Try SpotterAdd or remove multiple LDAP attribute values
| "added in version" 0.2.0 of community.general"
Authors: Jiri Tyr (@jtyr), Alexander Korinek (@noles), Maciej Delmanowski (@drybjed)
Install with ansible-galaxy collection install community.general:==8.5.0
collections:
- name: community.general
version: 8.5.0Add or remove multiple LDAP attribute values.
- name: Configure directory number 1 for example.com
community.general.ldap_attrs:
dn: olcDatabase={1}hdb,cn=config
attributes:
olcSuffix: dc=example,dc=com
state: exact
# The complex argument format is required here to pass a list of ACL strings.
- name: Set up the ACL
community.general.ldap_attrs:
dn: olcDatabase={1}hdb,cn=config
attributes:
olcAccess:
- >-
{0}to attrs=userPassword,shadowLastChange
by self write
by anonymous auth
by dn="cn=admin,dc=example,dc=com" write
by * none'
- >-
{1}to dn.base="dc=example,dc=com"
by dn="cn=admin,dc=example,dc=com" write
by * read
state: exact
# An alternative approach with automatic X-ORDERED numbering
- name: Set up the ACL
community.general.ldap_attrs:
dn: olcDatabase={1}hdb,cn=config
attributes:
olcAccess:
- >-
to attrs=userPassword,shadowLastChange
by self write
by anonymous auth
by dn="cn=admin,dc=example,dc=com" write
by * none'
- >-
to dn.base="dc=example,dc=com"
by dn="cn=admin,dc=example,dc=com" write
by * read
ordered: true
state: exact
- name: Declare some indexes
community.general.ldap_attrs:
dn: olcDatabase={1}hdb,cn=config
attributes:
olcDbIndex:
- objectClass eq
- uid eq
- name: Set up a root user, which we can use later to bootstrap the directory
community.general.ldap_attrs:
dn: olcDatabase={1}hdb,cn=config
attributes:
olcRootDN: cn=root,dc=example,dc=com
olcRootPW: "{SSHA}tabyipcHzhwESzRaGA7oQ/SDoBZQOGND"
state: exact
- name: Remove an attribute with a specific value
community.general.ldap_attrs:
dn: uid=jdoe,ou=people,dc=example,dc=com
attributes:
description: "An example user account"
state: absent
server_uri: ldap://localhost/
bind_dn: cn=admin,dc=example,dc=com
bind_pw: password
- name: Remove specified attribute(s) from an entry
community.general.ldap_attrs:
dn: uid=jdoe,ou=people,dc=example,dc=com
attributes:
description: []
state: exact
server_uri: ldap://localhost/
bind_dn: cn=admin,dc=example,dc=com
bind_pw: password
dn:
description:
- The DN of the entry to add or remove.
required: true
type: str
state:
choices:
- present
- absent
- exact
default: present
description:
- The state of the attribute values. If V(present), all given attribute values will
be added if they're missing. If V(absent), all given attribute values will be removed
if present. If V(exact), the set of attribute values will be forced to exactly those
provided and no others. If O(state=exact) and the attribute value is empty, all
values for this attribute will be removed.
required: false
type: str
bind_dn:
description:
- A DN to bind with. If this is omitted, we'll try a SASL bind with the EXTERNAL mechanism
as default.
- If this is blank, we'll use an anonymous bind.
type: str
bind_pw:
default: ''
description:
- The password to use with O(bind_dn).
type: str
ca_path:
description:
- Set the path to PEM file with CA certs.
type: path
version_added: 6.5.0
version_added_collection: community.general
ordered:
default: false
description:
- If V(true), prepend list values with X-ORDERED index numbers in all attributes specified
in the current task. This is useful mostly with C(olcAccess) attribute to easily
manage LDAP Access Control Lists.
required: false
type: bool
start_tls:
default: false
description:
- If true, we'll use the START_TLS LDAP extension.
type: bool
attributes:
description:
- The attribute(s) and value(s) to add or remove.
- Each attribute value can be a string for single-valued attributes or a list of strings
for multi-valued attributes.
- If you specify values for this option in YAML, please note that you can improve
readability for long string values by using YAML block modifiers as seen in the
examples for this module.
- Note that when using values that YAML/ansible-core interprets as other types, like
V(yes), V(no) (booleans), or V(2.10) (float), make sure to quote them if these are
meant to be strings. Otherwise the wrong values may be sent to LDAP.
required: true
type: dict
client_key:
description:
- PEM formatted file that contains your private key to be used for SSL client authentication.
- Required if O(client_cert) is defined.
type: path
version_added: 7.1.0
version_added_collection: community.general
sasl_class:
choices:
- external
- gssapi
default: external
description:
- The class to use for SASL authentication.
type: str
version_added: 2.0.0
version_added_collection: community.general
server_uri:
default: ldapi:///
description:
- The O(server_uri) parameter may be a comma- or whitespace-separated list of URIs
containing only the schema, the host, and the port fields.
- The default value lets the underlying LDAP client library look for a UNIX domain
socket in its default location.
- Note that when using multiple URIs you cannot determine to which URI your client
gets connected.
- For URIs containing additional fields, particularly when using commas, behavior
is undefined.
type: str
client_cert:
description:
- PEM formatted certificate chain file to be used for SSL client authentication.
- Required if O(client_key) is defined.
type: path
version_added: 7.1.0
version_added_collection: community.general
validate_certs:
default: true
description:
- If set to V(false), SSL certificates will not be validated.
- This should only be used on sites using self-signed certificates.
type: bool
xorder_discovery:
choices:
- enable
- auto
- disable
default: auto
description:
- Set the behavior on how to process Xordered DNs.
- V(enable) will perform a C(ONELEVEL) search below the superior RDN to find the matching
DN.
- V(disable) will always use the DN unmodified (as passed by the O(dn) parameter).
- V(auto) will only perform a search if the first RDN does not contain an index number
(C({x})).
type: str
version_added: 6.4.0
version_added_collection: community.general
referrals_chasing:
choices:
- disabled
- anonymous
default: anonymous
description:
- Set the referrals chasing behavior.
- V(anonymous) follow referrals anonymously. This is the default behavior.
- V(disabled) disable referrals chasing. This sets C(OPT_REFERRALS) to off.
type: str
version_added: 2.0.0
version_added_collection: community.general
modlist:
description: list of modified parameters
returned: success
sample:
- - 2
- olcRootDN
- - cn=root,dc=example,dc=com
type: list