You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
219 lines
8.9 KiB
219 lines
8.9 KiB
Adapted version of
|
|
|
|
From c808ad6e3408c2145ba660025c75531920f05d73 Mon Sep 17 00:00:00 2001
|
|
From: Rafael Guterres Jeffman <rjeffman@redhat.com>
|
|
Date: Tue, 18 Oct 2022 10:26:01 -0300
|
|
Subject: [PATCH] ipaconfig: Do not require enable_sid for add_sids or
|
|
netbios_name
|
|
|
|
Current behavior of ipaconfig mimics FreeIPA CLI and requires that
|
|
'enable_sid' is set to True every time add_sids or netbios_name are
|
|
used. It is sufficient that SID generation is enabled to use add_sids
|
|
and netbios_name, but the IPA API requires 'enable_sid' so that the
|
|
operations are executed.
|
|
|
|
This patch allows ansible-freeipa plugin ipaconfig to run 'add_sids' or
|
|
set 'netbios_name without requiring 'enable_sid' to be set on the
|
|
playbook.
|
|
|
|
If SID generation is enabled, 'add_sids' and 'netbios_name' can be used
|
|
without 'enable_sid: yes'. If SID generation is not enabled, an error
|
|
message will be raised if 'enable_sid: yes' is not used.
|
|
---
|
|
README-config.md | 4 +--
|
|
plugins/modules/ipaconfig.py | 53 +++++++++++++++++---------------
|
|
tests/config/test_config_sid.yml | 48 +++++++++++++++++++++++++++--
|
|
3 files changed, 76 insertions(+), 29 deletions(-)
|
|
|
|
diff --git a/README-config.md b/README-config.md
|
|
index d6fe40a..a1d6117 100644
|
|
--- a/README-config.md
|
|
+++ b/README-config.md
|
|
@@ -149,8 +149,8 @@ Variable | Description | Required
|
|
`domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | no
|
|
`ca_renewal_master_server` \| `ipacarenewalmasterserver`| Renewal master for IPA certificate authority. | no
|
|
`enable_sid` | New users and groups automatically get a SID assigned. Cannot be deactivated once activated. Requires IPA 4.9.8+. (bool) | no
|
|
-`netbios_name` | NetBIOS name of the IPA domain. Requires IPA 4.9.8+ and 'enable_sid: yes'. | no
|
|
-`add_sids` | Add SIDs for existing users and groups. Requires IPA 4.9.8+ and 'enable_sid: yes'. (bool) | no
|
|
+`netbios_name` | NetBIOS name of the IPA domain. Requires IPA 4.9.8+ and SID generation to be activated. | no
|
|
+`add_sids` | Add SIDs for existing users and groups. Requires IPA 4.9.8+ and SID generation to be activated. (bool) | no
|
|
|
|
|
|
Return Values
|
|
diff --git a/plugins/modules/ipaconfig.py b/plugins/modules/ipaconfig.py
|
|
index 9c19afb..7e78492 100644
|
|
--- a/plugins/modules/ipaconfig.py
|
|
+++ b/plugins/modules/ipaconfig.py
|
|
@@ -180,14 +180,14 @@ options:
|
|
type: bool
|
|
netbios_name:
|
|
description: >
|
|
- NetBIOS name of the IPA domain.
|
|
- Requires IPA 4.9.8+ and 'enable_sid: yes'.
|
|
+ NetBIOS name of the IPA domain. Requires IPA 4.9.8+
|
|
+ and SID generation to be activated.
|
|
required: false
|
|
type: string
|
|
add_sids:
|
|
description: >
|
|
- Add SIDs for existing users and groups.
|
|
- Requires IPA 4.9.8+ and 'enable_sid: yes'.
|
|
+ Add SIDs for existing users and groups. Requires IPA 4.9.8+
|
|
+ and SID generation to be activated.
|
|
required: false
|
|
type: bool
|
|
'''
|
|
@@ -362,7 +362,7 @@ def get_netbios_name(module):
|
|
|
|
|
|
def is_enable_sid(module):
|
|
- """When 'enable-sid' is true admin user and admins group have SID set."""
|
|
+ """When 'enable_sid' is true admin user and admins group have SID set."""
|
|
_result = module.ipa_command("user_show", "admin", {"all": True})
|
|
sid = _result["result"].get("ipantsecurityidentifier", [""])
|
|
if not sid[0].endswith("-500"):
|
|
@@ -517,7 +517,7 @@ def main():
|
|
changed = False
|
|
exit_args = {}
|
|
|
|
- # Connect to IPA API (enable-sid requires context == 'client')
|
|
+ # Connect to IPA API (enable_sid requires context == 'client')
|
|
with ansible_module.ipa_connect(context="client"):
|
|
has_enable_sid = ansible_module.ipa_command_param_exists(
|
|
"config_mod", "enable_sid")
|
|
@@ -532,20 +532,8 @@ def main():
|
|
ansible_module.fail_json(msg="SID cannot be disabled.")
|
|
|
|
netbios_name = params.get("netbios_name")
|
|
- if netbios_name:
|
|
- netbios_name = netbios_name.upper()
|
|
add_sids = params.get("add_sids")
|
|
- required_sid = any([netbios_name, add_sids])
|
|
- if required_sid and not enable_sid:
|
|
- ansible_module.fail_json(
|
|
- msg="'enable-sid: yes' required for 'netbios_name' "
|
|
- "and 'add-sids'."
|
|
- )
|
|
- if enable_sid:
|
|
- if not has_enable_sid:
|
|
- ansible_module.fail_json(
|
|
- msg="This version of IPA does not support enable-sid."
|
|
- )
|
|
+ if has_enable_sid:
|
|
if (
|
|
netbios_name
|
|
and netbios_name == get_netbios_name(ansible_module)
|
|
@@ -554,12 +542,27 @@ def main():
|
|
netbios_name = None
|
|
if not add_sids and "add_sids" in params:
|
|
del params["add_sids"]
|
|
- if (
|
|
- not any([netbios_name, add_sids])
|
|
- and sid_is_enabled
|
|
- ):
|
|
- del params["enable_sid"]
|
|
-
|
|
+ if any([netbios_name, add_sids]):
|
|
+ if sid_is_enabled:
|
|
+ params["enable_sid"] = True
|
|
+ else:
|
|
+ if not enable_sid:
|
|
+ ansible_module.fail_json(
|
|
+ msg="SID generation must be enabled for "
|
|
+ "'netbios_name' and 'add_sids'. Use "
|
|
+ "'enable_sid: yes'."
|
|
+ )
|
|
+ else:
|
|
+ if sid_is_enabled and "enable_sid" in params:
|
|
+ del params["enable_sid"]
|
|
+
|
|
+ else:
|
|
+ if any([enable_sid, netbios_name, add_sids is not None]):
|
|
+ ansible_module.fail_json(
|
|
+ msg="This version of IPA does not support enable_sid, "
|
|
+ "add_sids or netbios_name setting through the "
|
|
+ "config module"
|
|
+ )
|
|
params = {
|
|
k: v for k, v in params.items()
|
|
if k not in result or result[k] != v
|
|
diff --git a/tests/config/test_config_sid.yml b/tests/config/test_config_sid.yml
|
|
index bd550a5..d8d78f1 100644
|
|
--- a/tests/config/test_config_sid.yml
|
|
+++ b/tests/config/test_config_sid.yml
|
|
@@ -19,6 +19,32 @@
|
|
|
|
# TESTS
|
|
- block:
|
|
+ - name: Check if SID is enabled.
|
|
+ ipaconfig:
|
|
+ ipaadmin_password: SomeADMINpassword
|
|
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
+ enable_sid: yes
|
|
+ check_mode: yes
|
|
+ register: sid_disabled
|
|
+
|
|
+ - name: Ensure netbios_name can't be changed without SID enabled.
|
|
+ ipaconfig:
|
|
+ ipaadmin_password: SomeADMINpassword
|
|
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
+ netbios_name: IPATESTPLAY
|
|
+ register: result
|
|
+ failed_when: not result.failed and "SID generation must be enabled" in result.msg
|
|
+ when: sid_disabled.changed
|
|
+
|
|
+ - name: Ensure SIDs can't be changed without SID enabled.
|
|
+ ipaconfig:
|
|
+ ipaadmin_password: SomeADMINpassword
|
|
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
+ add_sids: yes
|
|
+ register: result
|
|
+ failed_when: not result.failed and "SID generation must be enabled" in result.msg
|
|
+ when: sid_disabled.changed
|
|
+
|
|
- name: Ensure SID is enabled.
|
|
ipaconfig:
|
|
ipaadmin_password: SomeADMINpassword
|
|
@@ -56,18 +82,36 @@
|
|
ipaconfig:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
- enable_sid: yes
|
|
netbios_name: IPATESTPLAY
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
+ - name: Ensure netbios_name cannot be set with lowercase characters
|
|
+ ipaconfig:
|
|
+ ipaadmin_password: SomeADMINpassword
|
|
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
+ netbios_name: IPATESTplay
|
|
+ register: result
|
|
+ failed_when:
|
|
+ (not result.failed
|
|
+ and "Up to 15 characters and only uppercase ASCII letters, digits and dashes are allowed" not in result.message)
|
|
+
|
|
+ - name: Ensure netbios_name cannot be set different lowercase characters
|
|
+ ipaconfig:
|
|
+ ipaadmin_password: SomeADMINpassword
|
|
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
+ netbios_name: otherPLAY
|
|
+ register: result
|
|
+ failed_when:
|
|
+ (not result.failed
|
|
+ and "Up to 15 characters and only uppercase ASCII letters, digits and dashes are allowed" not in result.message)
|
|
+
|
|
# add_sids is not idempotent as it always tries to generate the missing
|
|
# SIDs for users and groups.
|
|
- name: Add SIDs to users and groups.
|
|
ipaconfig:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
- enable_sid: yes
|
|
add_sids: yes
|
|
|
|
# only run tests if version supports enable-sid
|
|
--
|
|
2.37.3
|
|
|