diff --git a/roles/ldap_server/tasks/main.yml b/roles/ldap_server/tasks/main.yml index 37d4d516a65970125bcfdd0f569b20a122754e03..e3d64f87b2974cdf6afaf1dd2cc629537f740945 100644 --- a/roles/ldap_server/tasks/main.yml +++ b/roles/ldap_server/tasks/main.yml @@ -1,26 +1,26 @@ --- - name: Set domain for slapd - debconf: + ansible.builtin.debconf: name: slapd question: slapd/domain vtype: string value: "{{ ldap_server_domain }}" - name: Set organisation for slapd - debconf: + ansible.builtin.debconf: name: slapd question: shared/organization vtype: string value: "{{ ldap_server_organization }}" - name: Install slapd - apt: + ansible.builtin.apt: name: slapd state: present - name: Allow OpenLDAP user to traverse the directory with TLS private keys - user: + ansible.builtin.user: name: openldap append: true groups: ssl-cert @@ -31,18 +31,18 @@ # In order to be able to change LDAP server TLS configuration, it must be # able to read both the private key and certificate. Therefore we need to # immediatelly restart (since configuration is done live on the server. - service: + ansible.builtin.service: name: slapd state: restarted when: openldap_in_ssl_cert.changed - name: Install Python LDAP bindings - apt: + ansible.builtin.apt: name: python3-pyldap state: present - name: Set-up LDAP server to listen on legacy SSL port - lineinfile: + ansible.builtin.lineinfile: dest: /etc/default/slapd state: present backrefs: true @@ -52,7 +52,7 @@ - Restart slapd - name: Enable and start slapd service - service: + ansible.builtin.service: name: slapd state: started enabled: true @@ -65,12 +65,12 @@ values: "{{ ldap_server_log_level }}" - name: Test if LDAP misc schema has been applied - command: "ldapsearch -H ldapi:/// -Q -LLL -A -Y EXTERNAL -b cn=schema,cn=config -s one '(cn={*}misc)' cn" + ansible.builtin.command: "ldapsearch -H ldapi:/// -Q -LLL -A -Y EXTERNAL -b cn=schema,cn=config -s one '(cn={*}misc)' cn" register: ldap_misc_schema_present changed_when: false - name: Deploy LDAP misc schema - command: "ldapadd -H ldapi:/// -Q -Y EXTERNAL -f /etc/ldap/schema/misc.ldif" + ansible.builtin.command: "ldapadd -H ldapi:/// -Q -Y EXTERNAL -f /etc/ldap/schema/misc.ldif" when: not ldap_misc_schema_present.stdout changed_when: true # Always results in change due to task logic. @@ -79,7 +79,7 @@ # against under Debian) picking a matching DH parameter from RFC-7919 # (https://www.ietf.org/rfc/rfc7919.txt). - name: Generate the LDAP server Diffie-Hellman parameter - openssl_dhparam: + community.crypto.openssl_dhparam: owner: root group: openldap mode: "0640" @@ -89,7 +89,7 @@ - Restart slapd - name: Deploy LDAP TLS private key - template: + ansible.builtin.template: src: "ldap_tls_key.j2" dest: "/etc/ssl/private/{{ ansible_fqdn }}_ldap.key" mode: "0640" @@ -99,7 +99,7 @@ - Restart slapd - name: Deploy LDAP TLS certificate - template: + ansible.builtin.template: src: "ldap_tls_cert.j2" dest: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem" mode: "0644" @@ -109,7 +109,7 @@ - Restart slapd - name: Deploy configuration file for checking certificate validity via cron - copy: + ansible.builtin.copy: content: "/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem" dest: "/etc/check_certificate/{{ ansible_fqdn }}_ldap.conf" owner: root @@ -193,7 +193,7 @@ values: "{1}memberof" - name: Enable the memberof overlay for database - ldap_entry: + community.general.ldap_entry: dn: "olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config" objectClass: - olcConfig @@ -211,12 +211,12 @@ rules: "{{ ldap_permissions }}" - name: Drop the admin entry corresponding to olcRootDN for database from directory - ldap_entry: + community.general.ldap_entry: dn: "cn=admin,{{ ldap_server_int_basedn }}" state: absent - name: Create basic LDAP directory structure - ldap_entry: + community.general.ldap_entry: dn: "ou={{ item }},{{ ldap_server_int_basedn }}" objectClass: - organizationalUnit @@ -228,7 +228,7 @@ - services - name: Create the entry that will contain mail service information - ldap_entry: + community.general.ldap_entry: dn: "ou=mail,ou=services,{{ ldap_server_int_basedn }}" objectClass: - organizationalUnit @@ -236,7 +236,7 @@ ou: mail - name: Create LDAP directory structure for mail service - ldap_entry: + community.general.ldap_entry: dn: "ou={{ item }},ou=mail,ou=services,{{ ldap_server_int_basedn }}" objectClass: - organizationalUnit @@ -247,7 +247,7 @@ - aliases - name: Create or remove login entries for services - ldap_entry: + community.general.ldap_entry: dn: "cn={{ item.name }},ou=services,{{ ldap_server_int_basedn }}" objectClass: - applicationProcess @@ -268,7 +268,7 @@ when: "item.state | default('present') == 'present'" - name: Create or remove user-supplied groups - ldap_entry: + community.general.ldap_entry: dn: "cn={{ item.name }},ou=groups,{{ ldap_server_int_basedn }}" objectClass: - groupOfUniqueNames @@ -279,7 +279,7 @@ with_items: "{{ ldap_server_groups }}" - name: Create user-supplied LDAP entries - ldap_entry: + community.general.ldap_entry: dn: "{{ item.dn }}" objectClass: "{{ item.attributes.objectClass }}" attributes: "{{ item.attributes }}" @@ -287,7 +287,7 @@ with_items: "{{ ldap_entries }}" - name: Deploy firewall configuration for LDAP - copy: + ansible.builtin.copy: src: "ferm_ldap.conf" dest: "/etc/ferm/conf.d/10-ldap.conf" owner: root @@ -300,7 +300,7 @@ # was in use (where community collection has the ldap_search # module. - name: Deploy temporary file with LDAP admin password - template: + ansible.builtin.template: src: "ldap_admin_password.j2" dest: "/root/.ldap_admin_password" owner: root @@ -309,7 +309,7 @@ changed_when: false - name: Test if LDAP admin password needs to be changed - command: "ldapwhoami -H ldapi:/// -D 'cn=admin,{{ ldap_server_int_basedn }}' -x -y /root/.ldap_admin_password" + ansible.builtin.command: "ldapwhoami -H ldapi:/// -D 'cn=admin,{{ ldap_server_int_basedn }}' -x -y /root/.ldap_admin_password" register: ldap_admin_password_check changed_when: ldap_admin_password_check.rc != 0 failed_when: false @@ -323,17 +323,17 @@ when: ldap_admin_password_check.rc != 0 - name: Remove temporary file with LDAP admin password - file: + ansible.builtin.file: path: "/root/.ldap_admin_password" state: absent changed_when: false - name: Enable backup - include_tasks: backup.yml + ansible.builtin.include_tasks: backup.yml when: enable_backup - name: Explicitly run all handlers - include_tasks: ../handlers/main.yml + ansible.builtin.include_tasks: ../handlers/main.yml when: "run_handlers | default(False) | bool()" tags: - handlers