internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-05-14 13:32:10 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #1076 from rjeffman/fix_usercheck_dictcheck

Browse Source 
Fix handling of ipapwpolicy attributes usercheck and dictcheck
This commit is contained in:
Thomas Woerner
2023-07-14 15:25:20 +02:00
committed by GitHub
parent f4070f6a30 7b2701b985
commit c9f1da5d6b
4 changed files with 40 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
README-pwpolicy.md
View File

@@ -128,20 +128,20 @@ Variable | Description | Required
`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no `ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no `ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
`name` \| `cn` | The list of pwpolicy name strings. If name is not given, `global_policy` will be used automatically. | no `name` \| `cn` | The list of pwpolicy name strings. If name is not given, `global_policy` will be used automatically. | no
`maxlife` \| `krbmaxpwdlife` | Maximum password lifetime in days. (int) | no `maxlife` \| `krbmaxpwdlife` | Maximum password lifetime in days. (int or "") | no
`minlife` \| `krbminpwdlife` | Minimum password lifetime in hours. (int) | no `minlife` \| `krbminpwdlife` | Minimum password lifetime in hours. (int or "") | no
`history` \| `krbpwdhistorylength` | Password history size. (int) | no `history` \| `krbpwdhistorylength` | Password history size. (int or "") | no
`minclasses` \| `krbpwdmindiffchars` | Minimum number of character classes. (int) | no `minclasses` \| `krbpwdmindiffchars` | Minimum number of character classes. (int or "") | no
`minlength` \| `krbpwdminlength` | Minimum length of password. (int) | no `minlength` \| `krbpwdminlength` | Minimum length of password. (int or "") | no
`priority` \| `cospriority` | Priority of the policy, higher number means lower priority. (int) | no `priority` \| `cospriority` | Priority of the policy, higher number means lower priority. (int or "") | no
`maxfail` \| `krbpwdmaxfailure` | Consecutive failures before lockout. (int) | no `maxfail` \| `krbpwdmaxfailure` | Consecutive failures before lockout. (int or "") | no
`failinterval` \| `krbpwdfailurecountinterval` | Period after which failure count will be reset in seconds. (int) | no `failinterval` \| `krbpwdfailurecountinterval` | Period after which failure count will be reset in seconds. (int or "") | no
`lockouttime` \| `krbpwdlockoutduration` | Period for which lockout is enforced in seconds. (int) | no `lockouttime` \| `krbpwdlockoutduration` | Period for which lockout is enforced in seconds. (int or "") | no
`maxrepeat` \| `ipapwdmaxrepeat` | Maximum number of same consecutive characters. Requires IPA 4.9+ (int) | no `maxrepeat` \| `ipapwdmaxrepeat` | Maximum number of same consecutive characters. Requires IPA 4.9+ (int or "") | no
`maxsequence` \| `ipapwdmaxsequence` | The maximum length of monotonic character sequences (abcd). Requires IPA 4.9+ (int) | no `maxsequence` \| `ipapwdmaxsequence` | The maximum length of monotonic character sequences (abcd). Requires IPA 4.9+ (int or "") | no
`dictcheck` \| `ipapwdictcheck` | Check if the password is a dictionary word. Requires IPA 4.9+ (int) | no `dictcheck` \| `ipapwdictcheck` | Check if the password is a dictionary word. Requires IPA 4.9+. (bool or "") | no
`usercheck` \| `ipapwdusercheck` | Check if the password contains the username. Requires IPA 4.9+ (int) | no `usercheck` \| `ipapwdusercheck` | Check if the password contains the username. Requires IPA 4.9+. (bool or "") | no
`gracelimit` \| `passwordgracelimit` | Number of LDAP authentications allowed after expiration. Requires IPA 4.9.10 (int) | no `gracelimit` \| `passwordgracelimit` | Number of LDAP authentications allowed after expiration. Requires IPA 4.9.10 (int or "") | no
`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes `state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes

3
plugins/module_utils/ansible_freeipa_module.py
View File

@@ -30,7 +30,7 @@ __all__ = ["gssapi", "netaddr", "api", "ipalib_errors", "Env",
"kinit_password", "kinit_keytab", "run", "DN", "VERSION", "kinit_password", "kinit_keytab", "run", "DN", "VERSION",
"paths", "tasks", "get_credentials_if_valid", "Encoding", "paths", "tasks", "get_credentials_if_valid", "Encoding",
"DNSName", "getargspec", "certificate_loader", "DNSName", "getargspec", "certificate_loader",
"write_certificate_list"] "write_certificate_list", "boolean"]
import os import os
# ansible-freeipa requires locale to be C, IPA requires utf-8. # ansible-freeipa requires locale to be C, IPA requires utf-8.
@@ -49,6 +49,7 @@ from ansible.module_utils._text import to_text
from ansible.module_utils.common.text.converters import jsonify from ansible.module_utils.common.text.converters import jsonify
from ansible.module_utils import six from ansible.module_utils import six
from ansible.module_utils.common._collections_compat import Mapping from ansible.module_utils.common._collections_compat import Mapping
from ansible.module_utils.parsing.convert_bool import boolean
# Import getargspec from inspect or provide own getargspec for # Import getargspec from inspect or provide own getargspec for
# Python 2 compatibility with Python 3.11+. # Python 2 compatibility with Python 3.11+.

47
plugins/modules/ipapwpolicy.py
View File

@@ -45,82 +45,84 @@ options:
required: false required: false
aliases: ["cn"] aliases: ["cn"]
maxlife: maxlife:
description: Maximum password lifetime (in days) description: Maximum password lifetime (in days). (int or "")
type: str type: str
required: false required: false
aliases: ["krbmaxpwdlife"] aliases: ["krbmaxpwdlife"]
minlife: minlife:
description: Minimum password lifetime (in hours) description: Minimum password lifetime (in hours). (int or "")
type: str type: str
required: false required: false
aliases: ["krbminpwdlife"] aliases: ["krbminpwdlife"]
history: history:
description: Password history size description: Password history size. (int or "")
type: str type: str
required: false required: false
aliases: ["krbpwdhistorylength"] aliases: ["krbpwdhistorylength"]
minclasses: minclasses:
description: Minimum number of character classes description: Minimum number of character classes. (int or "")
type: str type: str
required: false required: false
aliases: ["krbpwdmindiffchars"] aliases: ["krbpwdmindiffchars"]
minlength: minlength:
description: Minimum length of password description: Minimum length of password. (int or "")
type: str type: str
required: false required: false
aliases: ["krbpwdminlength"] aliases: ["krbpwdminlength"]
priority: priority:
description: Priority of the policy (higher number means lower priority) description: >
Priority of the policy (higher number means lower priority). (int or "")
type: str type: str
required: false required: false
aliases: ["cospriority"] aliases: ["cospriority"]
maxfail: maxfail:
description: Consecutive failures before lockout description: Consecutive failures before lockout. (int or "")
type: str type: str
required: false required: false
aliases: ["krbpwdmaxfailure"] aliases: ["krbpwdmaxfailure"]
failinterval: failinterval:
description: Period after which failure count will be reset (seconds) description: >
Period after which failure count will be reset (seconds). (int or "")
type: str type: str
required: false required: false
aliases: ["krbpwdfailurecountinterval"] aliases: ["krbpwdfailurecountinterval"]
lockouttime: lockouttime:
description: Period for which lockout is enforced (seconds) description: Period for which lockout is enforced (seconds). (int or "")
type: str type: str
required: false required: false
aliases: ["krbpwdlockoutduration"] aliases: ["krbpwdlockoutduration"]
maxrepeat: maxrepeat:
description: > description: >
Maximum number of same consecutive characters. Maximum number of same consecutive characters.
Requires IPA 4.9+ Requires IPA 4.9+. (int or "")
type: str type: str
required: false required: false
aliases: ["ipapwdmaxrepeat"] aliases: ["ipapwdmaxrepeat"]
maxsequence: maxsequence:
description: > description: >
The maximum length of monotonic character sequences (abcd). The maximum length of monotonic character sequences (abcd).
Requires IPA 4.9+ Requires IPA 4.9+. (int or "")
type: str type: str
required: false required: false
aliases: ["ipapwdmaxsequence"] aliases: ["ipapwdmaxsequence"]
dictcheck: dictcheck:
description: > description: >
Check if the password is a dictionary word. Check if the password is a dictionary word.
Requires IPA 4.9+ Requires IPA 4.9+. (bool or "")
type: str type: str
required: false required: false
aliases: ["ipapwdictcheck"] aliases: ["ipapwdictcheck"]
usercheck: usercheck:
description: > description: >
Check if the password contains the username. Check if the password contains the username.
Requires IPA 4.9+ Requires IPA 4.9+. (bool or "")
type: str type: str
required: false required: false
aliases: ["ipapwdusercheck"] aliases: ["ipapwdusercheck"]
gracelimit: gracelimit:
description: > description: >
Number of LDAP authentications allowed after expiration. Number of LDAP authentications allowed after expiration.
Requires IPA 4.10.1+ Requires IPA 4.10.1+. (int or "")
type: str type: str
required: false required: false
aliases: ["passwordgracelimit"] aliases: ["passwordgracelimit"]
@@ -151,7 +153,7 @@ RETURN = """
""" """
from ansible.module_utils.ansible_freeipa_module import \ from ansible.module_utils.ansible_freeipa_module import \
IPAAnsibleModule, compare_args_ipa IPAAnsibleModule, compare_args_ipa, boolean
def find_pwpolicy(module, name): def find_pwpolicy(module, name):
@@ -359,17 +361,12 @@ def main():
gracelimit = int_or_empty_param(gracelimit, "gracelimit") gracelimit = int_or_empty_param(gracelimit, "gracelimit")
def bool_or_empty_param(value, param): # pylint: disable=R1710 def bool_or_empty_param(value, param): # pylint: disable=R1710
# As of Ansible 2.14, values True, False, Yes an No, with variable if value is None or value == "":
# capitalization are accepted by Ansible.
if not value:
return value return value
if value in ["TRUE", "True", "true", "YES", "Yes", "yes"]: try:
return True return boolean(value)
if value in ["FALSE", "False", "false", "NO", "No", "no"]: except TypeError as terr:
return False ansible_module.fail_json(msg="Param '%s': %s" % (param, str(terr)))
ansible_module.fail_json(
msg="Invalid value '%s' for argument '%s'." % (value, param)
)
dictcheck = bool_or_empty_param(dictcheck, "dictcheck") dictcheck = bool_or_empty_param(dictcheck, "dictcheck")
usercheck = bool_or_empty_param(usercheck, "usercheck") usercheck = bool_or_empty_param(usercheck, "usercheck")

4
tests/pwpolicy/test_pwpolicy_invalid_data_type.yml
View File

@@ -103,7 +103,7 @@
name: ops name: ops
dictcheck: "error" dictcheck: "error"
register: result register: result
failed_when: result.changed or (result.failed and "Invalid value 'error' for argument 'dictcheck" not in result.msg) failed_when: result.changed or (result.failed and "is not a valid boolean" not in result.msg)
when: ipa_version is version("4.9", ">=") when: ipa_version is version("4.9", ">=")
- name: Ensure invalid values for usercheck raise proper error. - name: Ensure invalid values for usercheck raise proper error.
@@ -113,7 +113,7 @@
name: ops name: ops
usercheck: "error" usercheck: "error"
register: result register: result
failed_when: result.changed or (result.failed and "Invalid value 'error' for argument 'usercheck'" not in result.msg) failed_when: result.changed or (result.failed and "is not a valid boolean" not in result.msg)
when: ipa_version is version("4.9", ">=") when: ipa_version is version("4.9", ">=")
- name: Ensure invalid values for gracelimit raise proper error. - name: Ensure invalid values for gracelimit raise proper error.