always
)
diff -up ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py
--- ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py 2022-10-07 16:54:27.707115487 +0200
@@ -46,7 +46,8 @@ __all__ = ["contextlib", "dnsexception",
"common_check", "current_domain_level",
"check_domain_level_is_supported", "promotion_check_ipa_domain",
"SSSDConfig", "CalledProcessError", "timeconf", "ntpinstance",
- "dnsname", "kernel_keyring", "krbinstance"]
+ "dnsname", "kernel_keyring", "krbinstance",
+ "adtrustinstance"]
import sys
@@ -105,6 +106,7 @@ else:
adtrust, bindinstance, ca, certs, dns, dsinstance, httpinstance,
installutils, kra, krbinstance,
otpdinstance, custodiainstance, service, upgradeinstance)
+ from ipaserver.install import adtrustinstance
try:
from ipaserver.masters import (
find_providing_servers, find_providing_server)
diff -up ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml.always_sids ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml
--- ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml 2022-10-07 16:44:59.008094369 +0200
@@ -748,13 +748,15 @@
ccache: "{{ result_ipareplica_prepare.ccache }}"
_top_dir: "{{ result_ipareplica_prepare._top_dir }}"
setup_ca: "{{ result_ipareplica_prepare.config_setup_ca }}"
+ setup_adtrust: "{{ result_ipareplica_test.setup_adtrust }}"
config_master_host_name:
"{{ result_ipareplica_prepare.config_master_host_name }}"
adtrust_netbios_name:
"{{ result_ipareplica_prepare.adtrust_netbios_name }}"
adtrust_reset_netbios_name:
"{{ result_ipareplica_prepare.adtrust_reset_netbios_name }}"
- when: result_ipareplica_test.setup_adtrust
+ when: result_ipareplica_test.setup_adtrust or
+ result_ipareplica_test.sid_generation_always
- name: Install - Enable IPA
ipareplica_enable_ipa:
diff -up ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py.always_sids ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py
--- ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py 2022-10-07 16:47:45.005808635 +0200
@@ -141,6 +141,9 @@ options:
setup_ca:
description: Configure a dogtag CA
required: yes
+ sid_generation_always:
+ description: Enable SID generation always
+ required: yes
_hostname_overridden:
description: The installer _hostname_overridden setting
required: yes
@@ -213,6 +216,8 @@ def main():
# additional
setup_ca=dict(required=False, type='bool', default=False),
+ sid_generation_always=dict(required=False, type='bool',
+ default=False),
_hostname_overridden=dict(required=False, type='bool',
default=False),
),
@@ -279,6 +284,7 @@ def main():
options.setup_ca = ansible_module.params.get('setup_ca')
options._host_name_overridden = ansible_module.params.get(
'_hostname_overridden')
+ sid_generation_always = ansible_module.params.get('sid_generation_always')
options.kasp_db_file = None
# init ##################################################################
@@ -371,7 +377,7 @@ def main():
logger.debug('Starting Directory Server')
services.knownservices.dirsrv.start(instance_name)
- if options.setup_adtrust:
+ if options.setup_adtrust or sid_generation_always:
with redirect_stdout(ansible_log):
adtrust.install_check(False, options, api)
diff -up ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py.always_sids ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py
--- ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py 2022-10-07 16:46:12.413968014 +0200
@@ -226,7 +226,7 @@ from ansible.module_utils.ansible_ipa_se
read_cache, ca, tasks, check_ldap_conf, timeconf, httpinstance,
check_dirsrv, ScriptError, get_fqdn, verify_fqdn, BadHostError,
validate_domain_name, load_pkcs12, IPA_PYTHON_VERSION,
- encode_certificate, check_available_memory
+ encode_certificate, check_available_memory, adtrustinstance
)
from ansible.module_utils import six
@@ -395,12 +395,16 @@ def main():
# version specific ######################################################
- if options.setup_adtrust and not adtrust_imported:
- # if "adtrust" not in options._allow_missing:
- ansible_module.fail_json(msg="adtrust can not be imported")
- # else:
- # options.setup_adtrust = False
- # ansible_module.warn(msg="adtrust is not supported, disabling")
+ sid_generation_always = False
+ if not options.setup_adtrust:
+ # pylint: disable=deprecated-method
+ argspec = inspect.getargspec(adtrustinstance.ADTRUSTInstance.__init__)
+ # pylint: enable=deprecated-method
+ if "fulltrust" in argspec.args:
+ sid_generation_always = True
+ else:
+ if not adtrust_imported:
+ ansible_module.fail_json(msg="adtrust can not be imported")
if options.setup_kra and not kra_imported:
# if "kra" not in options._allow_missing:
@@ -522,7 +526,8 @@ def main():
"You cannot specify an --enable-compat option without the "
"--setup-adtrust option")
- if self.netbios_name:
+ # Deactivate test for new IPA SID generation
+ if self.netbios_name and not sid_generation_always:
raise RuntimeError(
"You cannot specify a --netbios-name option without the "
"--setup-adtrust option")
@@ -1079,7 +1084,8 @@ def main():
ntp_pool=options.ntp_pool,
# additional
_installation_cleanup=_installation_cleanup,
- domainlevel=options.domainlevel)
+ domainlevel=options.domainlevel,
+ sid_generation_always=sid_generation_always)
if __name__ == '__main__':
diff -up ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml.always_sids ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml
--- ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml.always_sids 2022-01-27 14:05:04.000000000 +0100
+++ ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml 2022-10-07 16:48:36.946719227 +0200
@@ -191,6 +191,7 @@
secondary_rid_base: "{{ ipaserver_secondary_rid_base | default(omit) }}"
### additional ###
setup_ca: "{{ result_ipaserver_test.setup_ca }}"
+ sid_generation_always: "{{ result_ipaserver_test.sid_generation_always }}"
_hostname_overridden: "{{ result_ipaserver_test._hostname_overridden }}"
register: result_ipaserver_prepare
@@ -392,7 +393,8 @@
adtrust_netbios_name: "{{ result_ipaserver_prepare.adtrust_netbios_name }}"
adtrust_reset_netbios_name:
"{{ result_ipaserver_prepare.adtrust_reset_netbios_name }}"
- when: result_ipaserver_test.setup_adtrust
+ when: result_ipaserver_test.setup_adtrust or
+ result_ipaserver_test.sid_generation_always
- name: Install - Set DS password
ipaserver_set_ds_password: