ansible / ansible.builtin / v2.7.16 / module / ldap_attr Add or remove LDAP attribute values. | "added in version" 2.3 of ansible.builtin" Authors: Jiri Tyr (@jtyr) preview | supported by communityansible.builtin.ldap_attr (v2.7.16) — module
pip
Install with pip install ansible==2.7.16
Add or remove LDAP attribute values.
- name: Configure directory number 1 for example.com ldap_attr: dn: olcDatabase={1}hdb,cn=config name: olcSuffix values: dc=example,dc=com state: exact
# The complex argument format is required here to pass a list of ACL strings. - name: Set up the ACL ldap_attr: dn: olcDatabase={1}hdb,cn=config name: olcAccess values: - >- {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none' - >- {1}to dn.base="dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by * read state: exact
- name: Declare some indexes ldap_attr: dn: olcDatabase={1}hdb,cn=config name: olcDbIndex values: "{{ item }}" with_items: - objectClass eq - uid eq
- name: Set up a root user, which we can use later to bootstrap the directory ldap_attr: dn: olcDatabase={1}hdb,cn=config name: "{{ item.key }}" values: "{{ item.value }}" state: exact with_dict: olcRootDN: cn=root,dc=example,dc=com olcRootPW: "{SSHA}tabyipcHzhwESzRaGA7oQ/SDoBZQOGND"
- name: Get rid of an unneeded attribute ldap_attr: dn: uid=jdoe,ou=people,dc=example,dc=com name: shadowExpire values: [] state: exact server_uri: ldap://localhost/ bind_dn: cn=admin,dc=example,dc=com bind_pw: password
# # The same as in the previous example but with the authentication details # stored in the ldap_auth variable: # # ldap_auth: # server_uri: ldap://localhost/ # bind_dn: cn=admin,dc=example,dc=com # bind_pw: password - name: Get rid of an unneeded attribute ldap_attr: dn: uid=jdoe,ou=people,dc=example,dc=com name: shadowExpire values: [] state: exact params: "{{ ldap_auth }}"
dn: description: - The DN of the entry to add or remove. required: true type: str name: description: - The name of the attribute to modify. required: true state: choices: - present - absent - exact default: present description: - The state of the attribute values. If C(present), all given values will be added if they're missing. If C(absent), all given values will be removed if present. If C(exact), the set of values will be forced to exactly those provided and no others. If I(state=exact) and I(value) is an empty list, all values for this attribute will be removed. values: description: - The value(s) to add or remove. This can be a string or a list of strings. The complex argument format is required in order to pass a list of strings (see examples). required: true bind_dn: description: - A DN to bind with. If this is omitted, we'll try a SASL bind with the EXTERNAL mechanism as default. - If this is blank, we'll use an anonymous bind. type: str bind_pw: default: '' description: - The password to use with O(bind_dn). type: str ca_path: description: - Set the path to PEM file with CA certs. type: path version_added: 6.5.0 version_added_collection: community.general start_tls: default: false description: - If true, we'll use the START_TLS LDAP extension. type: bool client_key: description: - PEM formatted file that contains your private key to be used for SSL client authentication. - Required if O(client_cert) is defined. type: path version_added: 7.1.0 version_added_collection: community.general sasl_class: choices: - external - gssapi default: external description: - The class to use for SASL authentication. type: str version_added: 2.0.0 version_added_collection: community.general server_uri: default: ldapi:/// description: - The O(server_uri) parameter may be a comma- or whitespace-separated list of URIs containing only the schema, the host, and the port fields. - The default value lets the underlying LDAP client library look for a UNIX domain socket in its default location. - Note that when using multiple URIs you cannot determine to which URI your client gets connected. - For URIs containing additional fields, particularly when using commas, behavior is undefined. type: str client_cert: description: - PEM formatted certificate chain file to be used for SSL client authentication. - Required if O(client_key) is defined. type: path version_added: 7.1.0 version_added_collection: community.general validate_certs: default: true description: - If set to V(false), SSL certificates will not be validated. - This should only be used on sites using self-signed certificates. type: bool xorder_discovery: choices: - enable - auto - disable default: auto description: - Set the behavior on how to process Xordered DNs. - V(enable) will perform a C(ONELEVEL) search below the superior RDN to find the matching DN. - V(disable) will always use the DN unmodified (as passed by the O(dn) parameter). - V(auto) will only perform a search if the first RDN does not contain an index number (C({x})). type: str version_added: 6.4.0 version_added_collection: community.general referrals_chasing: choices: - disabled - anonymous default: anonymous description: - Set the referrals chasing behavior. - V(anonymous) follow referrals anonymously. This is the default behavior. - V(disabled) disable referrals chasing. This sets C(OPT_REFERRALS) to off. type: str version_added: 2.0.0 version_added_collection: community.general
modlist: description: list of modified parameters returned: success sample: '[[2, "olcRootDN", ["cn=root,dc=example,dc=com"]]]' type: list