roles/services/defaults/main.yaml

@@ -1,3 +1,4 @@
+realm: "{{domain}}.{{resolv_domain}}"
 samba_client_services:  
   - smbd 
   - nmbd 
@@ -7,6 +8,13 @@ dcsamba_base_packages:
   - krb5-user
   - winbind
   - acl
+  - libnss-winbind
+  - libpam-winbind
+  - samba-ad-provision
+  - smbclient
+  - ldb-tools
+  - samba-dsdb-modules
+  - samba-vfs-modules
 mariadb_base_packages:
   - mariadb-server
   - mariadb-backup

roles/services/tasks/adsamba.yml

@@ -1,49 +1,105 @@
-- name: Install adSamba packages
+# Provisioning of Samba. Samba is able to serve as an Active Directory (AD) domain controller (DC).
-  package:
+# The entire process of setting up a Samba domain controller consists of 5 steps which are relatively straight forward. These steps are as follows:
-    name: "{{ dcsamba_base_packages }}"
+# 1. Installation of Samba and associated packages
-    state: present
+# 2. Deletion of pre-configured Samba and Kerberos placeholder configuration files
-    install_recommends: no
+# 3. Provisioning of Samba using the automatic provisioning tool
+# 4. Editing of the smb.conf as needed (enabling of Group Policy and/or other features as needed) see Group Policy for more information
+# 5. Any environmental configuration based on Unix/Linux Distribution
+# 
+# https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/active-directory-domain-join-troubleshooting-guidance
+# https://learn.microsoft.com/en-us/windows/win32/api/lmjoin/nf-lmjoin-netvalidatename
+# 
+# Check local login with
+# smbclient -L //localhost -U Administrator
+# apt install ldb-tools
+#
+# samba-tool domain provision --use-rfc2307 --interactive 
 
-- name: Add adsamba host to hosts file
+- name: Gather installed packages
-  blockinfile:
+  package_facts:
-    path: /etc/hosts
-    marker: "# {mark} ANSIBLE-MANAGED SAMBA DC ENTRY"
-    block: |
-      {{ dc1 }} dc1-test.samba-test.{{ resolv_domain }}
 
-- name: Disable Samba client services and mask them
+- name: Check if metadata.tdb exists and is not empty
-  systemd:
+  stat:
-    name: "{{ item }}"
+    path: /var/lib/samba/private/sam.ldb.d/metadata.tdb
-    state: stopped
+  register: metadata_tdb
-    enabled: no
-    masked: yes
-  loop: "{{ samba_client_services }}"
 
-- name: Check if server is already joined to domain
+- name: Register domain existence
-  command:
+  set_fact:
-    cmd: samba-tool domain info localhost
+    domain_exists: >-
-  register: domain_info
+      {{
-  failed_when: domain_info.rc != 0 and 'Cannot contact' not in domain_info.stderr
+        ('samba-ad-provision' in ansible_facts.packages or
-  changed_when: false
+        'samba-ad-dc' in ansible_facts.packages) and
+        (metadata_tdb.stat.exists and metadata_tdb.stat.size > 0)
+      }}
 
-- name: Join domain as DC if not already joined
+# If we want to go 4.21
-  command:
+#- name: Add Debian backports repository
-    cmd: samba-tool domain join samba."{{ resolv_domain }}" DC -U"SAMBA\\administrator" --option='idmap_ldb:use rfc2307 = yes'
+#  apt_repository:
-  when: "'Cannot contact' in domain_info.stderr"
+#    repo: "deb http://deb.debian.org/debian {{ ansible_distribution_release | lower }}-backports main"
-  register: domain_join
+#    state: present
-  changed_when: "'Joined domain' in domain_join.stdout"
 
-- name: Copy Kerberos configuration
+#- name: Update apt cache
-  copy:
+#  apt:
-    src: krb5.conf
+#    update_cache: yes
-    dest: /etc/krb5.conf
+
-    remote_src: true
+- when: "not domain_exists"
-    owner: root
+  block:
-    group: root
+  - name: Install adSamba packages
-    mode: '0644'
+    package:
+      name: "{{ dcsamba_base_packages }}"
+      # default_release: bookworm-backports # If we want to go 4.21
+      state: latest
+  
+  - name: Add adsamba host to hosts file
+    blockinfile:
+      path: /etc/hosts
+      marker: "# {mark} ANSIBLE-MANAGED SAMBA DC ENTRY"
+      block: |
+        {{ ip_serverad1 }} {{ name_ip_serverad1}}.{{ domain }}.{{ resolv_domain }} {{ realm }}
+  
+  - name: Force remove smb.conf file
+    file:
+      path: /etc/samba/smb.conf
+      state: absent
+      force: yes
+  
+  - name: Disable Samba client services and mask them
+    systemd:
+      name: "{{ item }}"
+      state: stopped
+      enabled: no
+      masked: yes
+    loop: "{{ samba_client_services }}"
+  
+  - name: Join domain 
+    command:
+      cmd: samba-tool domain provision --realm="{{ realm }}" --domain="{{ domain }}" --dns-backend=SAMBA_INTERNAL --server-role=dc --use-rfc2307
+    register: domain_join
+
+  - name: Show the domain join output with Administrator password
+    debug:
+      msg: "{{ domain_join.stderr_lines[-6:] }}"
+
+  - name: Copy Kerberos configuration
+    copy:
+      src: /var/lib/samba/private/krb5.conf
+      dest: /etc/krb5.conf
+      remote_src: true
+      owner: root
+      group: root
+      mode: '0644'
+    when: domain_join.changed
+
+  - name: Enable and start Samba AD DC service
+    systemd:
+      name: samba-ad-dc
+      state: started
+      enabled: yes
+    when: domain_join.changed
+  
+  # Hay que crear un registro tipo A con el FQDN es decir el GLUE RECORD en tu DNS
+  # Luego hay que crear la delegación # update add activedirectory.verdnatura.es. 86400 NS dc1-ad.activedirectory.verdnatura.es.
+  # Bloque de inizialización del dominio ## Hecho
+  # Revisar la condicion de domain_join ## Hecho.
+  # Cuidado con la copia de KRB5, revisar si lo hace ya el samba-tool. ## Hecho.
   
-- name: Enable and start Samba AD DC service
-  systemd:
-    name: samba-ad-dc
-    state: started
-    enabled: yes