Finally, use a service for the stage users cleanup script

Signed-off-by: Aurélien Bompard <aurelien@bompard.org>

roles/ipa/server/tasks/main.yml

@@ -538,9 +538,6 @@
   when: ipa_initial
 
 
-- import_tasks: scripts.yml
-
-
 - name: Destroy admin ticket
   command: kdestroy -A
   tags:
@@ -550,6 +547,9 @@
   when: ipa_initial
 
 
+- import_tasks: scripts.yml
+
+
 # User groups
 
 - name: Set the members of the admin group

roles/ipa/server/tasks/scripts.yml

@@ -13,16 +13,17 @@
 #
 # Cleanup stage users
 #
-- name: Create script user to cleanup stage users
-  ipauser:
-    name: sys-cleanup-stage-users
-    givenname: Cleanup stage users
-    sn: Script
-    userclass: system
-    ipaadmin_password: "{{ ipa_admin_password }}"
-  tags:
-  - ipa/server
-  - config
+- name: Create the service for stage users
+  include_role:
+    name: keytab/service
+    apply:
+      tags:
+      - ipa/server
+      - config
+      - keytab
+  vars:
+    host: {{ ipa_server }}
+    service: stage-users
 
 
 - name: Create the Stage User Administrator role
@@ -31,22 +32,13 @@
     description: "Role for users that need to perform admin tasks on stage users."
     privilege:
     - "Stage User Administrators"
-    user:
-    - sys-cleanup-stage-users
+    service:
+    - "stage-users/{{ ipa_server }}"
     ipa_host: "{{ inventory_hostname }}"
     ipa_user: admin
     ipa_pass: "{{ipa_admin_password}}"
     validate_certs: no
-  tags:
-  - ipa/server
-  - config
-
-
-- name: Get the keytab for the stage users cleanup script
-  include_role:
-    name: keytab/user
-  vars:
-    user: sys-cleanup-stage-users
+  run_once: yes
   tags:
   - ipa/server
   - config

roles/keytab/user/defaults/main.yml

@@ -1,4 +0,0 @@
-owner_user: root
-owner_group: root
-host: "{{inventory_hostname }}"
-kt_location: "/etc/krb5.{{user}}.keytab"

roles/keytab/user/tasks/main.yml

@@ -1,67 +0,0 @@
----
-- name: Determine whether we need to get keytab
-  stat: path={{kt_location}}
-  register: keytab_status
-  check_mode: no
-  changed_when: "1 != 1"
-  tags:
-  - keytab
-  - config
-  - krb5
-
-- name: Get admin ticket
-  delegate_to: "{{ ipa_server }}"
-  shell: echo "{{ipa_admin_password}}" | kinit admin
-  check_mode: no
-  changed_when: "1 != 1"
-  tags:
-  - keytab
-  - config
-  - krb5
-  when: not keytab_status.stat.exists
-
-- name: Retrieve keytab
-  delegate_to: "{{ ipa_server }}"
-  command: ipa-getkeytab --retrieve --server {{ipa_server}} --keytab {{kt_location}} --principal {{user}}
-  register: retrieve_result
-  check_mode: no
-  changed_when: "1 != 1"
-  failed_when: "not ('Keytab successfully retrieved' in retrieve_result.stderr or 'krbPrincipalKey not found' in retrieve_result.stderr)"
-  tags:
-  - keytab
-  - config
-  - krb5
-  when: not keytab_status.stat.exists
-
-- name: Create keytab if it did not exist
-  delegate_to: "{{ ipa_server }}"
-  command: ipa-getkeytab --server {{ipa_server}} --keytab {{kt_location}} --principal {{user}}
-  tags:
-  - keytab
-  - config
-  - krb5
-  when: not keytab_status.stat.exists and 'krbPrincipalKey not found' in retrieve_result.stderr
-
-- name: Destroy admin ticket
-  delegate_to: "{{ ipa_server }}"
-  command: kdestroy -A
-  tags:
-  - keytab
-  - config
-  - krb5
-  when: not keytab_status.stat.exists
-
-- name: Set keytab permissions
-  file: path={{kt_location}} owner={{owner_user}} group={{owner_group}} mode=0640 state=file
-  tags:
-  - keytab
-  - config
-  - krb5
-
-- name: Set keytab ACL
-  acl: name={{kt_location}} entity={{extra_acl_user}} etype=user permissions=r state=present
-  tags:
-  - keytab
-  - config
-  - krb5
-  when: extra_acl_user is defined