# Ansible plugin for FreeIPA **URL:** \ **Category:** Ansible Project\ **Created:** [March 7, 2014, 10:15am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723 "2014-03-07T10:15:36Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Johan\_Soderberg](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@Johan\_Soderberg](https://forum.ansible.com/u/Johan_Soderberg)\ **Post date:** [March 7, 2014, 10:15am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/1 "2014-03-07T10:15:36Z")
Hi, I’m wondering if there has been any thought of making a FreeIPA plugin for Ansible where one would be able to administrate IPA with Ansible? Add and remove servers, groups, users etc etc. Would such a plugin make sense? Regards, /Johan ---
**Author:** ![Walid](https://avatars.discourse-cdn.com/v4/letter/w/ea5d25/32.png) [@Walid](https://forum.ansible.com/u/Walid)\ **Post date:** [March 7, 2014, 5:17pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/2 "2014-03-07T17:17:35Z")
the IPA itself has a good cli abstraction, hiding the different components behind it ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 8, 2014, 4:02am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/3 "2014-03-08T04:02:14Z")
So would you mean a series of modules to configure things? I’d be open to it. I know a lot of the FreeIPA guys from Red Hat days and they are good folks. it’s also a bit of an interesting story to use it to manage access to Ansible via sssd. ---
**Author:** ![Johan\_Soderberg](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@Johan\_Soderberg](https://forum.ansible.com/u/Johan_Soderberg)\ **Post date:** [March 10, 2014, 9:05am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/4 "2014-03-10T09:05:34Z")
Yes, I’m thinking of one or more modules that gives the system administrator the ability to do the most basic tasks directly from Ansible. My vision is to automate the whole life cycle chain of a server, from deployment, configuration, administation to decomission. In my environment we are using cobbler and ansible, these two applications together provides most of the necessary information to be used by our IPA installation. IP numbers, DNS names, group belongings etc etc. I imagine this wouldn’t be unique for my environment. As Wildi Shaari mentioned the IPA has a pretty good cli, One can of course write scripts that gets executed by Ansible, but I think that a much cleaner way would be to use Ansible directly since Ansible in itself can provide all necessary details to IPA. IPA, at least in my environment, is largely a mirror of the information available in Cobbler and Ansible. Here is an example of a task where Ansible might be able help, the task adds an entry to IPA, exports the server kerberos keytab, adds the new host entry to the kerberos keytab, transfer the new keytab to the target host: - kinit admin - SERVER=server1 ; ipa host-add $[SERVER-adm.domain.com](http://SERVER-adm.domain.com) ; ipa-getkeytab -s [ipa01.domain.com](http://ipa01.domain.com) -p host/$[SERVER.domain.com](http://SERVER.domain.com) -k /tmp/$SERVER.keytab ; ipa-getkeytab -s [ipa01.domian.com](http://ipa01.domian.com) -p host/$[SERVER-adm.domain.com](http://SERVER-adm.domain.com) -k /tmp/$SERVER.keytab - transfer they new keytab to the target server, server1:/tmp/server1.keytab - backup the existing keytab on the target server - mv /etc/krb5.keytab /tmp/krb5.keytab.$(date +%Y%m%d) - replace the existing keytab - mv /tmp/fourier.keytab /etc/krb5.keytab /Johan ---
**Author:** ![Mark\_Phillips](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Mark\_Phillips](https://forum.ansible.com/u/Mark_Phillips)\ **Post date:** [March 10, 2014, 10:30pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/5 "2014-03-10T22:30:38Z")
Interesting, and timely. Funnily enough I started looking at FreeIPA at the weekend, as part of a proposal for a current client project (where I’m building out an infra with Ansible). Naturally I’d done the initial setup with Ansible (the easy bit - ‘yum’ :-)) and was progressing to looking at what else could be done. Can’t chip in anything else useful, at the moment, but I’m keen to follow this topic closely (and hopefully contribute then!) –Mark ---
**Author:** ![Christopher\_Young](https://avatars.discourse-cdn.com/v4/letter/c/f19dbf/32.png) [@Christopher\_Young](https://forum.ansible.com/u/Christopher_Young)\ **Post date:** [May 3, 2015, 9:34pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/6 "2015-05-03T21:34:22Z")
I’m just curious is there was any progress on this? I’m looking to do very similar work. ---
**Author:** ![Johan\_Soderberg](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@Johan\_Soderberg](https://forum.ansible.com/u/Johan_Soderberg)\ **Post date:** [May 4, 2015, 2:30pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/7 "2015-05-04T14:30:58Z")
Not what I’m aware of. I ended up using the command module and it turned out quite ok. /Johan ---
**Author:** ![Thomas\_Krahn](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Thomas\_Krahn](https://forum.ansible.com/u/Thomas_Krahn)\ **Post date:** [August 3, 2016, 10:00am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/8 "2016-08-03T10:00:39Z")
> Hi All, i’ve started an Ansible Module to manage IPA entries like users, groups, sudo rules, … . Feel free to contribute: [https://github.com/Nosmoht/ansible-module-ipa.git](https://github.com/Nosmoht/ansible-module-ipa.git) Thomas ---
**Author:** ![jdelaporte](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jdelaporte/32/366_2.png) [@jdelaporte](https://forum.ansible.com/u/jdelaporte)\ **Post date:** [August 3, 2016, 1:01pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/9 "2016-08-03T13:01:11Z")
Awesome! Thank you! ---
**Author:** ![Christopher\_Young](https://avatars.discourse-cdn.com/v4/letter/c/f19dbf/32.png) [@Christopher\_Young](https://forum.ansible.com/u/Christopher_Young)\ **Post date:** [August 3, 2016, 1:10pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/10 "2016-08-03T13:10:36Z")
Yes. Thank you so much. I’ve been needing this! Where’s the Amazon wish list? Lol ---
**Author:** ![Ryan\_Groten](https://avatars.discourse-cdn.com/v4/letter/r/f9ae1b/32.png) [@Ryan\_Groten](https://forum.ansible.com/u/Ryan_Groten)\ **Post date:** [August 3, 2016, 4:07pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/11 "2016-08-03T16:07:33Z")
Awesome, been looking for something like this. You should make a pull request to ansible-modules-extras! ---
**Author:** ![Greg\_DeKoenigsberg1](https://avatars.discourse-cdn.com/v4/letter/g/838e76/32.png) [@Greg\_DeKoenigsberg1](https://forum.ansible.com/u/Greg_DeKoenigsberg1)\ **Post date:** [August 3, 2016, 4:24pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/12 "2016-08-03T16:24:44Z")
> Awesome, been looking for something like this. You should make a pull > request to ansible-modules-extras! +1, since you clearly have reviewers already lined up. 🙂 ---
**Author:** ![Thomas\_Krahn](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Thomas\_Krahn](https://forum.ansible.com/u/Thomas_Krahn)\ **Post date:** [August 4, 2016, 2:24pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/13 "2016-08-04T14:24:46Z")
I’m happy to open a PR to ansible-extra-modules but first of all i would like to implement some more modules. Please let my know what you need by creating an issue and i’ll implement missing functionality/modules. Thomas ---
**Author:** ![Thomas\_Krahn](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Thomas\_Krahn](https://forum.ansible.com/u/Thomas_Krahn)\ **Post date:** [August 18, 2016, 7:17am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/14 "2016-08-18T07:17:26Z")
> Hi All, i implement modules to manage users, groups, roles, hosts, hostgroups, HBAC rule and sudo rules. Now i need your feedback and support. If everybody is happy and there are no major bugs i’ll open a PR to ansible-extra-modules. Thomas ---
**Author:** ![Greg\_DeKoenigsberg1](https://avatars.discourse-cdn.com/v4/letter/g/838e76/32.png) [@Greg\_DeKoenigsberg1](https://forum.ansible.com/u/Greg_DeKoenigsberg1)\ **Post date:** [August 18, 2016, 2:20pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/15 "2016-08-18T14:20:27Z")
Excellent news, Thomas. Do you have a link to these modules so people can provide feedback? ---
**Author:** ![Thomas\_Krahn](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Thomas\_Krahn](https://forum.ansible.com/u/Thomas_Krahn)\ **Post date:** [August 18, 2016, 3:41pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/16 "2016-08-18T15:41:30Z")
Hi Greg, thats where you can find the modules: [https://github.com/Nosmoht/ansible-module-ipa](https://github.com/Nosmoht/ansible-module-ipa) ---
**Author:** ![Thomas\_Krahn](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@Thomas\_Krahn](https://forum.ansible.com/u/Thomas_Krahn)\ **Post date:** [October 24, 2016, 5:07pm UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/17 "2016-10-24T17:07:14Z")
> Hi All, i’m happy to announce that i’ve open a PR for ansible-modules-extras. [https://github.com/ansible/ansible-modules-extras/pull/3247](https://github.com/ansible/ansible-modules-extras/pull/3247) Feel free to test it and provide feedback. If things are good, the modules would be in Ansible 2.3. Thomas ---
**Author:** ![benny.shtark](https://avatars.discourse-cdn.com/v4/letter/b/a8b319/32.png) [@benny.shtark](https://forum.ansible.com/u/benny.shtark)\ **Post date:** [November 16, 2016, 10:24am UTC](https://forum.ansible.com/t/ansible-plugin-for-freeipa/14723/18 "2016-11-16T10:24:58Z")
Hi Thomas, First of all, thank you for great work you did on this ansible playbook for FreeIPA. I am using IPA on daily basis, and sometimes its somewhat difficult using its web interfaces as its slow and confusing… I would like to use Rundeck with your ansible playbook as a backend for user/groups/hosts management… few questions: 1. how you are managing actual access from “playbook” to IPA server (how ansible is able to talk with IPA Server? cleartext password in .yml file?) 2. any chance you have some live demo video of how it actualy works? (would be REALLY nice to see it live, especially for beginners with ansible and freeipa) thanx.