|
|
@ -16,6 +16,8 @@
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
import re
|
|
|
|
|
|
|
|
|
|
|
|
try:
|
|
|
|
try:
|
|
|
|
import psycopg2
|
|
|
|
import psycopg2
|
|
|
|
except ImportError:
|
|
|
|
except ImportError:
|
|
|
@ -34,35 +36,14 @@ def user_exists(cursor, user):
|
|
|
|
return cursor.rowcount > 0
|
|
|
|
return cursor.rowcount > 0
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def user_add(cursor, user, password, db):
|
|
|
|
def user_add(cursor, user, password):
|
|
|
|
"""Create a new user with write access to the database"""
|
|
|
|
"""Create a new user with write access to the database"""
|
|
|
|
query = "CREATE USER %(user)s with PASSWORD '%(password)s'"
|
|
|
|
query = "CREATE USER %(user)s with PASSWORD '%(password)s'"
|
|
|
|
cursor.execute(query % {"user": user, "password": password})
|
|
|
|
cursor.execute(query % {"user": user, "password": password})
|
|
|
|
grant_privileges(cursor, user, db)
|
|
|
|
|
|
|
|
return True
|
|
|
|
return True
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def user_chpass(cursor, user, password):
|
|
|
|
def has_privileges(cursor, user, db):
|
|
|
|
"""Change user password"""
|
|
|
|
"""Check if the user has create privileges on the database"""
|
|
|
|
|
|
|
|
query = "SELECT has_database_privilege(%(user)s, %(db)s, 'CREATE')"
|
|
|
|
|
|
|
|
cursor.execute(query, {'user': user, 'db': db})
|
|
|
|
|
|
|
|
return cursor.fetchone()[0]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def grant_privileges(cursor, user, db):
|
|
|
|
|
|
|
|
"""Grant all privileges on the database"""
|
|
|
|
|
|
|
|
query = "GRANT ALL PRIVILEGES ON DATABASE %(db)s TO %(user)s"
|
|
|
|
|
|
|
|
cursor.execute(query % {'user': user, 'db': db})
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def revoke_privileges(cursor, user, db):
|
|
|
|
|
|
|
|
"""Revoke all privileges on the database"""
|
|
|
|
|
|
|
|
query = "REVOKE ALL PRIVILEGES ON DATABASE %(db)s FROM %(user)s"
|
|
|
|
|
|
|
|
cursor.execute(query % {'user': user, 'db': db})
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def user_mod(cursor, user, password, db):
|
|
|
|
|
|
|
|
"""Update password and permissions"""
|
|
|
|
|
|
|
|
changed = False
|
|
|
|
changed = False
|
|
|
|
|
|
|
|
|
|
|
|
# Handle passwords.
|
|
|
|
# Handle passwords.
|
|
|
@ -79,28 +60,159 @@ def user_mod(cursor, user, password, db):
|
|
|
|
if current_pass_hash != new_pass_hash:
|
|
|
|
if current_pass_hash != new_pass_hash:
|
|
|
|
changed = True
|
|
|
|
changed = True
|
|
|
|
|
|
|
|
|
|
|
|
# Handle privileges.
|
|
|
|
return changed
|
|
|
|
# For now, we just check if the user has access to the database
|
|
|
|
|
|
|
|
if not has_privileges(cursor, user, db):
|
|
|
|
def user_delete(cursor, user):
|
|
|
|
grant_privileges(cursor, user, db)
|
|
|
|
"""Try to remove a user. Returns True if successful otherwise False"""
|
|
|
|
changed = True
|
|
|
|
cursor.execute("SAVEPOINT ansible_pgsql_user_delete")
|
|
|
|
|
|
|
|
try:
|
|
|
|
|
|
|
|
cursor.execute("DROP USER %s" % user)
|
|
|
|
|
|
|
|
except:
|
|
|
|
|
|
|
|
cursor.execute("ROLLBACK TO SAVEPOINT ansible_pgsql_user_delete")
|
|
|
|
|
|
|
|
cursor.execute("RELEASE SAVEPOINT ansible_pgsql_user_delete")
|
|
|
|
|
|
|
|
return False
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
cursor.execute("RELEASE SAVEPOINT ansible_pgsql_user_delete")
|
|
|
|
|
|
|
|
return True
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def has_table_privilege(cursor, user, table, priv):
|
|
|
|
|
|
|
|
query = 'SELECT has_table_privilege(%s, %s, %s)'
|
|
|
|
|
|
|
|
cursor.execute(query, (user, table, priv))
|
|
|
|
|
|
|
|
return cursor.fetchone()[0]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def get_table_privileges(cursor, user, table):
|
|
|
|
|
|
|
|
if '.' in table:
|
|
|
|
|
|
|
|
schema, table = table.split('.', 1)
|
|
|
|
|
|
|
|
else:
|
|
|
|
|
|
|
|
schema = 'public'
|
|
|
|
|
|
|
|
query = '''SELECT privilege_type FROM information_schema.role_table_grants
|
|
|
|
|
|
|
|
WHERE grantee=%s AND table_name=%s AND table_schema=%s'''
|
|
|
|
|
|
|
|
cursor.execute(query, (user, table, schema))
|
|
|
|
|
|
|
|
return set([x[0] for x in cursor.fetchall()])
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def grant_table_privilege(cursor, user, table, priv):
|
|
|
|
|
|
|
|
prev_priv = get_table_privileges(cursor, user, table)
|
|
|
|
|
|
|
|
query = 'GRANT %s ON TABLE %s TO %s' % (priv, table, user)
|
|
|
|
|
|
|
|
cursor.execute(query)
|
|
|
|
|
|
|
|
curr_priv = get_table_privileges(cursor, user, table)
|
|
|
|
|
|
|
|
return len(curr_priv) > len(prev_priv)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def revoke_table_privilege(cursor, user, table, priv):
|
|
|
|
|
|
|
|
prev_priv = get_table_privileges(cursor, user, table)
|
|
|
|
|
|
|
|
query = 'REVOKE %s ON TABLE %s FROM %s' % (priv, table, user)
|
|
|
|
|
|
|
|
cursor.execute(query)
|
|
|
|
|
|
|
|
curr_priv = get_table_privileges(cursor, user, table)
|
|
|
|
|
|
|
|
return len(curr_priv) < len(prev_priv)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def get_database_privileges(cursor, user, db):
|
|
|
|
|
|
|
|
priv_map = {
|
|
|
|
|
|
|
|
'C':'CREATE',
|
|
|
|
|
|
|
|
'T':'TEMPORARY',
|
|
|
|
|
|
|
|
'c':'CONNECT',
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
query = 'SELECT datacl FROM pg_database WHERE datname = %s'
|
|
|
|
|
|
|
|
cursor.execute(query, (db,))
|
|
|
|
|
|
|
|
datacl = cursor.fetchone()[0]
|
|
|
|
|
|
|
|
r = re.search('%s=(C?T?c?)/[a-z]+\,?' % user, datacl)
|
|
|
|
|
|
|
|
if r is None:
|
|
|
|
|
|
|
|
return []
|
|
|
|
|
|
|
|
o = []
|
|
|
|
|
|
|
|
for v in r.group(1):
|
|
|
|
|
|
|
|
o.append(priv_map[v])
|
|
|
|
|
|
|
|
return o
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def has_database_privilege(cursor, user, db, priv):
|
|
|
|
|
|
|
|
query = 'SELECT has_database_privilege(%s, %s, %s)'
|
|
|
|
|
|
|
|
cursor.execute(query, (user, db, priv))
|
|
|
|
|
|
|
|
return cursor.fetchone()[0]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def grant_database_privilege(cursor, user, db, priv):
|
|
|
|
|
|
|
|
prev_priv = get_database_privileges(cursor, user, db)
|
|
|
|
|
|
|
|
query = 'GRANT %s ON DATABASE %s TO %s' % (priv, db, user)
|
|
|
|
|
|
|
|
cursor.execute(query)
|
|
|
|
|
|
|
|
curr_priv = get_database_privileges(cursor, user, db)
|
|
|
|
|
|
|
|
return len(curr_priv) > len(prev_priv)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def revoke_database_privilege(cursor, user, db, priv):
|
|
|
|
|
|
|
|
prev_priv = get_database_privileges(cursor, user, db)
|
|
|
|
|
|
|
|
query = 'REVOKE %s ON DATABASE %s FROM %s' % (priv, db, user)
|
|
|
|
|
|
|
|
cursor.execute(query)
|
|
|
|
|
|
|
|
curr_priv = get_database_privileges(cursor, user, db)
|
|
|
|
|
|
|
|
return len(curr_priv) < len(prev_priv)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def revoke_privileges(cursor, user, privs):
|
|
|
|
|
|
|
|
if privs is None:
|
|
|
|
|
|
|
|
return False
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
changed = False
|
|
|
|
|
|
|
|
for type_ in privs:
|
|
|
|
|
|
|
|
revoke_func = {
|
|
|
|
|
|
|
|
'table':revoke_table_privilege,
|
|
|
|
|
|
|
|
'database':revoke_database_privilege
|
|
|
|
|
|
|
|
}[type_]
|
|
|
|
|
|
|
|
for name, privileges in privs[type_].iteritems():
|
|
|
|
|
|
|
|
for privilege in privileges:
|
|
|
|
|
|
|
|
changed = revoke_func(cursor, user, name, privilege)\
|
|
|
|
|
|
|
|
or changed
|
|
|
|
|
|
|
|
|
|
|
|
return changed
|
|
|
|
return changed
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def grant_privileges(cursor, user, privs):
|
|
|
|
|
|
|
|
if privs is None:
|
|
|
|
|
|
|
|
return False
|
|
|
|
|
|
|
|
|
|
|
|
def user_delete(cursor, user, db):
|
|
|
|
changed = False
|
|
|
|
"""Delete a user, first revoking privileges"""
|
|
|
|
for type_ in privs:
|
|
|
|
revoke_privileges(cursor, user, db)
|
|
|
|
grant_func = {
|
|
|
|
cursor.execute("DROP USER %(user)s" % {'user': user})
|
|
|
|
'table':grant_table_privilege,
|
|
|
|
return True
|
|
|
|
'database':grant_database_privilege
|
|
|
|
|
|
|
|
}[type_]
|
|
|
|
|
|
|
|
for name, privileges in privs[type_].iteritems():
|
|
|
|
|
|
|
|
for privilege in privileges:
|
|
|
|
|
|
|
|
changed = grant_func(cursor, user, name, privilege)\
|
|
|
|
|
|
|
|
or changed
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return changed
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def parse_privs(privs, db):
|
|
|
|
|
|
|
|
"""
|
|
|
|
|
|
|
|
Parse privilege string to determine permissions for database db.
|
|
|
|
|
|
|
|
Format:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
privileges[/privileges/...]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Where:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
privileges := DATABASE_PRIVILEGES[,DATABASE_PRIVILEGES,...] |
|
|
|
|
|
|
|
|
TABLE_NAME:TABLE_PRIVILEGES[,TABLE_PRIVILEGES,...]
|
|
|
|
|
|
|
|
"""
|
|
|
|
|
|
|
|
if privs is None:
|
|
|
|
|
|
|
|
return privs
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
o_privs = {
|
|
|
|
|
|
|
|
'database':{},
|
|
|
|
|
|
|
|
'table':{}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
for token in privs.split('/'):
|
|
|
|
|
|
|
|
if ':' not in token:
|
|
|
|
|
|
|
|
type_ = 'database'
|
|
|
|
|
|
|
|
name = db
|
|
|
|
|
|
|
|
priv_set = set(x.strip() for x in token.split(','))
|
|
|
|
|
|
|
|
else:
|
|
|
|
|
|
|
|
type_ = 'table'
|
|
|
|
|
|
|
|
name, privileges = token.split(':', 1)
|
|
|
|
|
|
|
|
priv_set = set(x.strip() for x in privileges.split(','))
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
o_privs[type_][name] = priv_set
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return o_privs
|
|
|
|
|
|
|
|
|
|
|
|
# ===========================================
|
|
|
|
# ===========================================
|
|
|
|
# Module execution.
|
|
|
|
# Module execution.
|
|
|
|
#
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def main():
|
|
|
|
def main():
|
|
|
|
module = AnsibleModule(
|
|
|
|
module = AnsibleModule(
|
|
|
|
argument_spec=dict(
|
|
|
|
argument_spec=dict(
|
|
|
@ -110,13 +222,19 @@ def main():
|
|
|
|
user=dict(required=True, aliases=['name']),
|
|
|
|
user=dict(required=True, aliases=['name']),
|
|
|
|
password=dict(default=None),
|
|
|
|
password=dict(default=None),
|
|
|
|
state=dict(default="present", choices=["absent", "present"]),
|
|
|
|
state=dict(default="present", choices=["absent", "present"]),
|
|
|
|
db=dict(required=True),
|
|
|
|
priv=dict(default=None),
|
|
|
|
|
|
|
|
db=dict(default=''),
|
|
|
|
|
|
|
|
fail_on_user=dict(default='yes')
|
|
|
|
)
|
|
|
|
)
|
|
|
|
)
|
|
|
|
)
|
|
|
|
user = module.params["user"]
|
|
|
|
user = module.params["user"]
|
|
|
|
password = module.params["password"]
|
|
|
|
password = module.params["password"]
|
|
|
|
state = module.params["state"]
|
|
|
|
state = module.params["state"]
|
|
|
|
|
|
|
|
fail_on_user = module.params["fail_on_user"] == 'yes'
|
|
|
|
db = module.params["db"]
|
|
|
|
db = module.params["db"]
|
|
|
|
|
|
|
|
if db == '' and module.params["priv"] is not None:
|
|
|
|
|
|
|
|
module.fail_json(msg="privileges require a database to be specified")
|
|
|
|
|
|
|
|
privs = parse_privs(module.params["priv"], db)
|
|
|
|
|
|
|
|
|
|
|
|
if not postgresqldb_found:
|
|
|
|
if not postgresqldb_found:
|
|
|
|
module.fail_json(msg="the python psycopg2 module is required")
|
|
|
|
module.fail_json(msg="the python psycopg2 module is required")
|
|
|
@ -127,33 +245,44 @@ def main():
|
|
|
|
params_map = {
|
|
|
|
params_map = {
|
|
|
|
"login_host":"host",
|
|
|
|
"login_host":"host",
|
|
|
|
"login_user":"user",
|
|
|
|
"login_user":"user",
|
|
|
|
"login_password":"password"
|
|
|
|
"login_password":"password",
|
|
|
|
|
|
|
|
"db":"database"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
kw = dict( (params_map[k], v) for (k, v) in module.params.iteritems()
|
|
|
|
kw = dict( (params_map[k], v) for (k, v) in module.params.iteritems()
|
|
|
|
if k in params_map and v != "" )
|
|
|
|
if k in params_map and v != "" )
|
|
|
|
try:
|
|
|
|
try:
|
|
|
|
db_connection = psycopg2.connect(database=db, **kw)
|
|
|
|
db_connection = psycopg2.connect(**kw)
|
|
|
|
cursor = db_connection.cursor()
|
|
|
|
cursor = db_connection.cursor()
|
|
|
|
except Exception, e:
|
|
|
|
except Exception, e:
|
|
|
|
module.fail_json(msg="unable to connect to database: %s" % e)
|
|
|
|
module.fail_json(msg="unable to connect to database: %s" % e)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
kw = dict(user=user)
|
|
|
|
|
|
|
|
changed = False
|
|
|
|
|
|
|
|
user_removed = False
|
|
|
|
if state == "present":
|
|
|
|
if state == "present":
|
|
|
|
if user_exists(cursor, user):
|
|
|
|
if user_exists(cursor, user):
|
|
|
|
changed = user_mod(cursor, user, password, db)
|
|
|
|
changed = user_chpass(cursor, user, password)
|
|
|
|
else:
|
|
|
|
else:
|
|
|
|
if password is None:
|
|
|
|
if password is None:
|
|
|
|
msg = "password parameter required when adding a user"
|
|
|
|
msg = "password parameter required when adding a user"
|
|
|
|
module.fail_json(msg=msg)
|
|
|
|
module.fail_json(msg=msg)
|
|
|
|
changed = user_add(cursor, user, password, db)
|
|
|
|
changed = user_add(cursor, user, password)
|
|
|
|
|
|
|
|
changed = grant_privileges(cursor, user, privs) or changed
|
|
|
|
elif state == "absent":
|
|
|
|
else:
|
|
|
|
if user_exists(cursor, user):
|
|
|
|
if user_exists(cursor, user):
|
|
|
|
changed = user_delete(cursor, user, db)
|
|
|
|
changed = revoke_privileges(cursor, user, privs)
|
|
|
|
else:
|
|
|
|
user_removed = user_delete(cursor, user)
|
|
|
|
changed = False
|
|
|
|
changed = changed or user_removed
|
|
|
|
# Commit the database changes
|
|
|
|
if fail_on_user and not user_removed:
|
|
|
|
db_connection.commit()
|
|
|
|
msg = "unable to remove user"
|
|
|
|
module.exit_json(changed=changed, user=user)
|
|
|
|
module.fail_json(msg=msg)
|
|
|
|
|
|
|
|
kw['user_removed'] = user_removed
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if changed:
|
|
|
|
|
|
|
|
db_connection.commit()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
kw['changed'] = changed
|
|
|
|
|
|
|
|
module.exit_json(**kw)
|
|
|
|
|
|
|
|
|
|
|
|
# this is magic, see lib/ansible/module_common.py
|
|
|
|
# this is magic, see lib/ansible/module_common.py
|
|
|
|
#<<INCLUDE_ANSIBLE_MODULE_COMMON>>
|
|
|
|
#<<INCLUDE_ANSIBLE_MODULE_COMMON>>
|
|
|
|