mirror of https://github.com/ansible/ansible.git
Feature udm user (#2406)
* Creating directory univention * UCS udm_user: added Signed-off-by: Tobias Rüetschi <tobias.ruetschi@adfinis-sygroup.ch> * UCS udm_user: updating, added support to modify user groups Signed-off-by: Tobias Rüetschi <tobias.ruetschi@adfinis-sygroup.ch> * UCS udm_user: add key homedrive Signed-off-by: Tobias Rüetschi <tobias.ruetschi@adfinis-sygroup.ch> * UCS udm_user: add key userexpiry Signed-off-by: Tobias Rüetschi <tobias.ruetschi@adfinis-sygroup.ch> * python styling Signed-off-by: Tobias Rüetschi <tobias.ruetschi@adfinis-sygroup.ch> * UCS udm_user: updated, add supports check mode Signed-off-by: Tobias Rüetschi <tobias.ruetschi@adfinis-sygroup.ch> * UCS udm_user: updated, add support to modify users * UCS udm_user: change string formating * UCS udm_user: add type definitions to the argument specification * UCS udm_user: only modify object if it has changed * UCS udm_user: if user not exists, changed is always true * UCS udm_user: import common code for univention from ansible.module_utils.univention_umc * UCS udm_user: add a lot more attributes * UCS udm_user: add license information * UCS udm_user: fix API serviceprovider and unixhome * UCS udm_user: add documentation * univention udm_user: import only AnsibleModule from ansible.module_utils.basic * univention udm_user: reorder documentation options * univention udm_user: fix documentation * univention udm_user: dont log password * univention udm_user: add more examplesreviewable/pr18780/r1
Tobias Rüetschi
8 years ago
committed by
John R Barker
parent
628ee6864d
commit
825a224d38
@ -0,0 +1,530 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: UTF-8 -*-
|
||||
|
||||
# Copyright (c) 2016, Adfinis SyGroup AG
|
||||
# Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
|
||||
#
|
||||
# This file is part of Ansible
|
||||
#
|
||||
# Ansible is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Ansible is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
from ansible.module_utils.univention_umc import (
|
||||
umc_module_for_add,
|
||||
umc_module_for_edit,
|
||||
ldap_search,
|
||||
base_dn,
|
||||
)
|
||||
from datetime import date
|
||||
from dateutil.relativedelta import relativedelta
|
||||
import crypt
|
||||
|
||||
|
||||
DOCUMENTATION = '''
|
||||
---
|
||||
module: udm_user
|
||||
version_added: "2.2"
|
||||
author: "Tobias Rueetschi (@2-B)"
|
||||
short_description: Manage posix users on a univention corporate server
|
||||
description:
|
||||
- "This module allows to manage posix users on a univention corporate server (UCS).
|
||||
It uses the python API of the UCS to create a new object or edit it."
|
||||
requirements:
|
||||
- Python >= 2.6
|
||||
options:
|
||||
state:
|
||||
required: false
|
||||
default: "present"
|
||||
choices: [ present, absent ]
|
||||
description:
|
||||
- Whether the user is present or not.
|
||||
username:
|
||||
required: true
|
||||
description:
|
||||
- User name
|
||||
aliases: ['name']
|
||||
firstname:
|
||||
required: false
|
||||
description:
|
||||
- First name. Required if C(state=present).
|
||||
lastname:
|
||||
required: false
|
||||
description:
|
||||
- Last name. Required if C(state=present).
|
||||
password:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Password. Required if C(state=present).
|
||||
birthday:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Birthday
|
||||
city:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- City of users business address.
|
||||
country:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Country of users business address.
|
||||
departmentNumber:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Department number of users business address.
|
||||
description:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Description (not gecos)
|
||||
displayName:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Display name (not gecos)
|
||||
email:
|
||||
required: false
|
||||
default: ['']
|
||||
description:
|
||||
- A list of e-mail addresses.
|
||||
employeeNumber:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Employee number
|
||||
employeeType:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Employee type
|
||||
gecos:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- GECOS
|
||||
groups:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- "POSIX groups, the LDAP DNs of the groups will be found with the
|
||||
LDAP filter for each group as $GROUP:
|
||||
C((&(objectClass=posixGroup)(cn=$GROUP)))."
|
||||
homeShare:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- "Home NFS share. Must be a LDAP DN, e.g.
|
||||
C(cn=home,cn=shares,ou=school,dc=example,dc=com)."
|
||||
homeSharePath:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Path to home NFS share, inside the homeShare.
|
||||
homeTelephoneNumber:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- List of private telephone numbers.
|
||||
homedrive:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Windows home drive, e.g. C("H:").
|
||||
mailAlternativeAddress:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- List of alternative e-mail addresses.
|
||||
mailHomeServer:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- FQDN of mail server
|
||||
mailPrimaryAddress:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Primary e-mail address
|
||||
mobileTelephoneNumber:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- Mobile phone number
|
||||
organisation:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Organisation
|
||||
pagerTelephonenumber:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- List of pager telephone numbers.
|
||||
phone:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- List of telephone numbers.
|
||||
postcode:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Postal code of users business address.
|
||||
primaryGroup:
|
||||
required: false
|
||||
default: cn=Domain Users,cn=groups,$LDAP_BASE_DN
|
||||
description:
|
||||
- Primary group. This must be the group LDAP DN.
|
||||
profilepath:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Windows profile directory
|
||||
pwdChangeNextLogin:
|
||||
required: false
|
||||
default: None
|
||||
choices: [ '0', '1' ]
|
||||
description:
|
||||
- Change password on next login.
|
||||
roomNumber:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Room number of users business address.
|
||||
sambaPrivileges:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- "Samba privilege, like allow printer administration, do domain
|
||||
join."
|
||||
sambaUserWorkstations:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- Allow the authentication only on this Microsoft Windows host.
|
||||
sambahome:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Windows home path, e.g. C('\\\\$FQDN\\$USERNAME').
|
||||
scriptpath:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Windows logon script.
|
||||
secretary:
|
||||
required: false
|
||||
default: []
|
||||
description:
|
||||
- A list of superiors as LDAP DNs.
|
||||
serviceprovider:
|
||||
required: false
|
||||
default: ['']
|
||||
description:
|
||||
- Enable user for the following service providers.
|
||||
shell:
|
||||
required: false
|
||||
default: '/bin/bash'
|
||||
description:
|
||||
- Login shell
|
||||
street:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Street of users business address.
|
||||
title:
|
||||
required: false
|
||||
default: None
|
||||
description:
|
||||
- Title, e.g. C(Prof.).
|
||||
unixhome:
|
||||
required: false
|
||||
default: '/home/$USERNAME'
|
||||
description:
|
||||
- Unix home directory
|
||||
userexpiry:
|
||||
required: false
|
||||
default: Today + 1 year
|
||||
description:
|
||||
- Account expiry date, e.g. C(1999-12-31).
|
||||
position:
|
||||
required: false
|
||||
default: ''
|
||||
description:
|
||||
- "Define the whole position of users object inside the LDAP tree, e.g.
|
||||
C(cn=employee,cn=users,ou=school,dc=example,dc=com)."
|
||||
ou:
|
||||
required: false
|
||||
default: ''
|
||||
description:
|
||||
- "Organizational Unit inside the LDAP Base DN, e.g. C(school) for
|
||||
LDAP OU C(ou=school,dc=example,dc=com)."
|
||||
subpath:
|
||||
required: false
|
||||
default: 'cn=users'
|
||||
description:
|
||||
- "LDAP subpath inside the organizational unit, e.g.
|
||||
C(cn=teachers,cn=users) for LDAP container
|
||||
C(cn=teachers,cn=users,dc=example,dc=com)."
|
||||
'''
|
||||
|
||||
|
||||
EXAMPLES = '''
|
||||
# Create a user on a UCS
|
||||
- udm_user: name=FooBar
|
||||
password=secure_password
|
||||
firstname=Foo
|
||||
lastname=Bar
|
||||
|
||||
# Create a user with the DN
|
||||
# C(uid=foo,cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com)
|
||||
- udm_user: name=foo
|
||||
password=secure_password
|
||||
firstname=Foo
|
||||
lastname=Bar
|
||||
ou=school
|
||||
subpath='cn=teachers,cn=users'
|
||||
# or define the position
|
||||
- udm_user: name=foo
|
||||
password=secure_password
|
||||
firstname=Foo
|
||||
lastname=Bar
|
||||
position='cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com'
|
||||
'''
|
||||
|
||||
|
||||
RETURN = '''# '''
|
||||
|
||||
|
||||
def main():
|
||||
expiry = date.strftime(date.today()+relativedelta(years=1), "%Y-%m-%d")
|
||||
module = AnsibleModule(
|
||||
argument_spec = dict(
|
||||
birthday = dict(default=None,
|
||||
type='str'),
|
||||
city = dict(default=None,
|
||||
type='str'),
|
||||
country = dict(default=None,
|
||||
type='str'),
|
||||
departmentNumber = dict(default=None,
|
||||
type='str'),
|
||||
description = dict(default=None,
|
||||
type='str'),
|
||||
displayName = dict(default=None,
|
||||
type='str'),
|
||||
email = dict(default=[''],
|
||||
type='list'),
|
||||
employeeNumber = dict(default=None,
|
||||
type='str'),
|
||||
employeeType = dict(default=None,
|
||||
type='str'),
|
||||
firstname = dict(default=None,
|
||||
type='str'),
|
||||
gecos = dict(default=None,
|
||||
type='str'),
|
||||
groups = dict(default=[],
|
||||
type='list'),
|
||||
homeShare = dict(default=None,
|
||||
type='str'),
|
||||
homeSharePath = dict(default=None,
|
||||
type='str'),
|
||||
homeTelephoneNumber = dict(default=[],
|
||||
type='list'),
|
||||
homedrive = dict(default=None,
|
||||
type='str'),
|
||||
lastname = dict(default=None,
|
||||
type='str'),
|
||||
mailAlternativeAddress = dict(default=[],
|
||||
type='list'),
|
||||
mailHomeServer = dict(default=None,
|
||||
type='str'),
|
||||
mailPrimaryAddress = dict(default=None,
|
||||
type='str'),
|
||||
mobileTelephoneNumber = dict(default=[],
|
||||
type='list'),
|
||||
organisation = dict(default=None,
|
||||
type='str'),
|
||||
pagerTelephonenumber = dict(default=[],
|
||||
type='list'),
|
||||
password = dict(default=None,
|
||||
type='str',
|
||||
no_log=True),
|
||||
phone = dict(default=[],
|
||||
type='list'),
|
||||
postcode = dict(default=None,
|
||||
type='str'),
|
||||
primaryGroup = dict(default=None,
|
||||
type='str'),
|
||||
profilepath = dict(default=None,
|
||||
type='str'),
|
||||
pwdChangeNextLogin = dict(default=None,
|
||||
type='str',
|
||||
choices=['0', '1']),
|
||||
roomNumber = dict(default=None,
|
||||
type='str'),
|
||||
sambaPrivileges = dict(default=[],
|
||||
type='list'),
|
||||
sambaUserWorkstations = dict(default=[],
|
||||
type='list'),
|
||||
sambahome = dict(default=None,
|
||||
type='str'),
|
||||
scriptpath = dict(default=None,
|
||||
type='str'),
|
||||
secretary = dict(default=[],
|
||||
type='list'),
|
||||
serviceprovider = dict(default=[''],
|
||||
type='list'),
|
||||
shell = dict(default='/bin/bash',
|
||||
type='str'),
|
||||
street = dict(default=None,
|
||||
type='str'),
|
||||
title = dict(default=None,
|
||||
type='str'),
|
||||
unixhome = dict(default=None,
|
||||
type='str'),
|
||||
userexpiry = dict(default=expiry,
|
||||
type='str'),
|
||||
username = dict(required=True,
|
||||
aliases=['name'],
|
||||
type='str'),
|
||||
position = dict(default='',
|
||||
type='str'),
|
||||
ou = dict(default='',
|
||||
type='str'),
|
||||
subpath = dict(default='cn=users',
|
||||
type='str'),
|
||||
state = dict(default='present',
|
||||
choices=['present', 'absent'],
|
||||
type='str')
|
||||
),
|
||||
supports_check_mode=True,
|
||||
required_if = ([
|
||||
('state', 'present', ['firstname', 'lastname', 'password'])
|
||||
])
|
||||
)
|
||||
username = module.params['username']
|
||||
position = module.params['position']
|
||||
ou = module.params['ou']
|
||||
subpath = module.params['subpath']
|
||||
state = module.params['state']
|
||||
changed = False
|
||||
|
||||
users = list(ldap_search(
|
||||
'(&(objectClass=posixAccount)(uid={}))'.format(username),
|
||||
attr=['uid']
|
||||
))
|
||||
if position != '':
|
||||
container = position
|
||||
else:
|
||||
if ou != '':
|
||||
ou = 'ou={},'.format(ou)
|
||||
if subpath != '':
|
||||
subpath = '{},'.format(subpath)
|
||||
container = '{}{}{}'.format(subpath, ou, base_dn())
|
||||
user_dn = 'uid={},{}'.format(username, container)
|
||||
|
||||
exists = bool(len(users))
|
||||
|
||||
if state == 'present':
|
||||
try:
|
||||
if not exists:
|
||||
obj = umc_module_for_add('users/user', container)
|
||||
else:
|
||||
obj = umc_module_for_edit('users/user', user_dn)
|
||||
|
||||
if module.params['displayName'] == None:
|
||||
module.params['displayName'] = '{} {}'.format(
|
||||
module.params['firstname'],
|
||||
module.params['lastname']
|
||||
)
|
||||
if module.params['unixhome'] == None:
|
||||
module.params['unixhome'] = '/home/{}'.format(
|
||||
module.params['username']
|
||||
)
|
||||
for k in obj.keys():
|
||||
if (k != 'password' and
|
||||
k != 'groups' and
|
||||
module.params.has_key(k) and
|
||||
module.params[k] != None):
|
||||
obj[k] = module.params[k]
|
||||
# handle some special values
|
||||
obj['e-mail'] = module.params['email']
|
||||
password = module.params['password']
|
||||
if obj['password'] == None:
|
||||
obj['password'] = password
|
||||
else:
|
||||
old_password = obj['password'].split('}', 2)[1]
|
||||
if crypt.crypt(password, old_password) != old_password:
|
||||
obj['password'] = password
|
||||
|
||||
diff = obj.diff()
|
||||
if exists:
|
||||
for k in obj.keys():
|
||||
if obj.hasChanged(k):
|
||||
changed = True
|
||||
else:
|
||||
changed = True
|
||||
if not module.check_mode:
|
||||
if not exists:
|
||||
obj.create()
|
||||
elif changed:
|
||||
obj.modify()
|
||||
except:
|
||||
module.fail_json(
|
||||
msg="Creating/editing user {} in {} failed".format(username, container)
|
||||
)
|
||||
try:
|
||||
groups = module.params['groups']
|
||||
if groups:
|
||||
filter = '(&(objectClass=posixGroup)(|(cn={})))'.format(')(cn='.join(groups))
|
||||
group_dns = list(ldap_search(filter, attr=['dn']))
|
||||
for dn in group_dns:
|
||||
grp = umc_module_for_edit('groups/group', dn[0])
|
||||
if user_dn not in grp['users']:
|
||||
grp['users'].append(user_dn)
|
||||
if not module.check_mode:
|
||||
grp.modify()
|
||||
changed = True
|
||||
except:
|
||||
module.fail_json(
|
||||
msg="Adding groups to user {} failed".format(username)
|
||||
)
|
||||
|
||||
if state == 'absent' and exists:
|
||||
try:
|
||||
obj = umc_module_for_edit('users/user', user_dn)
|
||||
if not module.check_mode:
|
||||
obj.remove()
|
||||
changed = True
|
||||
except:
|
||||
module.fail_json(
|
||||
msg="Removing user {} failed".format(username)
|
||||
)
|
||||
|
||||
module.exit_json(
|
||||
changed=changed,
|
||||
username=username,
|
||||
diff=diff,
|
||||
container=container
|
||||
)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Loading…
Reference in New Issue