Use ansible_domain everywhere and bail out if it is empty.

roles/krb5-kdc-ldap/tasks/main.yml

@@ -1,6 +1,8 @@
 ## Install and configure krb5-kdc-ldap (if not done yet),
 ##  run most tasks only on krb5-kdc-ldap installation.
 ---
+- fail: msg="The machine's domain must not be empty."
+  when: ansible_domain | length == 0 
 
 - name: check if slapd is already there
   stat: path=/usr/sbin/krb5kdc
@@ -135,7 +137,7 @@
       -H ldapi:///
       create -s -subtrees "{{ basedn }}"
       -P "{{ kdc_master_pwd }}"
-      -r "{{ ldap_domain | upper }}"
+      -r "{{ ansible_domain | upper }}"
   no_log: true
   notify: "restart krb5-kdc"
   when: not krb5kdc.stat.exists
@@ -154,14 +156,14 @@
   when: not krb5kdc.stat.exists
 
 - name: create machine principals
-  command: kadmin.local -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ldap_domain }}"
+  command: kadmin.local -q "addprinc -randkey {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}"
   with_items:
     - host
     - ldap
   when: not krb5kdc.stat.exists
 
 - name: add principal to the keytab
-  command: kadmin.local -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ldap_domain }}"
+  command: kadmin.local -q "ktadd {{ item }}/{{ ansible_hostname }}.{{ ansible_domain }}"
   with_items:
     - host
     - ldap

roles/krb5-kdc-ldap/templates/kadm5.acl.j2

@@ -1,4 +1,4 @@
 ## access controls for the Kerberos KDC
-root/admin@{{ ldap_domain | upper }} *
-*@{{ ldap_domain | upper }} cil
-*/*@{{ ldap_domain | upper }} i
+root/admin@{{ ansible_domain | upper }} *
+*@{{ ansible_domain | upper }} cil
+*/*@{{ ansible_domain | upper }} i

roles/krb5-kdc-ldap/templates/kdc.conf.j2

@@ -2,7 +2,7 @@
     kdc_ports = 750,88
 
 [realms]
-    {{ ldap_domain | upper }} = {
+    {{ ansible_domain | upper }} = {
         admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
         acl_file = /etc/krb5kdc/kadm5.acl
         key_stash_file = /etc/krb5kdc/stash

roles/krb5-kdc-ldap/templates/krb5.conf.j2

@@ -1,16 +1,16 @@
 [libdefaults]
-        default_realm = {{ ldap_domain | upper }}
+        default_realm = {{ ansible_domain | upper }}
 
 [realms]
-        {{ ldap_domain | upper }} = {
+        {{ ansible_domain | upper }} = {
                 kdc = {{ ansible_hostname }}
                 admin_server = {{ ansible_hostname }}
                 database_module = LDAP
         }
 
 [domain_realm]
-        .{{ ldap_domain }} = {{ ldap_domain | upper }}
-        {{ ldap_domain }} = {{ ldap_domain | upper }}
+        .{{ ansible_domain }} = {{ ansible_domain | upper }}
+        {{ ansible_domain }} = {{ ansible_domain | upper }}
 
 [dbdefaults]
         ldap_kerberos_container_dn = cn=kerberos,{{ basedn }}