internet/community.general
3
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2026-04-21 08:11:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

udm_user, homectl - replace crypt/legacycrypt with passlib (#11860)

Browse Source 
* udm_user - replace crypt/legacycrypt with passlib

The stdlib crypt module was removed in Python 3.13. Replace the
crypt/legacycrypt import chain with passlib (already used elsewhere
in the collection) and use CryptContext.verify() for password
comparison.

Fixes #4690

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add changelog fragment for PR 11860

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* remove redundant ignore file entries

* udm_user, homectl - replace crypt/legacycrypt with _crypt module utils

Add a new _crypt module_utils that abstracts password hashing and
verification. It uses passlib when available, falling back to the
stdlib crypt or legacycrypt, and raises ImportError if none of them
can be imported. Both udm_user and homectl now use this shared
utility, fixing compatibility with Python 3.13+.

Fixes #4690

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add BOTMETA entry for _crypt module utils

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* _crypt - fix mypy errors and handle complete unavailability

Replace CryptContext = object fallback (rejected by mypy) with a
proper dummy class definition. Add has_crypt_context flag so modules
can detect when no backend is available. Update both modules to
import and check has_crypt_context instead of testing for None.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* adjsutments from review

* Update plugins/modules/homectl.py

Co-authored-by: Felix Fontein <felix@fontein.de>

* Update plugins/modules/udm_user.py

Co-authored-by: Felix Fontein <felix@fontein.de>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
This commit is contained in:
Alexei Znamensky
2026-04-20 07:53:44 +12:00
committed by GitHub
parent 39f4cda6b5
commit 25b21183bb
11 changed files with 100 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
plugins/modules/homectl.py
View File

@@ -15,10 +15,11 @@ version_added: 4.4.0
description:
- Manages a user's home directory managed by systemd-homed.
notes:
- This module requires the deprecated L(crypt Python module, https://docs.python.org/3.12/library/crypt.html) library which
was removed from Python 3.13. For Python 3.13 or newer, you need to install L(legacycrypt, https://pypi.org/project/legacycrypt/).
- This module uses L(passlib, https://pypi.org/project/passlib/) for password hashing when available,
falling back to the Python C(crypt) module or L(legacycrypt, https://pypi.org/project/legacycrypt/).
requirements:
- legacycrypt (on Python 3.13 or newer)
- passlib (Python library, recommended), or legacycrypt on Python 3.13 or newer
- It requires no dependency on Python 3.12 and earlier, but then it relies on the deprecated standard library C(crypt).
extends_documentation_fragment:
- community.general.attributes
attributes:
@@ -268,38 +269,23 @@ data:
"""
import json
import traceback
from ansible.module_utils.basic import AnsibleModule, jsonify, missing_required_lib
from ansible.module_utils.basic import AnsibleModule, jsonify
from ansible.module_utils.common.text.formatters import human_to_bytes
CRYPT_IMPORT_ERROR: str | None
try:
import crypt
except ImportError:
HAS_CRYPT = False
CRYPT_IMPORT_ERROR = traceback.format_exc()
else:
HAS_CRYPT = True
CRYPT_IMPORT_ERROR = None
from ansible_collections.community.general.plugins.module_utils import deps
LEGACYCRYPT_IMPORT_ERROR: str | None
try:
import legacycrypt
with deps.declare("crypt_context"):
from ansible_collections.community.general.plugins.module_utils._crypt import CryptContext, has_crypt_context
if not HAS_CRYPT:
crypt = legacycrypt
except ImportError:
HAS_LEGACYCRYPT = False
LEGACYCRYPT_IMPORT_ERROR = traceback.format_exc()
else:
HAS_LEGACYCRYPT = True
LEGACYCRYPT_IMPORT_ERROR = None
if not has_crypt_context:
raise ImportError("Failed to import any of: passlib, crypt, legacycrypt")
class Homectl:
def __init__(self, module):
def __init__(self, module, crypt_context):
self.module = module
self.crypt_context = crypt_context
self.state = module.params["state"]
self.name = module.params["name"]
self.password = module.params["password"]
@@ -364,14 +350,10 @@ class Homectl:
return self.module.run_command(cmd, data=record)
def _hash_password(self, password):
method = crypt.METHOD_SHA512
salt = crypt.mksalt(method, rounds=10000)
pw_hash = crypt.crypt(password, salt)
return pw_hash
return self.crypt_context.hash(password, scheme="sha512_crypt", rounds=10000)
def _check_password(self, pwhash):
hash = crypt.crypt(self.password, pwhash)
return pwhash == hash
return self.crypt_context.verify(self.password, pwhash)
def remove_user(self):
cmd = [self.module.get_bin_path("homectl", True)]
@@ -616,13 +598,10 @@ def main():
)
module.run_command_environ_update = {"LANGUAGE": "C", "LC_ALL": "C"}
if not HAS_CRYPT and not HAS_LEGACYCRYPT:
module.fail_json(
msg=missing_required_lib("crypt (part of standard library up to Python 3.12) or legacycrypt (PyPI)"),
exception=CRYPT_IMPORT_ERROR,
)
deps.validate(module)
homectl = Homectl(module)
crypt_context = CryptContext(schemes=["sha512_crypt", "sha256_crypt", "md5_crypt", "des_crypt"])
homectl = Homectl(module, crypt_context)
homectl.result["state"] = homectl.state
# First we need to make sure homed service is active

52
plugins/modules/udm_user.py
View File

@@ -16,10 +16,11 @@ description:
- This module allows to manage posix users on a univention corporate server (UCS). It uses the Python API of the UCS to
create a new object or edit it.
notes:
- This module requires the deprecated L(crypt Python module, https://docs.python.org/3.12/library/crypt.html) library which
was removed from Python 3.13. For Python 3.13 or newer, you need to install L(legacycrypt, https://pypi.org/project/legacycrypt/).
- This module uses L(passlib, https://pypi.org/project/passlib/) for password hashing when available,
falling back to the Python C(crypt) module or L(legacycrypt, https://pypi.org/project/legacycrypt/).
requirements:
- legacycrypt (on Python 3.13 or newer)
- passlib (Python library, recommended), or legacycrypt on Python 3.13 or newer
- It requires no dependency on Python 3.12 and earlier, but then it relies on the deprecated standard library C(crypt).
extends_documentation_fragment:
- community.general.attributes
attributes:
@@ -316,10 +317,18 @@ EXAMPLES = r"""
RETURN = """#"""
import traceback
from datetime import date, timedelta
from ansible.module_utils.basic import AnsibleModule, missing_required_lib
from ansible.module_utils.basic import AnsibleModule
from ansible_collections.community.general.plugins.module_utils import deps
with deps.declare("crypt_context"):
from ansible_collections.community.general.plugins.module_utils._crypt import CryptContext, has_crypt_context
if not has_crypt_context:
raise ImportError("Failed to import any of: passlib, crypt, legacycrypt")
from ansible_collections.community.general.plugins.module_utils.univention_umc import (
base_dn,
@@ -328,29 +337,6 @@ from ansible_collections.community.general.plugins.module_utils.univention_umc i
umc_module_for_edit,
)
CRYPT_IMPORT_ERROR: str | None
try:
import crypt
except ImportError:
HAS_CRYPT = False
CRYPT_IMPORT_ERROR = traceback.format_exc()
else:
HAS_CRYPT = True
CRYPT_IMPORT_ERROR = None
LEGACYCRYPT_IMPORT_ERROR: str | None
try:
import legacycrypt
if not HAS_CRYPT:
crypt = legacycrypt
except ImportError:
HAS_LEGACYCRYPT = False
LEGACYCRYPT_IMPORT_ERROR = traceback.format_exc()
else:
HAS_LEGACYCRYPT = True
LEGACYCRYPT_IMPORT_ERROR = None
def main():
expiry = date.strftime(date.today() + timedelta(days=365), "%Y-%m-%d")
@@ -410,11 +396,9 @@ def main():
required_if=([("state", "present", ["firstname", "lastname", "password"])]),
)
if not HAS_CRYPT and not HAS_LEGACYCRYPT:
module.fail_json(
msg=missing_required_lib("crypt (part of standard library up to Python 3.12) or legacycrypt (PyPI)"),
exception=LEGACYCRYPT_IMPORT_ERROR,
)
deps.validate(module)
crypt_context = CryptContext(schemes=["sha512_crypt", "sha256_crypt", "md5_crypt", "des_crypt"])
username = module.params["username"]
position = module.params["position"]
@@ -474,7 +458,7 @@ def main():
obj["password"] = password
if module.params["update_password"] == "always":
old_password = obj["password"].split("}", 2)[1]
if crypt.crypt(password, old_password) != old_password:
if not crypt_context.verify(password, old_password):
obj["overridePWHistory"] = module.params["overridePWHistory"]
obj["overridePWLength"] = module.params["overridePWLength"]
obj["password"] = password