prole/infrastructure/playbooks/workstation_kerberos.yml

---
# workstation_kerberos.yml — Configure Kerberos client + browser SPNEGO on managed endpoints.
#
# Run this playbook once during laptop provisioning (or re-run idempotently).
# It replaces the per-user "defaults write" workaround with a managed, auditable
# policy that is identical across every machine.
#
# WHAT IT DOES
# ------------
# 1. Writes /etc/krb5.conf (or /Library/Preferences/edu.mit.Kerberos on macOS)
#    so that kinit resolves PROLE.ORG principals against myrddin.prole.org.
# 2. Deploys Chrome managed preferences (AuthServerAllowlist) so Chrome/Edge
#    automatically negotiates Kerberos for *.prole.org without any per-user
#    browser configuration.
# 3. Symlinks/copies a krb5.conf into place for any Kerberos CLI tools.
#
# USAGE
# -----
#   # All managed workstations:
#   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml
#
#   # Single machine:
#   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml \
#     --limit <hostname>
#
#   # Dry-run:
#   ansible-playbook infrastructure/playbooks/workstation_kerberos.yml \
#     --check --diff
#
# HOSTS
# -----
# Targets the "workstations" inventory group.  Add new machines there as
# engineering headcount grows — no playbook changes required.
#
# ADDING A NEW REALM
# ------------------
# Extend the krb5_realms list in vars below.  The template generates the
# [realms] and [domain_realm] sections automatically.

- name: Configure Kerberos client and browser SPNEGO on managed workstations
  hosts: workstations
  gather_facts: true
  become: true

  vars:
    krb5_default_realm: "PROLE.ORG"
    krb5_realms:
      - realm: "PROLE.ORG"
        kdc: "myrddin.prole.org"
        admin_server: "myrddin.prole.org"
        domain_suffixes:
          - ".prole.org"
          - "prole.org"

    # Chrome / Chromium / Edge — negotiate Kerberos for these domains.
    # *.prole.org covers git.prole.org, svc.prole.org, db.prole.org, etc.
    chrome_negotiate_domains: "*.prole.org"

  tasks:
    # -----------------------------------------------------------------------
    # 1. krb5.conf — shared by kinit, curl --negotiate, Python krb5, etc.
    # -----------------------------------------------------------------------
    - name: Write /etc/krb5.conf
      ansible.builtin.copy:
        dest: /etc/krb5.conf
        owner: root
        group: "{{ 'wheel' if ansible_os_family == 'Darwin' else 'root' }}"
        mode: '0644'
        content: |
          [libdefaults]
              default_realm = {{ krb5_default_realm }}
              dns_canonicalize_hostname = false
              rdns = false
              # Ticket forwarding is disabled by default; enable per-service via
              # [appdefaults] if needed (e.g. SSH GSSAPIDelegateCredentials).
              forwardable = false

          [realms]
          {% for r in krb5_realms %}
              {{ r.realm }} = {
                  kdc = {{ r.kdc }}
                  admin_server = {{ r.admin_server }}
              }
          {% endfor %}

          [domain_realm]
          {% for r in krb5_realms %}
          {% for d in r.domain_suffixes %}
              {{ d }} = {{ r.realm }}
          {% endfor %}
          {% endfor %}          

    # macOS also checks this legacy path; symlink for compatibility.
    - name: Symlink macOS legacy Kerberos config
      ansible.builtin.file:
        src: /etc/krb5.conf
        dest: /Library/Preferences/edu.mit.Kerberos
        state: link
        force: true
      when: ansible_os_family == "Darwin"

    # -----------------------------------------------------------------------
    # 2. Chrome managed policy — macOS
    # Placed in /Library/Managed Preferences/ so it applies to all users on
    # the machine.  No per-user Chrome configuration required.
    # -----------------------------------------------------------------------
    - name: Ensure Chrome managed preferences directory exists (macOS)
      ansible.builtin.file:
        path: /Library/Managed Preferences
        state: directory
        owner: root
        group: wheel
        mode: '0755'
      when: ansible_os_family == "Darwin"

    - name: Deploy Chrome SPNEGO managed policy (macOS)
      ansible.builtin.copy:
        dest: /Library/Managed Preferences/com.google.Chrome.plist
        owner: root
        group: wheel
        mode: '0644'
        content: |
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
            "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
              <!-- Domains for which Chrome will negotiate Kerberos automatically. -->
              <key>AuthServerAllowlist</key>
              <string>{{ chrome_negotiate_domains }}</string>
              <!-- Domains to which Chrome may delegate (forward) the Kerberos ticket. -->
              <key>AuthNegotiateDelegateAllowlist</key>
              <string>{{ chrome_negotiate_domains }}</string>
          </dict>
          </plist>          
      when: ansible_os_family == "Darwin"
      notify: Restart Chrome (macOS)

    # Microsoft Edge on macOS uses the same managed-preferences directory with
    # a different bundle ID.
    - name: Deploy Edge SPNEGO managed policy (macOS)
      ansible.builtin.copy:
        dest: /Library/Managed Preferences/com.microsoft.Edge.plist
        owner: root
        group: wheel
        mode: '0644'
        content: |
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
            "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
              <key>AuthServerAllowlist</key>
              <string>{{ chrome_negotiate_domains }}</string>
              <key>AuthNegotiateDelegateAllowlist</key>
              <string>{{ chrome_negotiate_domains }}</string>
          </dict>
          </plist>          
      when: ansible_os_family == "Darwin"

    # -----------------------------------------------------------------------
    # 2b. Chrome / Chromium managed policy — Linux
    # Google Chrome looks in /etc/opt/chrome/policies/managed/
    # Chromium looks in /etc/chromium/policies/managed/
    # -----------------------------------------------------------------------
    - name: Ensure Chrome policy directory exists (Linux)
      ansible.builtin.file:
        path: "{{ item }}"
        state: directory
        owner: root
        group: root
        mode: '0755'
      loop:
        - /etc/opt/chrome/policies/managed
        - /etc/chromium/policies/managed
      when: ansible_os_family != "Darwin"

    - name: Deploy Chrome/Chromium SPNEGO managed policy (Linux)
      ansible.builtin.copy:
        dest: "{{ item }}/kerberos.json"
        owner: root
        group: root
        mode: '0644'
        content: |
          {
            "AuthServerAllowlist": "{{ chrome_negotiate_domains }}",
            "AuthNegotiateDelegateAllowlist": "{{ chrome_negotiate_domains }}"
          }          
      loop:
        - /etc/opt/chrome/policies/managed
        - /etc/chromium/policies/managed
      when: ansible_os_family != "Darwin"

    # -----------------------------------------------------------------------
    # 3. Verify — print where to check policy was applied
    # -----------------------------------------------------------------------
    - name: Show policy verification URL
      ansible.builtin.debug:
        msg: >
          Chrome policy applied.
          Verify at chrome://policy in a browser on {{ inventory_hostname }}.
          Expected: AuthServerAllowlist = {{ chrome_negotiate_domains }}          

  handlers:
    # Chrome must be fully quit and restarted (not just reloaded) for managed
    # preferences to take effect on macOS.
    - name: Restart Chrome (macOS)
      ansible.builtin.debug:
        msg: >
          Chrome policy updated on {{ inventory_hostname }}.
          Ask the user to quit Chrome completely (Cmd-Q) and relaunch.
          Managed preferences take effect on next launch — no reinstall needed.