user: add expired state

ported from
https://github.com/ansible/ansible/pull/6303

It's very useful and routine to disable a *nix user.
I implemented expired instead of locked because this prevents any use of
the account, safer than just preventing password-based authentication.

I have tests [1], but since none of the suite came along with the core
modules, I'm unsure how to submit them.

[1] https://github.com/billwanjohi/ansible/blob/add_locked_state/test/integration/roles/test_user/tasks/main.yml
pull/18777/head
billwanjohi 10 years ago committed by Matt Clay
parent 447c625cb3
commit b019076dd3

@ -84,10 +84,12 @@ options:
state:
required: false
default: "present"
choices: [ present, absent ]
choices: [ present, absent, expired ]
description:
- Whether the account should exist. When C(absent), removes
the user account.
- Whether the account should exist, and whether it is expired.
When C(absent), removes the user account.
When C(expired), the user will not be able to login through any means.
Expired state is only implemented for Linux.
createhome:
required: false
default: "yes"
@ -327,6 +329,10 @@ class User(object):
cmd.append('-s')
cmd.append(self.shell)
if self.state == 'expired':
cmd.append('--expiredate')
cmd.append('1')
if self.password is not None:
cmd.append('-p')
cmd.append(self.password)
@ -433,6 +439,10 @@ class User(object):
cmd.append('-s')
cmd.append(self.shell)
if self.state == 'expired':
cmd.append('--expiredate')
cmd.append('1')
if self.update_password == 'always' and self.password is not None and info[1] != self.password:
cmd.append('-p')
cmd.append(self.password)
@ -703,6 +713,10 @@ class FreeBsdUser(User):
cmd.append('-L')
cmd.append(self.login_class)
if self.state == 'expired':
cmd.append('-e')
cmd.append('1970-01-01')
# system cannot be handled currently - should we error if its requested?
# create the user
(rc, out, err) = self.execute_command(cmd)
@ -787,6 +801,10 @@ class FreeBsdUser(User):
new_groups = groups | set(current_groups)
cmd.append(','.join(new_groups))
if self.state == 'expired':
cmd.append('-e')
cmd.append('1970-01-01')
# modify the user if cmd will do anything
if cmd_len != len(cmd):
(rc, out, err) = self.execute_command(cmd)
@ -863,6 +881,10 @@ class OpenBSDUser(User):
cmd.append('-L')
cmd.append(self.login_class)
if self.state == 'expired':
cmd.append('-e')
cmd.append('1')
if self.password is not None:
cmd.append('-p')
cmd.append(self.password)
@ -957,6 +979,10 @@ class OpenBSDUser(User):
cmd.append('-L')
cmd.append(self.login_class)
if self.state == 'expired':
cmd.append('-e')
cmd.append('1')
if self.update_password == 'always' and self.password is not None and info[1] != self.password:
cmd.append('-p')
cmd.append(self.password)
@ -1030,6 +1056,10 @@ class NetBSDUser(User):
cmd.append('-L')
cmd.append(self.login_class)
if self.state == 'expired':
cmd.append('-e')
cmd.append('1')
if self.password is not None:
cmd.append('-p')
cmd.append(self.password)
@ -1112,6 +1142,10 @@ class NetBSDUser(User):
cmd.append('-L')
cmd.append(self.login_class)
if self.state == 'expired':
cmd.append('-e')
cmd.append('1')
if self.update_password == 'always' and self.password is not None and info[1] != self.password:
cmd.append('-p')
cmd.append(self.password)
@ -1189,6 +1223,10 @@ class SunOS(User):
if self.createhome:
cmd.append('-m')
if self.state == 'expired':
cmd.append('-e')
cmd.append('1/1/70')
cmd.append(self.name)
if self.module.check_mode:
@ -1273,6 +1311,10 @@ class SunOS(User):
cmd.append('-s')
cmd.append(self.shell)
if self.state == 'expired':
cmd.append('-e')
cmd.append('1/1/70')
if self.module.check_mode:
return (0, '', '')
else:
@ -1362,6 +1404,10 @@ class AIX(User):
if self.createhome:
cmd.append('-m')
if self.state == 'expired':
cmd.append('-e')
cmd.append('0101000070')
cmd.append(self.name)
(rc, out, err) = self.execute_command(cmd)
@ -1431,6 +1477,9 @@ class AIX(User):
cmd.append('-s')
cmd.append(self.shell)
if self.state == 'expired':
cmd.append('-e')
cmd.append('0101000070')
# skip if no changes to be made
if len(cmd) == 1:
@ -1468,7 +1517,7 @@ def main():
}
module = AnsibleModule(
argument_spec = dict(
state=dict(default='present', choices=['present', 'absent'], type='str'),
state=dict(default='present', choices=['present', 'absent', 'expired'], type='str'),
name=dict(required=True, aliases=['user'], type='str'),
uid=dict(default=None, type='str'),
non_unique=dict(default='no', type='bool'),
@ -1523,7 +1572,10 @@ def main():
module.fail_json(name=user.name, msg=err, rc=rc)
result['force'] = user.force
result['remove'] = user.remove
elif user.state == 'present':
elif user.state == 'expired' and user.platform != 'Generic':
module.fail_json(name=user.state,
msg='expired state not yet support for {0} platform'.format(user.platform))
elif user.state == 'present' or user.state == 'expired':
if not user.user_exists():
if module.check_mode:
module.exit_json(changed=True)

Loading…
Cancel
Save