mirror of https://github.com/ansible/ansible.git
LDAP: Refactor and add ldap_passwd module (#33040)
* modules/net_tools/ldap: Refactor shared options * modules/net_tools/ldap: Refactor shared code * modules/net_tools/ldap: Add ldap_passwd module * modules/net_tools/ldap/ldap_passwd: More robust change check * In some deployments, using compare_s results in spurious “changed” results, while bind is more reliable. The downside is that it results in an extra connection, and the code it more involved. * ldap_passwd: Rename methods passwd_[cs] * ldap_passwd: Remove unecessary type=str * ldap: Factor-out failure cases * ldap_passwd: Provide more precise error messages * ldap_passwd: Irrelevant syntax changes * ldap_passwd: Rename u_con to tmp_con * ldap_passwd: Keep HAS_LDAP local * LDAP doc update * Resolved all copyright related issues * Resolved self.fail calls * Update documentation Signed-off-by: The Fox in the Shell <KellerFuchs@hashbang.sh> Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>pull/39250/merge
The Fox in the Shell
7 years ago
committed by
Abhijeet Kasurde
parent
19e1f41837
commit
efe7c20100
@ -0,0 +1,78 @@
|
|||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Copyright: (c) 2016, Peter Sagerson <psagers@ignorare.net>
|
||||||
|
# Copyright: (c) 2016, Jiri Tyr <jiri.tyr@gmail.com>
|
||||||
|
# Copyright: (c) 2017-2018 Keller Fuchs (@kellerfuchs) <kellerfuchs@hashbang.sh>
|
||||||
|
#
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
|
||||||
|
from __future__ import absolute_import, division, print_function
|
||||||
|
__metaclass__ = type
|
||||||
|
|
||||||
|
import traceback
|
||||||
|
from ansible.module_utils._text import to_native
|
||||||
|
|
||||||
|
try:
|
||||||
|
import ldap
|
||||||
|
import ldap.sasl
|
||||||
|
|
||||||
|
HAS_LDAP = True
|
||||||
|
except ImportError:
|
||||||
|
HAS_LDAP = False
|
||||||
|
|
||||||
|
|
||||||
|
def gen_specs(**specs):
|
||||||
|
specs.update({
|
||||||
|
'bind_dn': dict(),
|
||||||
|
'bind_pw': dict(default='', no_log=True),
|
||||||
|
'dn': dict(required=True),
|
||||||
|
'server_uri': dict(default='ldapi:///'),
|
||||||
|
'start_tls': dict(default=False, type='bool'),
|
||||||
|
'validate_certs': dict(default=True, type='bool'),
|
||||||
|
})
|
||||||
|
|
||||||
|
return specs
|
||||||
|
|
||||||
|
|
||||||
|
class LdapGeneric(object):
|
||||||
|
def __init__(self, module):
|
||||||
|
# Shortcuts
|
||||||
|
self.module = module
|
||||||
|
self.bind_dn = self.module.params['bind_dn']
|
||||||
|
self.bind_pw = self.module.params['bind_pw']
|
||||||
|
self.dn = self.module.params['dn']
|
||||||
|
self.server_uri = self.module.params['server_uri']
|
||||||
|
self.start_tls = self.module.params['start_tls']
|
||||||
|
self.verify_cert = self.module.params['validate_certs']
|
||||||
|
|
||||||
|
# Establish connection
|
||||||
|
self.connection = self._connect_to_ldap()
|
||||||
|
|
||||||
|
def fail(self, msg, exn):
|
||||||
|
self.module.fail_json(
|
||||||
|
msg=msg,
|
||||||
|
details=to_native(exn),
|
||||||
|
exception=traceback.format_exc()
|
||||||
|
)
|
||||||
|
|
||||||
|
def _connect_to_ldap(self):
|
||||||
|
if not self.verify_cert:
|
||||||
|
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
|
||||||
|
|
||||||
|
connection = ldap.initialize(self.server_uri)
|
||||||
|
|
||||||
|
if self.start_tls:
|
||||||
|
try:
|
||||||
|
connection.start_tls_s()
|
||||||
|
except ldap.LDAPError as e:
|
||||||
|
self.fail("Cannot start TLS.", e)
|
||||||
|
|
||||||
|
try:
|
||||||
|
if self.bind_dn is not None:
|
||||||
|
connection.simple_bind_s(self.bind_dn, self.bind_pw)
|
||||||
|
else:
|
||||||
|
connection.sasl_interactive_bind_s('', ldap.sasl.external())
|
||||||
|
except ldap.LDAPError as e:
|
||||||
|
self.fail("Cannot bind to the server.", e)
|
||||||
|
|
||||||
|
return connection
|
||||||
@ -0,0 +1,147 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Copyright: (c) 2017-2018, Keller Fuchs <kellerfuchs@hashbang.sh>
|
||||||
|
#
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
|
||||||
|
from __future__ import absolute_import, division, print_function
|
||||||
|
__metaclass__ = type
|
||||||
|
|
||||||
|
|
||||||
|
ANSIBLE_METADATA = {
|
||||||
|
'metadata_version': '1.1',
|
||||||
|
'status': ['preview'],
|
||||||
|
'supported_by': 'community'
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
DOCUMENTATION = """
|
||||||
|
---
|
||||||
|
module: ldap_passwd
|
||||||
|
short_description: Set passwords in LDAP.
|
||||||
|
description:
|
||||||
|
- Set a password for an LDAP entry. This module only asserts that
|
||||||
|
a given password is valid for a given entry. To assert the
|
||||||
|
existence of an entry, see M(ldap_entry).
|
||||||
|
notes:
|
||||||
|
- The default authentication settings will attempt to use a SASL EXTERNAL
|
||||||
|
bind over a UNIX domain socket. This works well with the default Ubuntu
|
||||||
|
install for example, which includes a cn=peercred,cn=external,cn=auth ACL
|
||||||
|
rule allowing root to modify the server configuration. If you need to use
|
||||||
|
a simple bind to access your server, pass the credentials in I(bind_dn)
|
||||||
|
and I(bind_pw).
|
||||||
|
version_added: '2.6'
|
||||||
|
author:
|
||||||
|
- Keller Fuchs (@kellerfuchs)
|
||||||
|
requirements:
|
||||||
|
- python-ldap
|
||||||
|
options:
|
||||||
|
passwd:
|
||||||
|
required: true
|
||||||
|
default: null
|
||||||
|
description:
|
||||||
|
- The (plaintext) password to be set for I(dn).
|
||||||
|
extends_documentation_fragment: ldap.documentation
|
||||||
|
"""
|
||||||
|
|
||||||
|
EXAMPLES = """
|
||||||
|
- name: Set a password for the admin user
|
||||||
|
ldap_passwd:
|
||||||
|
dn: cn=admin,dc=example,dc=com
|
||||||
|
passwd: "{{ vault_secret }}"
|
||||||
|
|
||||||
|
- name: Setting passwords in bulk
|
||||||
|
ldap_passwd:
|
||||||
|
dn: "{{ item.key }}"
|
||||||
|
passwd: "{{ item.value }}"
|
||||||
|
with_dict:
|
||||||
|
alice: alice123123
|
||||||
|
bob: "|30b!"
|
||||||
|
admin: "{{ vault_secret }}"
|
||||||
|
"""
|
||||||
|
|
||||||
|
RETURN = """
|
||||||
|
modlist:
|
||||||
|
description: list of modified parameters
|
||||||
|
returned: success
|
||||||
|
type: list
|
||||||
|
sample: '[[2, "olcRootDN", ["cn=root,dc=example,dc=com"]]]'
|
||||||
|
"""
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import AnsibleModule
|
||||||
|
from ansible.module_utils.ldap import LdapGeneric, gen_specs
|
||||||
|
|
||||||
|
try:
|
||||||
|
import ldap
|
||||||
|
|
||||||
|
HAS_LDAP = True
|
||||||
|
except ImportError:
|
||||||
|
HAS_LDAP = False
|
||||||
|
|
||||||
|
|
||||||
|
class LdapPasswd(LdapGeneric):
|
||||||
|
def __init__(self, module):
|
||||||
|
LdapGeneric.__init__(self, module)
|
||||||
|
|
||||||
|
# Shortcuts
|
||||||
|
self.passwd = self.module.params['passwd']
|
||||||
|
|
||||||
|
def passwd_check(self):
|
||||||
|
try:
|
||||||
|
tmp_con = ldap.initialize(self.server_uri)
|
||||||
|
except ldap.LDAPError as e:
|
||||||
|
self.fail("Cannot initialize LDAP connection", e)
|
||||||
|
|
||||||
|
if self.start_tls:
|
||||||
|
try:
|
||||||
|
tmp_con.start_tls_s()
|
||||||
|
except ldap.LDAPError as e:
|
||||||
|
self.fail("Cannot start TLS.", e)
|
||||||
|
|
||||||
|
try:
|
||||||
|
tmp_con.simple_bind_s(self.dn, self.passwd)
|
||||||
|
except ldap.INVALID_CREDENTIALS:
|
||||||
|
return True
|
||||||
|
except ldap.LDAPError as e:
|
||||||
|
self.fail("Cannot bind to the server.", e)
|
||||||
|
else:
|
||||||
|
return False
|
||||||
|
finally:
|
||||||
|
tmp_con.unbind()
|
||||||
|
|
||||||
|
def passwd_set(self):
|
||||||
|
# Exit early if the password is already valid
|
||||||
|
if not self.passwd_check():
|
||||||
|
return False
|
||||||
|
|
||||||
|
# Change the password (or throw an exception)
|
||||||
|
try:
|
||||||
|
self.connection.passwd_set(self.dn, None, self.passwd)
|
||||||
|
except ldap.LDAPError as e:
|
||||||
|
self.fail("Unable to set password", e)
|
||||||
|
|
||||||
|
# Password successfully changed
|
||||||
|
return True
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=gen_specs(passwd=dict(no_log=True)),
|
||||||
|
supports_check_mode=True,
|
||||||
|
)
|
||||||
|
|
||||||
|
if not HAS_LDAP:
|
||||||
|
module.fail_json(
|
||||||
|
msg="Missing required 'ldap' module (pip install python-ldap).")
|
||||||
|
|
||||||
|
ldap = LdapPasswd(module)
|
||||||
|
|
||||||
|
if module.check_mode:
|
||||||
|
module.exit_json(changed=ldap.passwd_check())
|
||||||
|
|
||||||
|
module.exit_json(changed=ldap.passwd_set())
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
||||||
@ -0,0 +1,42 @@
|
|||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Copyright: (c) 2016, Peter Sagerson <psagers@ignorare.net>
|
||||||
|
# Copyright: (c) 2016, Jiri Tyr <jiri.tyr@gmail.com>
|
||||||
|
# Copyright: (c) 2017-2018 Keller Fuchs (@kellerfuchs) <kellerfuchs@hashbang.sh>
|
||||||
|
#
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
|
||||||
|
|
||||||
|
class ModuleDocFragment(object):
|
||||||
|
# Standard LDAP documentation fragment
|
||||||
|
DOCUMENTATION = '''
|
||||||
|
options:
|
||||||
|
bind_dn:
|
||||||
|
description:
|
||||||
|
- A DN to bind with. If this is omitted, we'll try a SASL bind with the EXTERNAL mechanism.
|
||||||
|
- If this is blank, we'll use an anonymous bind.
|
||||||
|
bind_pw:
|
||||||
|
description:
|
||||||
|
- The password to use with I(bind_dn).
|
||||||
|
dn:
|
||||||
|
required: true
|
||||||
|
description:
|
||||||
|
- The DN of the entry to add or remove.
|
||||||
|
server_uri:
|
||||||
|
default: ldapi:///
|
||||||
|
description:
|
||||||
|
- A URI to the LDAP server.
|
||||||
|
- The default value lets the underlying LDAP client library look for a UNIX domain socket in its default location.
|
||||||
|
start_tls:
|
||||||
|
default: 'no'
|
||||||
|
type: bool
|
||||||
|
description:
|
||||||
|
- If true, we'll use the START_TLS LDAP extension.
|
||||||
|
validate_certs:
|
||||||
|
default: 'yes'
|
||||||
|
type: bool
|
||||||
|
description:
|
||||||
|
- If set to C(no), SSL certificates will not be validated.
|
||||||
|
- This should only be used on sites using self-signed certificates.
|
||||||
|
version_added: "2.4"
|
||||||
|
'''
|
||||||
Loading…
Reference in New Issue