openafs-krbserver - Kerberos Server Role
========================================

Description
-----------

Install and configure the MIT or Heimdal Kerberos master KDC on single host,
create the Kerberos database, the first administrator principal, and a keytab
for the first administrator.

Variables
---------

afs_realm
  The Kerberos realm name.

  Default: EXAMPLE.COM

afs_realm_files
  Path to realm related files on the controller. It is recommended to use
  ``ansible-vault`` to encrypt the files in this directory.

  Default: ``$HOME/.ansible-openafs/realm/{{ afs_realm }}``

afs_krb_master_password
  The secret Kerberos database master password. If this host variable is not
  present, the password is read from the ``afs_krb_master_password`` file located
  in the ``{{ afs_realm_files }}`` directory on the controller.  If this file does not
  exist, a random password is generated and written to the file.

  Note: It is recommended to use ``ansible-vault`` to encrypt this secret.

  Default: <random>

afs_krb_admin_principal
  An administrator principal to be created by this role. A keytab is always
  created for this principal with a random key. The keytab is downloaded to
  ``{{ afs_realm_files }}/{{ afs_krb_admin_principlal }}.keytab`` file on
  the controller.

  Default: root/admin

afs_kdc_servers
  A comma separated list of kdc host names to be set in the krb5.conf file.
  If this variable is not defined, the hostname of the hosts in the
  ``afs_kdcs`` inventory group are used. If that group is not defined, the kdcs
  are not defined for the realm in the krb5.conf file and it is assumed they
  are defined as SRV records in DNS.

  Default: hosts in the ``afs_kdcs`` group

afs_kadmin_server
  The host name of the kadmin server to be set in the krb5.conf file. If this
  variable is not defined, the first host name in the ``afs_kdcs`` inventory
  group is used. If that group is not defined, the kadmin server hostname is
  not set in the krb5.conf file and it is assumed to be defined as SRV
  records in DNS.

  Default: undefined

afs_krb_dns_lookup_kdc
  Define if dns_lookup_kdc mode is enabled/disabled via true/false. If this
  variable is not defined, no entry will be set which is the same like
  dns_lookup_kdc = true.

  Default: undefined

afs_krb_max_life
  KDC max ticket life.

  Default: 10h 0m 0s

afs_krb_max_renewable_life
  KDC max renewable life.

  Default: 7d 0h 0m 0s

afs_krb_supported_enctypes
  KDC supported enctypes. Specify as a list of enctype:salt values.

  Default: ['aes256-cts-hmac-sha1-96:normal', 'aes128-cts-hmac-sha1-96:normal']

afs_krb_default_principal_flags
  KDC default principal flags.

  Default: +preauth