You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
114 lines
4.5 KiB
114 lines
4.5 KiB
2 years ago
|
From 320168071ff56c00ff65870e781a261075fccc66 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Rafael Guterres Jeffman <rjeffman@redhat.com>
|
||
|
|
Date: Wed, 21 Sep 2022 18:28:55 -0300
|
||
|
|
Subject: [PATCH] ipaconfig: Do not allow enable_sid set to False.
|
||
|
|
|
||
|
|
Once enabled, SID cannot be disabled. This patch ensures that an error
|
||
|
|
is raised if one tries to disable SID.
|
||
|
|
---
|
||
|
|
README-config.md | 2 +-
|
||
|
|
plugins/modules/ipaconfig.py | 15 ++++++++-------
|
||
|
|
tests/config/test_config_sid.yml | 13 +++++++++++++
|
||
|
|
3 files changed, 22 insertions(+), 8 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/README-config.md b/README-config.md
|
||
|
|
index 13023ea..d6fe40a 100644
|
||
|
|
--- a/README-config.md
|
||
|
|
+++ b/README-config.md
|
||
|
|
@@ -148,7 +148,7 @@ Variable | Description | Required
|
||
|
|
`user_auth_type` \| `ipauserauthtype` | set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`). Use `""` to clear this variable. | no
|
||
|
|
`domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | no
|
||
|
|
`ca_renewal_master_server` \| `ipacarenewalmasterserver`| Renewal master for IPA certificate authority. | no
|
||
|
|
-`enable_sid` | New users and groups automatically get a SID assigned. Requires IPA 4.9.8+. (bool) | no
|
||
|
|
+`enable_sid` | New users and groups automatically get a SID assigned. Cannot be deactivated once activated. Requires IPA 4.9.8+. (bool) | no
|
||
|
|
`netbios_name` | NetBIOS name of the IPA domain. Requires IPA 4.9.8+ and 'enable_sid: yes'. | no
|
||
|
|
`add_sids` | Add SIDs for existing users and groups. Requires IPA 4.9.8+ and 'enable_sid: yes'. (bool) | no
|
||
|
|
|
||
|
|
diff --git a/plugins/modules/ipaconfig.py b/plugins/modules/ipaconfig.py
|
||
|
|
index 87810b2..9c19afb 100644
|
||
|
|
--- a/plugins/modules/ipaconfig.py
|
||
|
|
+++ b/plugins/modules/ipaconfig.py
|
||
|
|
@@ -175,7 +175,7 @@ options:
|
||
|
|
enable_sid:
|
||
|
|
description: >
|
||
|
|
New users and groups automatically get a SID assigned.
|
||
|
|
- Requires IPA 4.9.8+.
|
||
|
|
+ Cannot be deactivated once activated. Requires IPA 4.9.8+.
|
||
|
|
required: false
|
||
|
|
type: bool
|
||
|
|
netbios_name:
|
||
|
|
@@ -525,11 +525,16 @@ def main():
|
||
|
|
result = config_show(ansible_module)
|
||
|
|
|
||
|
|
if params:
|
||
|
|
+ enable_sid = params.get("enable_sid")
|
||
|
|
+ sid_is_enabled = has_enable_sid and is_enable_sid(ansible_module)
|
||
|
|
+
|
||
|
|
+ if sid_is_enabled and enable_sid is False:
|
||
|
|
+ ansible_module.fail_json(msg="SID cannot be disabled.")
|
||
|
|
+
|
||
|
|
netbios_name = params.get("netbios_name")
|
||
|
|
if netbios_name:
|
||
|
|
netbios_name = netbios_name.upper()
|
||
|
|
add_sids = params.get("add_sids")
|
||
|
|
- enable_sid = params.get("enable_sid")
|
||
|
|
required_sid = any([netbios_name, add_sids])
|
||
|
|
if required_sid and not enable_sid:
|
||
|
|
ansible_module.fail_json(
|
||
|
|
@@ -551,13 +556,9 @@ def main():
|
||
|
|
del params["add_sids"]
|
||
|
|
if (
|
||
|
|
not any([netbios_name, add_sids])
|
||
|
|
- and is_enable_sid(ansible_module)
|
||
|
|
+ and sid_is_enabled
|
||
|
|
):
|
||
|
|
del params["enable_sid"]
|
||
|
|
- else:
|
||
|
|
- for param in ["enable_sid", "netbios_name", "add_sids"]:
|
||
|
|
- if param in params:
|
||
|
|
- del params[params]
|
||
|
|
|
||
|
|
params = {
|
||
|
|
k: v for k, v in params.items()
|
||
|
|
diff --git a/tests/config/test_config_sid.yml b/tests/config/test_config_sid.yml
|
||
|
|
index 1761795..bd550a5 100644
|
||
|
|
--- a/tests/config/test_config_sid.yml
|
||
|
|
+++ b/tests/config/test_config_sid.yml
|
||
|
|
@@ -6,6 +6,9 @@
|
||
|
|
|
||
|
|
tasks:
|
||
|
|
|
||
|
|
+ - name: Set FreeIPA facts.
|
||
|
|
+ include_tasks: ../env_freeipa_facts.yml
|
||
|
|
+
|
||
|
|
# GET CURRENT CONFIG
|
||
|
|
|
||
|
|
- name: Return current values of the global configuration options
|
||
|
|
@@ -32,6 +35,14 @@
|
||
|
|
register: result
|
||
|
|
failed_when: result.failed or result.changed
|
||
|
|
|
||
|
|
+ - name: Try to Ensure SID is disabled.
|
||
|
|
+ ipaconfig:
|
||
|
|
+ ipaadmin_password: SomeADMINpassword
|
||
|
|
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
|
||
|
|
+ enable_sid: no
|
||
|
|
+ register: result
|
||
|
|
+ failed_when: not result.failed or "SID cannot be disabled." not in result.msg
|
||
|
|
+
|
||
|
|
- name: Ensure netbios_name is "IPATESTPLAY"
|
||
|
|
ipaconfig:
|
||
|
|
ipaadmin_password: SomeADMINpassword
|
||
|
|
@@ -59,6 +70,8 @@
|
||
|
|
enable_sid: yes
|
||
|
|
add_sids: yes
|
||
|
|
|
||
|
|
+ # only run tests if version supports enable-sid
|
||
|
|
+ when: ipa_version is version("4.9.8", ">=")
|
||
|
|
# REVERT TO PREVIOUS CONFIG
|
||
|
|
always:
|
||
|
|
# Once SID is enabled, it cannot be reverted.
|
||
|
|
--
|
||
|
|
2.37.3
|
||
|
|
|