diff options
| author | Patrick Uiterwijk <puiterwijk@redhat.com> | 2016-11-28 10:31:35 +0000 |
|---|---|---|
| committer | Patrick Uiterwijk <puiterwijk@redhat.com> | 2016-11-28 10:31:35 +0000 |
| commit | 7bd1227d59138348f47b4fb60400a70d49d6e4c2 (patch) | |
| tree | 56d6c69e7a16d4f457e14f72a7c6a69616a73313 /roles/ipa | |
| parent | c10926358f3aaa426c33363a969e075824ea27d1 (diff) | |
| download | ansible-7bd1227d59138348f47b4fb60400a70d49d6e4c2.tar.gz ansible-7bd1227d59138348f47b4fb60400a70d49d6e4c2.tar.xz ansible-7bd1227d59138348f47b4fb60400a70d49d6e4c2.zip | |
Deploy custom LDIF scripts
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Diffstat (limited to 'roles/ipa')
| -rw-r--r-- | roles/ipa/server/files/grant_anonymous_replication_view.ldif | 4 | ||||
| -rw-r--r-- | roles/ipa/server/tasks/main.yml | 21 |
2 files changed, 25 insertions, 0 deletions
diff --git a/roles/ipa/server/files/grant_anonymous_replication_view.ldif b/roles/ipa/server/files/grant_anonymous_replication_view.ldif new file mode 100644 index 000000000..00cf9d294 --- /dev/null +++ b/roles/ipa/server/files/grant_anonymous_replication_view.ldif @@ -0,0 +1,4 @@ +dn: cn="dc=fedoraproject,dc=org",cn=mapping tree,cn=config +changetype: modify +add: aci +aci: (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0; aci "permission:Read Replication Agreements"; allow (read, search, compare) groupdn = "ldap:///anyone";) diff --git a/roles/ipa/server/tasks/main.yml b/roles/ipa/server/tasks/main.yml index 3284cd68e..994ff1bd4 100644 --- a/roles/ipa/server/tasks/main.yml +++ b/roles/ipa/server/tasks/main.yml @@ -135,3 +135,24 @@ - ipa/server - config when: inventory_hostname.startswith("ipa01") and config_deployed.changed + +- name: Create LDIF directory + file: path=/root/ldif state=directory user=root group=root mode=0750 + tags: + - ipa/server + - config + +- name: Copy LDIF files + copy: src={{item}} dest=/root/ldif/{{item}} + with_items: + - grant_anonymous_replication_view.ldif + tags: + - ipa/server + - config + +- name: Grant access to replication status + command: ldapmodify -Y EXTERNAL -H ldapi://%2fvar%2frun%2fslapd-FEDORAPROJECT-ORG.socket + -f /root/ldif/grant_anonymous_replication_view.ldif + register: grant_repl_status_output + changed_when: "'Type or value exists' not in grant_repl_status_output.stderr" + failed_when: "'Type or value exists' not in grant_repl_status_output.stderr and 'modifying entry' not in grant_repl_status_output.stdout" |