From c2b5a91b2ef4e703da930f801cfefe5162465a74 Mon Sep 17 00:00:00 2001 From: Daniel Berteaud Date: Thu, 28 Jan 2021 14:00:07 +0100 Subject: [PATCH] Update to 2021-01-28 14:00 --- roles/sssd_ad_auth/defaults/main.yml | 3 +++ roles/sssd_ad_auth/tasks/main.yml | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/roles/sssd_ad_auth/defaults/main.yml b/roles/sssd_ad_auth/defaults/main.yml index a3f8274..b5161d8 100644 --- a/roles/sssd_ad_auth/defaults/main.yml +++ b/roles/sssd_ad_auth/defaults/main.yml @@ -11,6 +11,9 @@ ad_default_shell: /bin/false # If access control should evaluate domain GPO. Can be disabled, eforcing or permissive. See man sssd-ad ad_gpo_access_control: permissive +# If set to True, ansible will re join the host to the domain +ad_force_join: False + # sssd doesn't support cross forest approbations, but we can add the Linux box to the other domains ad_trusted_domains: "{{ samba_trusted_domains | default([]) }}" # ad_trusted_domains: diff --git a/roles/sssd_ad_auth/tasks/main.yml b/roles/sssd_ad_auth/tasks/main.yml index 97b1bfd..99aee4a 100644 --- a/roles/sssd_ad_auth/tasks/main.yml +++ b/roles/sssd_ad_auth/tasks/main.yml @@ -29,6 +29,11 @@ template: src=krb5.conf.j2 dest=/etc/krb5.conf tags: auth +- name: Remove current keytab + file: path=/etc/krb5.keytab state=absent + when: ad_force_join | bool + tags: auth + - name: Check if we already have our keytab file stat: path=/etc/krb5.keytab register: ad_keytab