#!/usr/bin/python # -*- coding: utf-8 -*- # Authors: # $author <$email> # # Copyright (C) $year Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . ANSIBLE_METADATA = { "metadata_version": "1.0", "supported_by": "community", "status": ["preview"], } DOCUMENTATION = """ --- module: ipa$name short description: Manage FreeIPA $name description: Manage FreeIPA $name and $name members options: ipaadmin_principal: description: The admin principal. default: admin ipaadmin_password: description: The admin password. required: false name: description: The list of $name name strings. required: true aliases: ["API_PARAMETER_NAME"] PARAMETER1: description: DESCRIPTION required: REQUIRED aliases: ["API_PARAMETER_NAME"] PARAMETER2: description: member DESCRIPTION required: REQUIRED aliases: ["API_PARAMETER_NAME"] action: description: Work on $name or member level. choices: ["$name", "member"] default: $name required: false state: description: The state to ensure. choices: ["present", "absent"] default: present required: true """ EXAMPLES = """ # Ensure $name NAME is present - ipa$name: name: NAME PARAMETERS # Ensure $name "NAME" member PARAMETER2 VALUE is present - ipa$name: name: NAME PARAMETER2: VALUE action: member # Ensure $name "NAME" member PARAMETER2 VALUE is absent - ipa$name: name: NAME PARAMETER2: VALUE action: member state: absent # Ensure $name NAME is absent - ipa$name: name: NAME state: absent # Ensure $name NAME ... - ipa$name: name: NAME CHANGE PARAMETERS """ RETURN = """ """ from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.ansible_freeipa_module import \ temp_kinit, temp_kdestroy, valid_creds, api_connect, api_command, \ compare_args_ipa, module_params_get, gen_add_del_lists import six if six.PY3: unicode = str def find_$name(module, name): """Find if a $name with the given name already exist.""" try: _result = api_command(module, "$name_show", name, {"all": True}) except Exception: # pylint: disable=broad-except # An exception is raised if $name name is not found. return None else: return _result["result"] def gen_args(PARAMETER1): _args = {} if PARAMETER1 is not None: _args["API_PARAMETER1_NAME"] = PARAMETER1 return _args def gen_member_args(PARAMETER2): _args = {} if PARAMETER2 is not None: _args["API_PARAMETER2_NAME"] = PARAMETER2 return _args def main(): ansible_module = AnsibleModule( argument_spec=dict( # general ipaadmin_principal=dict(type="str", default="admin"), ipaadmin_password=dict(type="str", required=False, no_log=True), name=dict(type="list", aliases=["API_PARAMETER_NAME"], default=None, required=True), # present PARAMETER1=dict(required=False, type='str', aliases=["API_PARAMETER_NAME"], default=None), PARAMETER2=dict(required=False, type='list', aliases=["API_PARAMETER_NAME"], default=None), action=dict(type="str", default="$name", choices=["member", "$name"]), # state state=dict(type="str", default="present", choices=["present", "absent"]), ), supports_check_mode=True, ) ansible_module._ansible_debug = True # Get parameters # general ipaadmin_principal = module_params_get(ansible_module, "ipaadmin_principal") ipaadmin_password = module_params_get(ansible_module, "ipaadmin_password") names = module_params_get(ansible_module, "name") # present PARAMETER1 = module_params_get(ansible_module, "PARAMETER1") PARAMETER2 = module_params_get(ansible_module, "PARAMETER2") action = module_params_get(ansible_module, "action") # state state = module_params_get(ansible_module, "state") # Check parameters invalid = [] if state == "present": if len(names) != 1: ansible_module.fail_json( msg="Only one $name can be added at a time.") if action == "member": invalid = ["PARAMETER1"] if state == "absent": if len(names) < 1: ansible_module.fail_json(msg="No name given.") invalid = ["PARAMETER1"] if action == "$name": invalid.append("PARAMETER2") for x in invalid: if vars()[x] is not None: ansible_module.fail_json( msg="Argument '%s' can not be used with action " "'%s' and state '%s'" % (x, action, state)) # Init changed = False exit_args = {} ccache_dir = None ccache_name = None try: if not valid_creds(ansible_module, ipaadmin_principal): ccache_dir, ccache_name = temp_kinit(ipaadmin_principal, ipaadmin_password) api_connect() commands = [] for name in names: # Make sure $name exists res_find = find_$name(ansible_module, name) # Create command if state == "present": # Generate args args = gen_args(PARAMETER1) if action == "$name": # Found the $name if res_find is not None: # For all settings is args, check if there are # different settings in the find result. # If yes: modify if not compare_args_ipa(ansible_module, args, res_find): commands.append([name, "$name_mod", args]) else: commands.append([name, "$name_add", args]) member_args = gen_member_args(PARAMETER2) if not compare_args_ipa(ansible_module, member_args, res_find): # Generate addition and removal lists PARAMETER2_add, PARAMETER2_del = gen_add_del_lists( PARAMETER2, res_find.get("member_PARAMETER2")) # Add members if len(PARAMETER2_add) > 0: commands.append([name, "$name_add_member", { "PARAMETER2": PARAMETER2_add, }]) # Remove members if len(PARAMETER2_del) > 0: commands.append([name, "$name_remove_member", { "PARAMETER2": PARAMETER2_del, }]) elif action == "member": if res_find is None: ansible_module.fail_json( msg="No $name '%s'" % name) if PARAMETER2 is None: ansible_module.fail_json(msg="No PARAMETER2 given") commands.append([name, "$name_add_member", { "PARAMETER2": PARAMETER2, }]) elif state == "absent": if action == "$name": if res_find is not None: commands.append([name, "$name_del", {}]) elif action == "member": if res_find is None: ansible_module.fail_json( msg="No $name '%s'" % name) if PARAMETER2 is None: ansible_module.fail_json(msg="No PARAMETER2 given") commands.append([name, "$name_remove_member", { "PARAMETER2": PARAMETER2, }]) else: ansible_module.fail_json(msg="Unkown state '%s'" % state) # Check mode exit if ansible_module.check_mode: ansible_module.exit_json(changed=len(commands) > 0, **exit_args) # Execute commands for name, command, args in commands: try: result = api_command(ansible_module, command, name, args) if "completed" in result: if result["completed"] > 0: changed = True else: changed = True except Exception as e: ansible_module.fail_json(msg="%s: %s: %s" % (command, name, str(e))) # Get all errors # All "already a member" and "not a member" failures in the # result are ignored. All others are reported. errors = [] for failed_item in result.get("failed", []): failed = result["failed"][failed_item] for member_type in failed: for member, failure in failed[member_type]: if "already a member" in failure \ or "not a member" in failure: continue errors.append("%s: %s %s: %s" % ( command, member_type, member, failure)) if len(errors) > 0: ansible_module.fail_json(msg=", ".join(errors)) except Exception as e: ansible_module.fail_json(msg=str(e)) finally: temp_kdestroy(ccache_dir, ccache_name) # Done ansible_module.exit_json(changed=changed, **exit_args) if __name__ == "__main__": main()