alfresco.platform.repository role

Note

This role is part of the alfresco.platform collection (version 0.7.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install alfresco.platform.

To use it in a playbook, specify: alfresco.platform.repository.

Entry point authentication – Authentication entrypoint for the repository role

Synopsis

  • Configures the authentication subsystems of an already installed Alfresco Content Services repository. Each supported subsystem has its own option and is configured only when that option is set. Fails when no subsystem option is set. It does not change the authentication chain: the calling playbook must add the configured subsystem instances to authentication.chain. The JVM running the repository must be started with the options exposed in the repository_authentication_java_opts fact. It does not provision any KDC or Active Directory resources.

Parameters

Parameter

Comments

repository_authentication_kerberos

dictionary

Kerberos (SPNEGO SSO) authentication subsystem. When set, writes the Kerberos client configuration, installs the keytab, writes the JAAS login configuration and the subsystem properties.

admin_server

string

Kerberos admin server. Omitted from krb5.conf when empty.

Default: ""

default_administrator_usernames

list / elements=string

Users granted administrator rights by the Kerberos subsystem.

Default: []

domains

list / elements=string

DNS domains mapped to the realm in the [domain_realm] section. Defaults to the realm in lowercase, with and without a leading dot.

enctypes

list / elements=string

Encryption types allowed for tickets.

Default: ["aes256-cts-hmac-sha1-96", "aes128-cts-hmac-sha1-96"]

instance_name

string

Name of the Kerberos authentication subsystem instance.

Default: "kerberos1"

jaas_config_path

string

Path of the JAAS login configuration file on the target host.

Default: "{{ repository_settings_dir }}/java.login.config"

kdcs

list / elements=string / required

Kerberos KDC hosts, optionally with a port (for example kdc.example.com:88).

keytab_path

string

Path of the keytab on the target host.

Default: "{{ repository_settings_dir }}/alfresco.keytab"

keytab_src

string

Path of the keytab on the Ansible controller. When empty, the keytab must already exist on the target host at keytab_path.

Default: ""

krb5_conf_path

string

Path of the Kerberos client configuration file on the target host.

Default: "/etc/krb5.conf"

principal

string / required

Service principal held in the keytab, in the form HTTP/<host>.<domain>. The host must be the name users browse to (the load balancer name when the repository is behind a proxy).

realm

string / required

Kerberos realm, usually the DNS domain in uppercase (for example EXAMPLE.COM).

sso_enabled

boolean

Enable SPNEGO/Kerberos single sign-on.

Choices:

  • false

  • true ← (default)

sso_fallback_enabled

boolean

Fall back to another authentication mechanism when SSO fails.

Choices:

  • false

  • true ← (default)

strip_username_suffix

boolean

Strip the @domain suffix from Kerberos authenticated usernames.

Choices:

  • false

  • true ← (default)

repository_classpath_dir

string

Repository classpath directory holding the alfresco/extension tree.

Default: "{{ repository_settings_dir }}/classpath"

repository_group

string

Group owning the repository configuration files.

Default: "alfresco"

repository_settings_dir

string

Repository settings directory on the target host.

Default: "/etc/opt/alfresco/content-services"

repository_username

string

User owning the repository configuration files.

Default: "alfresco"

Entry point user_sync – User synchronization entrypoint for the repository role

Synopsis

  • Configures the user and group synchronization subsystems of an already installed Alfresco Content Services repository. Each supported subsystem has its own option and is configured only when that option is set. Fails when no subsystem option is set. It does not change the authentication chain: the calling playbook must add the configured subsystem instances to authentication.chain for the synchronization to run. It does not provision any Active Directory resources.

Parameters

Parameter

Comments

repository_classpath_dir

string

Repository classpath directory holding the alfresco/extension tree.

Default: "{{ repository_settings_dir }}/classpath"

repository_group

string

Group owning the repository configuration files.

Default: "alfresco"

repository_settings_dir

string

Repository settings directory on the target host.

Default: "/etc/opt/alfresco/content-services"

repository_user_sync_ldap_ad

dictionary

LDAP-AD subsystem used only to synchronize users and groups from Active Directory. LDAP authentication is disabled on that instance.

bind_authentication

string

Bind mechanism used for synchronization (none, simple or DIGEST-MD5).

Default: "simple"

bind_password

string / required

Password of the bind account.

bind_principal

string / required

Account used to bind to the directory for synchronization.

extra_properties

dictionary

Additional LDAP-AD subsystem properties written as-is (for example ldap.synchronization.personQuery).

Default: {}

group_search_base

string / required

DN under which groups are searched.

instance_name

string

Name of the LDAP-AD authentication subsystem instance.

Default: "ldap1"

url

string / required

LDAP server URL (for example ldap://ad.example.com:389).

user_search_base

string / required

DN under which users are searched.

repository_username

string

User owning the repository configuration files.

Default: "alfresco"