internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-05-14 05:22:05 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #172 from t-woerner/ipahost_fix_auth_ind

Browse Source 
ipahost: Fix choices of auth_ind parameter, allow to reset parameter
This commit is contained in:
Rafael Guterres Jeffman
2019-12-23 20:46:05 -03:00
committed by GitHub
parent b226ed2c7b b6100f0c19
commit 3fc5da58c4
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README-host.md
View File

@@ -280,7 +280,7 @@ Variable | Description | Required
`mac_address` \| `macaddress` | List of hardware MAC addresses. | no `mac_address` \| `macaddress` | List of hardware MAC addresses. | no
`sshpubkey` \| `ipasshpubkey` | List of SSH public keys | no `sshpubkey` \| `ipasshpubkey` | List of SSH public keys | no
`userclass` \| `class` | Host category (semantics placed on this attribute are for local interpretation) | no `userclass` \| `class` | Host category (semantics placed on this attribute are for local interpretation) | no
`auth_ind` \| `krbprincipalauthind` | Defines a whitelist for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened"] | no `auth_ind` \| `krbprincipalauthind` | Defines a whitelist for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Use empty string to reset auth_ind to the initial value. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened", ""] | no
`requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service (bool) | no `requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service (bool) | no
`ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service (bool) | no `ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service (bool) | no
`ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client (bool) | no `ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client (bool) | no

15
plugins/modules/ipahost.py
View File

@@ -147,9 +147,10 @@ options:
Defines a whitelist for Authentication Indicators. Use 'otp' to allow Defines a whitelist for Authentication Indicators. Use 'otp' to allow
OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA
authentications. Other values may be used for custom configurations. authentications. Other values may be used for custom configurations.
Use empty string to reset auth_ind to the initial value.
type: list type: list
aliases: ["krbprincipalauthind"] aliases: ["krbprincipalauthind"]
choices: ["radius", "otp", "pkinit", "hardened"] choices: ["radius", "otp", "pkinit", "hardened", ""]
required: false required: false
requires_pre_auth: requires_pre_auth:
description: Pre-authentication is required for the service description: Pre-authentication is required for the service
@@ -277,9 +278,10 @@ options:
Defines a whitelist for Authentication Indicators. Use 'otp' to allow Defines a whitelist for Authentication Indicators. Use 'otp' to allow
OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA
authentications. Other values may be used for custom configurations. authentications. Other values may be used for custom configurations.
Use empty string to reset auth_ind to the initial value.
type: list type: list
aliases: ["krbprincipalauthind"] aliases: ["krbprincipalauthind"]
choices: ["radius", "otp", "pkinit", "hardened"] choices: ["radius", "otp", "pkinit", "hardened", ""]
required: false required: false
requires_pre_auth: requires_pre_auth:
description: Pre-authentication is required for the service description: Pre-authentication is required for the service
@@ -590,7 +592,7 @@ def main():
default=None), default=None),
auth_ind=dict(type='list', aliases=["krbprincipalauthind"], auth_ind=dict(type='list', aliases=["krbprincipalauthind"],
default=None, default=None,
choices=['password', 'radius', 'otp']), choices=['radius', 'otp', 'pkinit', 'hardened', '']),
requires_pre_auth=dict(type="bool", aliases=["ipakrbrequirespreauth"], requires_pre_auth=dict(type="bool", aliases=["ipakrbrequirespreauth"],
default=None), default=None),
ok_as_delegate=dict(type="bool", aliases=["ipakrbokasdelegate"], ok_as_delegate=dict(type="bool", aliases=["ipakrbokasdelegate"],
@@ -835,6 +837,13 @@ def main():
if x in args: if x in args:
del args[x] del args[x]
# Ignore auth_ind if it is empty (for resetting)
# and not set in for the host
if "krbprincipalauthind" not in res_find and \
"krbprincipalauthind" in args and \
args["krbprincipalauthind"] == ['']:
del args["krbprincipalauthind"]
# For all settings is args, check if there are # For all settings is args, check if there are
# different settings in the find result. # different settings in the find result.
# If yes: modify # If yes: modify