ansible: temp-disable Samba password complexity for trust account write

samba-tool user create rejected the cluster-generated trust_shared_password
with "0000052D: Constraint violation - check_password_restrictions: the
password does not meet the complexity criteria". The trust password is
high-entropy random bytes from init_kdc.sh and may not satisfy AD's
"3 of 4 character categories" rule.

Wrap the create + setpassword steps in a block that:
  1. reads the current `samba-tool domain passwordsettings show` state
  2. flips complexity off if it was on
  3. does the user write
  4. always: restores complexity to its prior on/off state

The restore is in an `always:` clause so a failure inside the write
block does not leave the domain policy weakened.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/playbooks/kerberos_trust_setup.yml

@@ -208,53 +208,76 @@
           knoe.local  = {{ trust_realm }}
 
     # ------------------------------------------------------------------
-    # 3. Create the inter-realm krbtgt user in Samba (if missing)
+    # 3. Create / re-sync the inter-realm krbtgt user
     # ------------------------------------------------------------------
-    # The account is named exactly `krbtgt/KNOE.LOCAL` — the slash is
-    # legal in a Samba sAMAccountName/userPrincipalName. Samba's KDC
-    # will then issue cross-realm TGTs whose source principal is
-    # `krbtgt/KNOE.LOCAL@PROLE.ORG` (PROLE.ORG is the local realm,
-    # added implicitly).
+    # Samba's default domain password policy rejects the cluster-generated
+    # trust_shared_password (it's high-entropy random bytes and may not
+    # satisfy the "3 of 4 character categories" complexity rule).
+    # We work around that by temporarily disabling complexity, doing the
+    # create + setpassword, then restoring the previous complexity state.
+    # The restore lives in an `always:` block so even a hard failure in
+    # the middle leaves Samba's policy intact.
     #
     # The "no_log" wrapper protects the password but also hides the
-    # error message on failure; if a real run dies here re-run by hand
-    # to see stderr (see playbook header).
-    - name: Create inter-realm krbtgt user {{ samba_account_name }}
+    # error message on failure; if a real run dies inside the block,
+    # re-run the failing command by hand to see stderr (see playbook
+    # header).
+    - name: Read current password complexity setting
       ansible.builtin.command:
-        argv:
-          - samba-tool
-          - user
-          - create
-          - "{{ samba_account_name }}"
-          - "{{ trust_shared_password }}"
-          - "--description=Inter-realm TGT for {{ trust_realm }} (MIT KDC) cross-realm trust"
-          - "--use-username-as-cn"
-          - "-U"
-          - "administrator%{{ samba_admin_password }}"
-      no_log: true
-      register: _krbtgt_create
-      changed_when: _krbtgt_create.rc == 0
-      when: not _trust_exists
+        cmd: samba-tool domain passwordsettings show
+      register: _pw_policy
+      changed_when: false
+      check_mode: false
 
-    # ------------------------------------------------------------------
-    # 4. Reset the password (idempotent: handles both fresh create and
-    #    re-runs where the cluster Secret may have been rotated).
-    #    Skipped on the fresh-create path because step 3 already set it.
-    # ------------------------------------------------------------------
-    - name: Re-sync {{ samba_account_name }} password with cluster Secret
-      ansible.builtin.command:
-        argv:
-          - samba-tool
-          - user
-          - setpassword
-          - "{{ samba_account_name }}"
-          - "--newpassword={{ trust_shared_password }}"
-          - "-U"
-          - "administrator%{{ samba_admin_password }}"
-      no_log: true
-      register: _krbtgt_setpw
-      changed_when: _krbtgt_setpw.rc == 0
-      when: _trust_exists
+    - name: Set fact — password complexity currently on?
+      ansible.builtin.set_fact:
+        _pw_complexity_was_on: "{{ 'Password complexity: on' in _pw_policy.stdout }}"
+
+    - name: Create / re-sync krbtgt user (with complexity temporarily off)
+      block:
+        - name: Disable password complexity for trust-account write
+          ansible.builtin.command:
+            cmd: samba-tool domain passwordsettings set --complexity=off
+          when: _pw_complexity_was_on
+          changed_when: true
+
+        - name: Create inter-realm krbtgt user {{ samba_account_name }}
+          ansible.builtin.command:
+            argv:
+              - samba-tool
+              - user
+              - create
+              - "{{ samba_account_name }}"
+              - "{{ trust_shared_password }}"
+              - "--description=Inter-realm TGT for {{ trust_realm }} (MIT KDC) cross-realm trust"
+              - "--use-username-as-cn"
+              - "-U"
+              - "administrator%{{ samba_admin_password }}"
+          no_log: true
+          register: _krbtgt_create
+          changed_when: _krbtgt_create.rc == 0
+          when: not _trust_exists
+
+        - name: Re-sync {{ samba_account_name }} password with cluster Secret
+          ansible.builtin.command:
+            argv:
+              - samba-tool
+              - user
+              - setpassword
+              - "{{ samba_account_name }}"
+              - "--newpassword={{ trust_shared_password }}"
+              - "-U"
+              - "administrator%{{ samba_admin_password }}"
+          no_log: true
+          register: _krbtgt_setpw
+          changed_when: _krbtgt_setpw.rc == 0
+          when: _trust_exists
+      always:
+        - name: Restore password complexity to its prior state
+          ansible.builtin.command:
+            cmd: samba-tool domain passwordsettings set --complexity=on
+          when: _pw_complexity_was_on
+          changed_when: true
 
     # ------------------------------------------------------------------
     # 5. Disable password expiry on the krbtgt account