mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-06-10 02:35:54 +00:00
7e04a46f07
Current implementation does not allow the change of an existingi Vault
type. To allow it, data is retrieved from the current vault, the vault
is modifiend, and then, data is stored again in the new vault.
Due to changing the process of modifying a vault, this change also
fixes the update of asymmetric vault keys. To change the key used,
the task must provide the old private key, used to retrieve data,
and the new public_key, used to store the data again. A new alias
was added to public_key (new_public_key) and public_key_file
(new_public_key_file) so that the playbook better express the
intention of the tak.
Vault tests have been updated to better test against the new update
process, and a new test file has bee added:
tests/vault/test_vault_change_type.
355 lines
11 KiB
YAML
355 lines
11 KiB
YAML
---
|
|
- name: Test vault
|
|
hosts: ipaserver
|
|
become: true
|
|
# Need to gather facts for ansible_env.
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Setup testing environment.
|
|
import_tasks: env_setup.yml
|
|
|
|
- name: Ensure symmetric vault is present
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_type: symmetric
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Ensure symmetric vault is present, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_type: symmetric
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Archive data to symmetric vault, matching `no_log` field.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_data: SomeADMINpassword
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or result.vault.data != 'SomeADMINpassword'
|
|
|
|
- name: Archive data to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_data: Hello World.
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault into file {{ ansible_env.HOME }}/data.txt.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
out: "{{ ansible_env.HOME }}/data.txt"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or result.failed or (result.vault.data | default(false))
|
|
|
|
- name: Verify retrieved data.
|
|
slurp:
|
|
src: "{{ ansible_env.HOME }}/data.txt"
|
|
register: slurpfile
|
|
failed_when: slurpfile['content'] | b64decode != 'Hello World.'
|
|
|
|
- name: Archive data with non-ASCII characters to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
vault_data: The world of π is half rounded.
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'The world of π is half rounded.'
|
|
|
|
- name: Archive data in symmetric vault, from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
in: "{{ ansible_env.HOME }}/in.txt"
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Another World.'
|
|
|
|
- name: Archive data with single character to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
vault_data: c
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'c'
|
|
|
|
- name: Ensure symmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure symmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Ensure symmetric vault is present, with password from file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
username: user01
|
|
password_file: "{{ ansible_env.HOME }}/password.txt"
|
|
vault_type: symmetric
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure symmetric vault is present, with password from file, again.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
username: user01
|
|
password_file: "{{ ansible_env.HOME }}/password.txt"
|
|
vault_type: symmetric
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Archive data to symmetric vault
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_data: Hello World.
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault, with password file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password_file: "{{ ansible_env.HOME }}/password.txt"
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault, with wrong password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeWRONGpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "Invalid credentials" not in result.msg
|
|
|
|
- name: Change vault password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
new_password: SomeNEWpassword
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault, with new password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeNEWpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Retrieve data from symmetric vault, with old password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: not result.failed or "Invalid credentials" not in result.msg
|
|
|
|
- name: Change symmetric vault salt, changing password
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeNEWpassword
|
|
new_password: SomeVAULTpassword
|
|
salt: AAAAAAAAAAAAAAAAAAAAAAA=
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Change symmetric vault salt, without changing password
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
new_password: SomeVAULTpassword
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Try to change symmetric vault salt, without providing any password
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
register: result
|
|
failed_when: not result.failed and "Vault `salt` can only change when changing the password." not in result.msg
|
|
|
|
- name: Try to change symmetric vault salt, without providing `password`
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
new_password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.failed and "Vault `salt` can only change when changing the password." not in result.msg
|
|
|
|
- name: Try to change symmetric vault salt, without providing `new_password`
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
salt: MTIzNDU2Nzg5MDEyMzQ1Ngo=
|
|
password: SomeVAULTpassword
|
|
register: result
|
|
failed_when: not result.failed and "Vault `salt` can only change when changing the password." not in result.msg
|
|
|
|
- name: Try to change symmetric vault salt, using wrong password.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeWRONGpassword
|
|
new_password: SomeWRONGpassword
|
|
salt: MDEyMzQ1Njc4OTAxMjM0NQo=
|
|
register: result
|
|
failed_when: not result.failed
|
|
|
|
- name: Ensure symmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure symmetric vault is absent, again
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Try to change password of inexistent vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: inexistentvault
|
|
password: SomeVAULTpassword
|
|
new_password: SomeNEWpassword
|
|
register: result
|
|
failed_when: not result.failed or "Cannot modify password of inexistent vault" not in result.msg
|
|
|
|
- name: Ensure symmetric vault is present
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
vault_type: symmetric
|
|
password: APasswordToChange
|
|
vault_data: Hello World.
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Change symmetric vault password, using password file.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: APasswordToChange
|
|
new_password_file: "{{ ansible_env.HOME }}/password.txt"
|
|
vault_type: symmetric
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Retrieve data from symmetric vault.
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
password: SomeVAULTpassword
|
|
state: retrieved
|
|
register: result
|
|
failed_when: result.failed or result.changed or result.vault.data != 'Hello World.'
|
|
|
|
- name: Ensure symmetric vault is absent
|
|
ipavault:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: symvault
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Cleanup testing environment.
|
|
import_tasks: env_cleanup.yml
|