community / community.general / 8.5.0 / module / ldap_entry Add or remove LDAP entries Authors: Jiri Tyr (@jtyr)community.general.ldap_entry (8.5.0) — module
Install with ansible-galaxy collection install community.general:==8.5.0
collections: - name: community.general version: 8.5.0
Add or remove LDAP entries. This module only asserts the existence or non-existence of an LDAP entry, not its attributes. To assert the attribute values of an entry, see M(community.general.ldap_attrs).
- name: Make sure we have a parent entry for users community.general.ldap_entry: dn: ou=users,dc=example,dc=com objectClass: organizationalUnit
- name: Make sure we have an admin user community.general.ldap_entry: dn: cn=admin,dc=example,dc=com objectClass: - simpleSecurityObject - organizationalRole attributes: description: An LDAP administrator userPassword: "{SSHA}tabyipcHzhwESzRaGA7oQ/SDoBZQOGND"
- name: Set possible values for attributes elements community.general.ldap_entry: dn: cn=admin,dc=example,dc=com objectClass: - simpleSecurityObject - organizationalRole attributes: description: An LDAP Administrator roleOccupant: - cn=Chocs Puddington,ou=Information Technology,dc=example,dc=com - cn=Alice Stronginthebrain,ou=Information Technology,dc=example,dc=com olcAccess: - >- {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none' - >- {1}to dn.base="dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by * read
- name: Get rid of an old entry community.general.ldap_entry: dn: ou=stuff,dc=example,dc=com state: absent server_uri: ldap://localhost/ bind_dn: cn=admin,dc=example,dc=com bind_pw: password
# # The same as in the previous example but with the authentication details # stored in the ldap_auth variable: # # ldap_auth: # server_uri: ldap://localhost/ # bind_dn: cn=admin,dc=example,dc=com # bind_pw: password # # In the example below, 'args' is a task keyword, passed at the same level as the module - name: Get rid of an old entry community.general.ldap_entry: dn: ou=stuff,dc=example,dc=com state: absent args: "{{ ldap_auth }}"
dn: description: - The DN of the entry to add or remove. required: true type: str state: choices: - present - absent default: present description: - The target state of the entry. type: str bind_dn: description: - A DN to bind with. If this is omitted, we'll try a SASL bind with the EXTERNAL mechanism as default. - If this is blank, we'll use an anonymous bind. type: str bind_pw: default: '' description: - The password to use with O(bind_dn). type: str ca_path: description: - Set the path to PEM file with CA certs. type: path version_added: 6.5.0 version_added_collection: community.general recursive: default: false description: - If O(state=delete), a flag indicating whether a single entry or the whole branch must be deleted. type: bool version_added: 4.6.0 version_added_collection: community.general start_tls: default: false description: - If true, we'll use the START_TLS LDAP extension. type: bool attributes: default: {} description: - If O(state=present), attributes necessary to create an entry. Existing entries are never modified. To assert specific attribute values on an existing entry, use M(community.general.ldap_attrs) module instead. - Each attribute value can be a string for single-valued attributes or a list of strings for multi-valued attributes. - If you specify values for this option in YAML, please note that you can improve readability for long string values by using YAML block modifiers as seen in the examples for this module. - Note that when using values that YAML/ansible-core interprets as other types, like V(yes), V(no) (booleans), or V(2.10) (float), make sure to quote them if these are meant to be strings. Otherwise the wrong values may be sent to LDAP. type: dict client_key: description: - PEM formatted file that contains your private key to be used for SSL client authentication. - Required if O(client_cert) is defined. type: path version_added: 7.1.0 version_added_collection: community.general sasl_class: choices: - external - gssapi default: external description: - The class to use for SASL authentication. type: str version_added: 2.0.0 version_added_collection: community.general server_uri: default: ldapi:/// description: - The O(server_uri) parameter may be a comma- or whitespace-separated list of URIs containing only the schema, the host, and the port fields. - The default value lets the underlying LDAP client library look for a UNIX domain socket in its default location. - Note that when using multiple URIs you cannot determine to which URI your client gets connected. - For URIs containing additional fields, particularly when using commas, behavior is undefined. type: str client_cert: description: - PEM formatted certificate chain file to be used for SSL client authentication. - Required if O(client_key) is defined. type: path version_added: 7.1.0 version_added_collection: community.general objectClass: description: - If O(state=present), value or list of values to use when creating the entry. It can either be a string or an actual list of strings. elements: str type: list validate_certs: default: true description: - If set to V(false), SSL certificates will not be validated. - This should only be used on sites using self-signed certificates. type: bool xorder_discovery: choices: - enable - auto - disable default: auto description: - Set the behavior on how to process Xordered DNs. - V(enable) will perform a C(ONELEVEL) search below the superior RDN to find the matching DN. - V(disable) will always use the DN unmodified (as passed by the O(dn) parameter). - V(auto) will only perform a search if the first RDN does not contain an index number (C({x})). type: str version_added: 6.4.0 version_added_collection: community.general referrals_chasing: choices: - disabled - anonymous default: anonymous description: - Set the referrals chasing behavior. - V(anonymous) follow referrals anonymously. This is the default behavior. - V(disabled) disable referrals chasing. This sets C(OPT_REFERRALS) to off. type: str version_added: 2.0.0 version_added_collection: community.general