ansible-ad-inventory

Active Directory dynamic inventory plugin for Ansible

Installation

To install locally,

pip install ldap3
mkdir -p ~/.ansible/plugins/inventory
cd ~/.ansible/plugins/inventory
git clone https://github.com/mdhowle/ansible-ad-inventory ad

See Ansible Documentation on installing plugins.

Requirement is ldap3

Optionally,

gssapi for Kerberos authentication
dnspython for LDAP server auto-detection

Usage

See ansible-doc -t inventory ad for more details.

Create a file named ad.yml with the contents:

plugin: ad
server: dc.example.com
port: 636
base: DC=example,DC=com
username: EXAMPLE\ExampleUser  # or distinguishedname
password: hunter2
filter: "(operatingSystem=Debian GNU/Linux)"
ansible group: Debian

Run ansible-playbook -i ad.yml playbook.yml

NOTE: Quotations are not required for the values. If you do quote the values, you will need to escape backslashes (e.g. username: "EXAMPLE\\ExampleUser").

Regardless of quoting, you do not need to quote or escape spaces within LDAP filters.

Configuration

Attribute	Type	Required	Choices/Default	Description
plugin	`str`	Yes	choices: `['ad']`; default: `ad`	Marks this as an instance of the ‘ad’ plugin
server	`str`	Yes, unless `dnspython` is installed.	`null`	Active Directory server name or list of server names
port	`int`	No	`389`	LDAP Server Port; using port 636 enables SSL
ssl	`bool`	No	False	Connect to server with SSL
starttls	`bool`	No	True	Connect to server with STARTTLS
base	`str`	No	`null`	Starting port of the search. If `null`, the default naming context will be used.
filter	`str`	No	`''`	LDAP query filter. `objectClass=computer` is automatically appended.
scope	`str`	No	choices: `['base', 'level', subtree']`; default: `subtree`	Scope of the search
hostname var	`str`	No	`name`	LDAP attribute to use as the inventory hostname
username	`str`	No	`null`	Username to bind as. It can the distinguished name of the user, or “SHORTDOMAIN\user”. If `null`, Kerberos + GSSAPI authentication will be used. Can be set by `ANSIBLE_AD_INVENTORY_USERNAME` environment variable.
password	`str`	No	`null`	Username’s password. Must be defined if username is also defined. Can be set by `ANSIBLE_AD_INVENTORY_PASSWORD` environment variable.
ansible group	`str`	No	N/A	Ansible group name to assign hosts to
var attribute	`str`	No	`null`	LDAP attribute to load as YAML for host-specific Ansible variables.
use ad groups	`bool`	No	`True`	Add AD group memberships as Ansible host groups.