ansible_samba_ad_dc/tasks/kerberos.yml

---
- name: Extract absolute krb5.conf path from provision output
  ansible.builtin.set_fact:
    krb5_conf_path: >-
      {{
        (
          samba_provision_output.stdout
          | regex_findall('(/[^\\s,"'']*/private/krb5\\.conf)')
          | list
          | default([])
        )
        | first
        | default('/var/lib/samba/private/krb5.conf')
        | trim
      }}
  when: samba_provision_output.stdout is defined
# the regex doesnt actually work

- name: Show extracted krb5.conf path
  ansible.builtin.debug:
    msg: "Extracted krb5.conf path: {{ krb5_conf_path | default('N/A') }}"

- name: Check if krb5.conf exists on disk
  ansible.builtin.stat:
    path: "{{ krb5_conf_path }}"
  register: krb5_conf_stat
  when: krb5_conf_path != ''

- name: Validate krb5.conf presence
  ansible.builtin.fail:
    msg: "Kerberos configuration file was not found at {{ krb5_conf_path }}. Provision may have failed."
  when:
    - krb5_conf_path != ''
    - not krb5_conf_stat.stat.exists | default(false)

- name: Confirm Kerberos configuration found
  ansible.builtin.debug:
    msg: "Kerberos configuration verified: {{ krb5_conf_path }}"
  when: krb5_conf_stat.stat.exists | default(false)

- name: Copy krb5.conf to /etc/krb5.conf
  ansible.builtin.copy:
    src: '{{ krb5_conf_path }}'
    dest: /etc/krb5.conf
    owner: root
    group: root
    mode: '0644'
  # Only run this if the provision was successful (changed)
  when: samba_provision_output.changed