diff --git a/README-config.md b/README-config.md new file mode 100644 index 00000000..608df548 --- /dev/null +++ b/README-config.md @@ -0,0 +1,145 @@ +Config module +=========== + +Description +----------- + +The config module allows the setting of global config parameters within IPA. If no parameters are specified it returns the list of all current parameters. + +The config module is as compatible as possible to the Ansible upstream `ipa_config` module, but adds many additional parameters + + +Features +-------- +* IPA server configuration management + + +Supported FreeIPA Versions +-------------------------- + +FreeIPA versions 4.4.0 and up are supported by the ipaconfig module. + + +Requirements +------------ + +**Controller** +* Ansible version: 2.8+ + +**Node** +* Supported FreeIPA version (see above) + + +Usage +===== + +Example inventory file + +```ini +[ipaserver] +ipaserver.test.local +``` + + +Example playbook to read config options: + +```yaml +--- +- name: Playbook to handle global config options + hosts: ipaserver + become: true + tasks: + - name: return current values of the global configuration options + ipaconfig: + ipaadmin_password: password + register: result + - name: display default login shell + debug: + msg: '{{result.config.defaultlogin }}' + + - name: ensure defaultloginshell and maxusernamelength are set as required + ipaconfig: + ipaadmin_password: password + defaultlogin: /bin/bash + maxusername: 64 +``` + +```yaml +--- +- name: Playbook to ensure some config options are set + hosts: ipaserver + become: true + tasks: + - name: set defaultlogin and maxusername + ipaconfig: + ipaadmin_password: password + defaultlogin: /bin/bash + maxusername: 64 +``` + + +Variables +========= + +ipauser +------- + +**General Variables:** + +Variable | Description | Required +-------- | ----------- | -------- +`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no +`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no +`maxusername` \| `ipamaxusernamelength` | Set the maximum username length (1 to 255) | false +`homedirectory` \| `ipahomesrootdir` | Set the default location of home directories | false +`defaultshell` \| `ipadefaultloginshell` | Set the default shell for new users | false +`defaultgroup` \| `ipadefaultprimarygroup` | Set the default group for new users | false +`emaildomain`\| `ipadefaultemaildomain` | Set the default e-mail domain | false +`searchtimelimit` \| `ipasearchtimelimit` | Set maximum amount of time (seconds) for a search -1 to 2147483647 (-1 or 0 is unlimited) | false +`searchrecordslimit` \| `ipasearchrecordslimit` | Set maximum number of records to search -1 to 2147483647 (-1 or 0 is unlimited) | false +`usersearch` \| `ipausersearchfields` | Set list of fields to search when searching for users | false +`groupsearch` \| `ipagroupsearchfields` | Set list of fields to search in when searching for groups | false +`enable_migration` \| `ipamigrationenabled` | Enable migration mode (choices: True, False ) | false +`groupobjectclasses` \| `ipagroupobjectclasses` | Set default group objectclasses (list) | false +`userobjectclasses` \| `ipauserobjectclasses` | Set default user objectclasses (list) | false +`pwdexpnotify` \| `ipapwdexpadvnotify` | Set number of days's notice of impending password expiration (0 to 2147483647) | false +`configstring` \| `ipaconfigstring` | Set extra hashes to generate in password plug-in (choices:`AllowNThash`, `KDC:Disable Last Success`, `KDC:Disable Lockout`, `KDC:Disable Default Preauth for SPNs`) | false +`selinuxusermaporder` \| `ipaselinuxusermaporder`| Set ordered list in increasing priority of SELinux users | false +`selinuxusermapdefault`\| `ipaselinuxusermapdefault` | Set default SELinux user when no match is found in SELinux map rule | false +`pac_type` \| `ipakrbauthzdata` | set default types of PAC supported for services (choices: `MS-PAC`, `PAD`, `nfs:NONE`) +`user_auth_type` \| `ipauserauthtype` | set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`) | false +`domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | false + + +Return Values +============= + +Variable | Description | Returned When +-------- | ----------- | ------------- +`config` | config dict
Fields: | No values to configure are specified +  | `homedirectory` |   +  | `defaultshell` |   +  | `defaultgroup` |   +  | `emaildomain` |   +  | `searchtimelimit` |   +  | `searchrecordslimit` |   +  | `usersearch` |   +  | `groupsearch` |   +  | `enable_migration` |   +  | `groupobjectclasses` |   +  | `userobjectclasses` |   +  | `pwdexpnotify` |   +  | `configstring` |   +  | `selinuxusermaporder` |   +  | `selinuxusermapdefault` |   +  | `pac_type` |   +  | `user_auth_type` |   +  | `domain_resolution_order` |   + + +All returned fields take the same form as their namesake input parameters + +Authors +======= + +Chris Procter diff --git a/plugins/modules/ipaconfig.py b/plugins/modules/ipaconfig.py new file mode 100644 index 00000000..d4383adc --- /dev/null +++ b/plugins/modules/ipaconfig.py @@ -0,0 +1,460 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# Authors: +# Chris Procter +# +# Copyright (C) 2020 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +ANSIBLE_METADATA = { + "metadata_version": "1.0", + "supported_by": "community", + "status": ["preview"], +} + + +DOCUMENTATION = ''' +--- +module: ipa_config +author: chris procter +short_description: Modify IPA global config options +description: +- Modify IPA global config options +options: + ipaadmin_principal: + description: The admin principal + default: admin + ipaadmin_password: + description: The admin password + required: false + maxusername: + description: Set the maximum username length between 1-255 + required: false + aliases: ['ipamaxusernamelength'] + homedirectory: + description: Set the default location of home directories + required: false + aliases: ['ipahomesrootdir'] + defaultshell: + description: Set the default shell for new users + required: false + aliases: ['ipadefaultloginshell', 'loginshell'] + defaultgroup: + description: Set the default group for new users + required: false + aliases: ['ipadefaultprimarygroup'] + emaildomain: + description: Set the default e-mail domain + required: false + aliases: ['ipadefaultemaildomain'] + searchtimelimit: + description: + - Set maximum amount of time (seconds) for a search + - values -1 to 2147483647 (-1 or 0 is unlimited) + required: false + aliases: ['ipasearchtimelimit'] + searchrecordslimit: + description: + - Set maximum number of records to search + - values -1 to 2147483647 (-1 or 0 is unlimited) + required: false + aliases: ['ipasearchrecordslimit'] + usersearch: + description: + - Set comma-separated list of fields to search for user search + required: false + aliases: ['ipausersearchfields'] + groupsearch: + description: + - Set comma-separated list of fields to search for group search + required: false + aliases: ['ipagroupsearchfields'] + enable_migration: + description: Enable migration mode + type: bool + required: false + aliases: ['enable-migration','ipamigrationenabled'] + groupobjectclasses: + description: Set default group objectclasses (comma-separated list) + required: false + type: list + aliases: ['ipagroupobjectclasses'] + userobjectclasses: + description: Set default user objectclasses (comma-separated list) + required: false + type: list + aliases: ['ipauserobjectclasses'] + pwdexpnotify: + description: + - Set number of days's notice of impending password expiration + - values 0 to 2147483647 + required: false + aliases: ['ipapwdexpadvnotify'] + configstring: + description: Set extra hashes to generate in password plug-in + required: false + type: list + choices: + - "AllowNThash" + - "KDC:Disable Last Success" + - "KDC:Disable Lockout" + - "KDC:Disable Default Preauth for SPNs" + aliases: ['ipaconfigstring'] + selinuxusermaporder: + description: Set order in increasing priority of SELinux users + required: false + type: list + aliases: ['ipaselinuxusermaporder'] + selinuxusermapdefault: + description: Set default SELinux user when no match found in map rule + required: false + aliases: ['ipaselinuxusermapdefault'] + pac_type: + description: set default types of PAC supported for services + required: false + type: list + choices: ["MS-PAC", "PAD", "nfs:NONE"] + aliases: ["pac-type","ipakrbauthzdata"] + user_auth_type: + description: set default types of supported user authentication + required: false + type: list + choices: ["password", "radius", "otp", "disabled"] + aliases: ["user-auth_type","user-auth-type","ipauserauthtype"] + domain_resolution_order: + description: set list of domains used for short name qualification + required: false + type: list + aliases: ["domain-resolution_order", + "domain-resolution-order", + "ipadomainresolutionorder"] +''' + +EXAMPLES = ''' +--- +- name: Playbook to handle global configuration options + hosts: ipaserver + become: true + tasks: + - name: return current values of the global configuration options + ipaconfig: + ipaadmin_password: password + register: result + - name: display default login shell + debug: + msg: '{{result.config.defaultshell[0] }}' + + - name: set defaultshell and maxusername + ipaconfig: + ipaadmin_password: password + defaultshell: /bin/bash + maxusername: 64 +''' + +RETURN = ''' +config: + description: Dict of all global config options + returned: When no options are set + type: dict + options: + maxusername: + description: maximum username length + returned: always + homedirectory: + description: default location of home directories + returned: always + defaultshell: + description: default shell for new users + returned: always + defaultgroup: + description: default group for new users + returned: always + emaildomain: + description: default e-mail domain + returned: always + searchtimelimit: + description: maximum amount of time (seconds) for a search + returned: always + searchrecordslimit: + description: maximum number of records to search + returned: always + usersearch: + description: comma-separated list of fields to search in user search + type: list + returned: always + groupsearch: + description: comma-separated list of fields to search in group search + type: list + returned: always + enable_migration: + description: Enable migration mode + type: bool + returned: always + groupobjectclasses: + description: default group objectclasses (comma-separated list) + type: list + returned: always + userobjectclasses: + description: default user objectclasses (comma-separated list) + type: list + returned: always + pwdexpnotify: + description: number of days's notice of impending password expiration + returned: always + configstring: + description: extra hashes to generate in password plug-in + type: list + returned: always + selinuxusermaporder: + description: order in increasing priority of SELinux users + returned: always + selinuxusermapdefault: + description: default SELinux user when no match is found in map rule + returned: always + pac_type: + description: default types of PAC supported for services + type: list + returned: always + user_auth_type: + description: default types of supported user authentication + returned: always + domain_resolution_order: + description: list of domains used for short name qualification + returned: always +''' + + +from ansible.module_utils.basic import AnsibleModule +from ansible.module_utils.ansible_freeipa_module import temp_kinit, \ + temp_kdestroy, valid_creds, api_connect, api_command_no_name, \ + compare_args_ipa, module_params_get + + +def config_show(module): + _result = api_command_no_name(module, "config_show", {}) + + return _result["result"] + + +def gen_args(params): + _args = {} + for k, v in params.items(): + if v is not None: + _args[k] = v + + return _args + + +def main(): + ansible_module = AnsibleModule( + argument_spec=dict( + # general + ipaadmin_principal=dict(type="str", default="admin"), + ipaadmin_password=dict(type="str", required=False, no_log=True), + maxusername=dict(type="int", required=False, + aliases=['ipamaxusernamelength']), + homedirectory=dict(type="str", required=False, + aliases=['ipahomesrootdir']), + defaultshell=dict(type="str", required=False, + aliases=['ipadefaultloginshell', + 'loginshell']), + defaultgroup=dict(type="str", required=False, + aliases=['ipadefaultprimarygroup']), + emaildomain=dict(type="str", required=False, + aliases=['ipadefaultemaildomain']), + searchtimelimit=dict(type="int", required=False, + aliases=['ipasearchtimelimit']), + searchrecordslimit=dict(type="int", required=False, + aliases=['ipasearchrecordslimit']), + usersearch=dict(type="list", required=False, + aliases=['ipausersearchfields']), + groupsearch=dict(type="list", required=False, + aliases=['ipagroupsearchfields']), + enable_migration=dict(type="bool", required=False, + aliases=['ipamigrationenabled', + 'enable-migration']), + groupobjectclasses=dict(type="list", required=False, + aliases=['ipagroupobjectclasses']), + userobjectclasses=dict(type="list", required=False, + aliases=['ipauserobjectclasses']), + pwdexpnotify=dict(type="int", required=False, + aliases=['ipapwdexpadvnotify']), + configstring=dict(type="list", required=False, + aliases=['ipaconfigstring'], + choices=["AllowNThash", + "KDC:Disable Last Success", + "KDC:Disable Lockout", + "KDC:Disable Default Preauth for SPNs"]), # noqa E128 + selinuxusermaporder=dict(type="list", required=False, + aliases=['ipaselinuxusermaporder']), + selinuxusermapdefault=dict(type="str", required=False, + aliases=['ipaselinuxusermapdefault']), + pac_type=dict(type="list", required=False, + aliases=["ipakrbauthzdata", "pac-type"], + choices=["MS-PAC", "PAD", "nfs:NONE"]), + user_auth_type=dict(type="list", required=False, + aliases=["ipauserauthtype", + "user-auth_type", + "user-auth-type"]), + domain_resolution_order=dict(type="list", required=False, + aliases=["ipadomainresolutionorder", + "domain-resolution_order", + "domain-resolution-order"]) + ), + supports_check_mode=True, + ) + + ansible_module._ansible_debug = True + + # Get parameters + + # general + ipaadmin_principal = module_params_get(ansible_module, + "ipaadmin_principal") + ipaadmin_password = module_params_get(ansible_module, + "ipaadmin_password") + + field_map = { + "maxusername": "ipamaxusernamelength", + "homedirectory": "ipahomesrootdir", + "defaultshell": "ipadefaultloginshell", + "defaultgroup": "ipadefaultprimarygroup", + "emaildomain": "ipadefaultemaildomain", + "searchtimelimit": "ipasearchtimelimit", + "searchrecordslimit": "ipasearchrecordslimit", + "usersearch": "ipausersearchfields", + "groupsearch": "ipagroupsearchfields", + "enable_migration": "ipamigrationenabled", + "groupobjectclasses": "ipagroupobjectclasses", + "userobjectclasses": "ipauserobjectclasses", + "pwdexpnotify": "ipapwdexpadvnotify", + "configstring": "ipaconfigstring", + "selinuxusermaporder": "ipaselinuxusermaporder", + "selinuxusermapdefault": "ipaselinuxusermapdefault", + "pac_type": "ipakrbauthzdata", + "user_auth_type": "ipauserauthtype", + "domain_resolution_order": "ipadomainresolutionorder" + } + reverse_field_map = {v: k for k, v in field_map.items()} + + params = {} + for x in field_map.keys(): + val = module_params_get(ansible_module, x) + + if val is not None: + params[field_map.get(x, x)] = val + + if params.get("ipamigrationenabled") is not None: + params["ipamigrationenabled"] = \ + str(params["ipamigrationenabled"]).upper() + + if params.get("ipaselinuxusermaporder", None): + params["ipaselinuxusermaporder"] = \ + "$".join(params["ipaselinuxusermaporder"]) + + if params.get("ipadomainresolutionorder", None): + params["ipadomainresolutionorder"] = \ + ":".join(params["ipadomainresolutionorder"]) + + if params.get("ipausersearchfields", None): + params["ipausersearchfields"] = \ + ",".join(params["ipausersearchfields"]) + + if params.get("ipagroupsearchfields", None): + params["ipagroupsearchfields"] = \ + ",".join(params["ipagroupsearchfields"]) + + if params.get("ipamaxusernamelength", 0) > 255 \ + or params.get("ipamaxusernamelength", 2) < 1: + ansible_module.fail_json( + msg="Argument 'maxusername' mustn range 1 to 255") + + for x in ["ipasearchtimelimit", + "ipasearchrecordslimit", + "ipapwdexpadvnotify"]: + if params.get(x, 0) > 2147483647: + ansible_module.fail_json( + msg="Argument '%s' has a maximum value of 2147483647" % (x)) + + for x in ["ipasearchtimelimit", "ipasearchrecordslimit"]: + if params.get(x, 0) < -2147483648: + ansible_module.fail_json( + msg="Argument '%s' has minimum value of -2147483648" % (x)) + + changed = False + exit_args = {} + ccache_dir = None + ccache_name = None + res_show = None + try: + if not valid_creds(ansible_module, ipaadmin_principal): + ccache_dir, ccache_name = temp_kinit(ipaadmin_principal, + ipaadmin_password) + api_connect() + + if params.keys(): + res_show = config_show(ansible_module) + if not compare_args_ipa(ansible_module, params, res_show): + changed = True + api_command_no_name(ansible_module, "config_mod", params) + + else: + rawresult = api_command_no_name(ansible_module, "config_show", {}) + result = rawresult['result'] + del result['dn'] + for key, v in result.items(): + k = reverse_field_map.get(key, key) + if ansible_module.argument_spec.get(k): + if k == 'ipaselinuxusermaporder': + exit_args['ipaselinuxusermaporder'] = \ + result.get(key)[0].split('$') + elif k == 'domain_resolution_order': + exit_args['domain_resolution_order'] = \ + result.get(key)[0].split('$') + elif k == 'usersearch': + exit_args['usersearch'] = \ + result.get(key)[0].split(',') + elif k == 'groupsearch': + exit_args['groupsearch'] = \ + result.get(key)[0].split(',') + elif isinstance(v, str) and \ + ansible_module.argument_spec[k]['type'] == "list": + exit_args[k] = [v] + elif isinstance(v, list) and \ + ansible_module.argument_spec[k]['type'] == "str": + exit_args[k] = ",".join(v) + elif isinstance(v, list) and \ + ansible_module.argument_spec[k]['type'] == "int": + exit_args[k] = ",".join(v) + elif isinstance(v, list) and \ + ansible_module.argument_spec[k]['type'] == "bool": + exit_args[k] = (v[0] == "TRUE") + else: + exit_args[k] = v + + except Exception as e: + ansible_module.fail_json(msg="%s %s" % (params, str(e))) + + finally: + temp_kdestroy(ccache_dir, ccache_name) + + # Done + ansible_module.exit_json(changed=changed, config=exit_args) + + +if __name__ == "__main__": + main() diff --git a/tests/config/test_config.yml b/tests/config/test_config.yml new file mode 100644 index 00000000..81f2f4e0 --- /dev/null +++ b/tests/config/test_config.yml @@ -0,0 +1,143 @@ +--- +- name: Playbook to handle users + hosts: ipaserver + become: true + gather_facts: false + + tasks: + - name: return current values of the global configuration options + ipaconfig: + ipaadmin_password: SomeADMINpassword + register: previousconfig + + - debug: + msg: "{{previousconfig}}" + + - name: set default shell to default value + ipaconfig: + ipaadmin_password: SomeADMINpassword + defaultshell: /bin/sh + register: result + failed_when: result.changed + + - name: set default shell to new value + ipaconfig: + ipaadmin_password: SomeADMINpassword + defaultshell: /bin/bash + register: result + failed_when: not result.changed + + - name: check default shell is changed + ipaconfig: + ipaadmin_password: SomeADMINpassword + defaultshell: /bin/bash + register: result + failed_when: result.changed + + - name: reset default shell to old value + ipaconfig: + ipaadmin_password: SomeADMINpassword + defaultshell: '{{previousconfig.config.defaultshell }}' + register: result + failed_when: not result.changed + + - name: check default shell is reset + ipaconfig: + ipaadmin_password: SomeADMINpassword + defaultshell: '{{previousconfig.config.defaultshell }}' + register: result + failed_when: result.changed + + - name: Ensure the default e-mail domain is ansible.com. + ipaconfig: + ipaadmin_password: SomeADMINpassword + emaildomain: ansible.com + register: result + failed_when: not result.changed + + - name: Ensure the default e-mail domain is set + ipaconfig: + ipaadmin_password: SomeADMINpassword + emaildomain: ansible.com + register: result + failed_when: result.changed + + - name: reset default e-mail domain + ipaconfig: + ipaadmin_password: SomeADMINpassword + emaildomain: '{{previousconfig.config.emaildomain }}' + register: result + failed_when: not result.changed + + - name: set pac-type + ipaconfig: + ipaadmin_password: SomeADMINpassword + pac_type: + - nfs:NONE + register: result + failed_when: not result.changed + + - name: reset pac-type + ipaconfig: + ipaadmin_password: SomeADMINpassword + pac_type: '{{previousconfig.config.pac_type}}' + register: result + failed_when: not result.changed + + - name: set usersearch + ipaconfig: + ipaadmin_password: SomeADMINpassword + usersearch: + - uid + register: result + failed_when: not result.changed + + - name: check usersearch + ipaconfig: + ipaadmin_password: SomeADMINpassword + usersearch: + - uid + register: result + failed_when: result.changed + + - name: reset changed fields + ipaconfig: + ipaadmin_password: 'SomeADMINpassword' + configstring: '{{previousconfig.config.configstring}}' + emaildomain: '{{previousconfig.config.emaildomain}}' + defaultshell: '{{previousconfig.config.defaultshell}}' + defaultgroup: '{{previousconfig.config.defaultgroup}}' + groupsearch: '{{previousconfig.config.groupsearch}}' + homedirectory: '{{previousconfig.config.homedirectory}}' + pac_type: '{{previousconfig.config.pac_type}}' + maxusername: '{{previousconfig.config.maxusername}}' + enable_migration: '{{previousconfig.config.enable_migration}}' + pwdexpnotify: '{{previousconfig.config.pwdexpnotify}}' + searchrecordslimit: '{{previousconfig.config.searchrecordslimit}}' + searchtimelimit: '{{previousconfig.config.searchtimelimit}}' + selinuxusermapdefault: '{{previousconfig.config.selinuxusermapdefault}}' + selinuxusermaporder: '{{previousconfig.config.selinuxusermaporder}}' + usersearch: '{{previousconfig.config.usersearch}}' + register: result + failed_when: not result.changed + + - name: check reset fields + ipaconfig: + ipaadmin_password: 'SomeADMINpassword' + configstring: '{{previousconfig.config.configstring}}' + emaildomain: '{{previousconfig.config.emaildomain}}' + defaultshell: '{{previousconfig.config.defaultshell}}' + defaultgroup: '{{previousconfig.config.defaultgroup}}' + groupsearch: '{{previousconfig.config.groupsearch}}' + homedirectory: '{{previousconfig.config.homedirectory}}' + pac_type: '{{previousconfig.config.pac_type}}' + maxusername: '{{previousconfig.config.maxusername}}' + enable_migration: '{{previousconfig.config.enable_migration}}' + pwdexpnotify: '{{previousconfig.config.pwdexpnotify}}' + searchrecordslimit: '{{previousconfig.config.searchrecordslimit}}' + searchtimelimit: '{{previousconfig.config.searchtimelimit}}' + selinuxusermapdefault: '{{previousconfig.config.selinuxusermapdefault}}' + selinuxusermaporder: '{{previousconfig.config.selinuxusermaporder}}' + usersearch: '{{previousconfig.config.usersearch}}' + register: result + failed_when: result.changed