Force combined keytab ownership

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

playbooks/groups/ipa.yml

@@ -60,6 +60,14 @@
     tags:
     - krb5
     - ipa/server
+  - name: Set owner and permissions on combined keytab
+    file: path="/etc/krb5.HTTP_id{{env_suffix}}.fedoraproject.org.keytab.combined"
+          owner=apache
+          group=apache
+          mode=0600
+    tags:
+    - krb5
+    - ipa/server
   # original: /etc/httpd/conf/ipa.keytab
   - name: Make IPA HTTP use the combined keytab
     lineinfile: dest=/etc/httpd/conf.d/ipa.conf