Change network *_user modules to use configured_password to set a users password (#28187)

* WIP, update eos_user args

* refactor password for ios_user

* add eos tests, fix ios tests

* fixed password check

* refactor iosxr_user password

* fixed password arg for nxos

* [WIP] fix vyos_user password

* fix vyos tests

* update docs for net_user

* fix typo

* fix eos tests

* add warning when attempting to use password arg

* fix sanity/unit tests

* fix eos unit tests

* fix vyos_user aggregate

* fix typo in eos documentation string

* re add configured_password to vyos tests after rebase

test/integration/targets/eos_user/tests/cli/auth.yaml

@@ -0,0 +1,39 @@
+---
+- block:
+  - name: Create user with password
+    eos_user:
+      name: auth_user
+      privilege: 15
+      role: network-operator
+      state: present
+      authorize: yes
+      provider: "{{ cli }}"
+      configured_password: pass123
+
+  - name: test login
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "pass123"
+
+  - name: test login with invalid password (should fail)
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "badpass"
+    ignore_errors: yes
+    register: results
+
+  - name: check that attempt failed
+    assert:
+      that:
+        - results.failed
+
+  always:
+  - name: delete user
+    eos_user:
+      name: auth_user
+      state: absent
+      provider: "{{ cli }}"
+      authorize: yes
+    register: result

test/integration/targets/ios_user/tests/cli/auth.yaml

@@ -0,0 +1,39 @@
+---
+- block:
+  - name: Create user with password
+    ios_user:
+      name: auth_user
+      privilege: 15
+      role: network-operator
+      state: present
+      authorize: yes
+      provider: "{{ cli }}"
+      configured_password: pass123
+
+  - name: test login
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "pass123"
+
+  - name: test login with invalid password (should fail)
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "badpass"
+    ignore_errors: yes
+    register: results
+
+  - name: check that attempt failed
+    assert:
+      that:
+        - results.failed
+
+  always:
+  - name: delete user
+    ios_user:
+      name: auth_user
+      state: absent
+      provider: "{{ cli }}"
+      authorize: yes
+    register: result

test/integration/targets/iosxr_user/tests/cli/auth.yaml

@@ -0,0 +1,35 @@
+---
+- block:
+  - name: Create user with password
+    iosxr_user:
+      name: auth_user
+      state: present
+      provider: "{{ cli }}"
+      configured_password: pass123
+
+  - name: test login
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "pass123"
+
+  - name: test login with invalid password (should fail)
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "badpass"
+    ignore_errors: yes
+    register: results
+
+  - name: check that attempt failed
+    assert:
+      that:
+        - results.failed
+
+  always:
+  - name: delete user
+    iosxr_user:
+      name: auth_user
+      state: absent
+      provider: "{{ cli }}"
+    register: result

test/integration/targets/iosxr_user/tests/cli/basic.yaml

@@ -10,7 +10,7 @@
 - name: Create user (SetUp)
   iosxr_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     state: present
     provider: "{{ cli }}"
   register: result
@@ -24,7 +24,7 @@
 - name: Create user with update_password always (not idempotent)
   iosxr_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     update_password: always
     state: present
     provider: "{{ cli }}"
@@ -39,7 +39,7 @@
 - name: Create user again with update_password on_create (idempotent)
   iosxr_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     update_password: on_create
     state: present
     provider: "{{ cli }}"
@@ -53,7 +53,7 @@
 - name: Modify user group
   iosxr_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     update_password: on_create
     group: sysadmin
     state: present
@@ -69,7 +69,7 @@
 - name: Modify user group again (idempotent)
   iosxr_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     update_password: on_create
     group: sysadmin
     state: present
@@ -86,7 +86,7 @@
     aggregate:
       - name: ansibletest2
       - name: ansibletest3
-    password: test
+    configured_password: test
     state: present
     group: sysadmin
     provider: "{{ cli }}"
@@ -107,7 +107,7 @@
     aggregate:
       - name: ansibletest2
       - name: ansibletest3
-    password: test
+    configured_password: test
     state: present
     group: sysadmin
     provider: "{{ cli }}"
@@ -126,7 +126,7 @@
     aggregate:
       - name: ansibletest2
       - name: ansibletest3
-    password: test
+    configured_password: test
     update_password: on_create
     state: present
     group: sysadmin

test/integration/targets/nxos_user/tests/cli/auth.yaml

@@ -0,0 +1,36 @@
+---
+- block:
+  - name: Create user with password
+    nxos_user:
+      name: auth_user
+      role: network-operator
+      state: present
+      provider: "{{ cli }}"
+      configured_password: pass123
+
+  - name: test login
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "pass123"
+
+  - name: test login with invalid password (should fail)
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "badpass"
+    ignore_errors: yes
+    register: results
+
+  - name: check that attempt failed
+    assert:
+      that:
+        - results.failed
+
+  always:
+  - name: delete user
+    nxos_user:
+      name: auth_user
+      state: absent
+      provider: "{{ cli }}"
+    register: result

test/integration/targets/nxos_user/tests/nxapi/auth.yaml

@@ -0,0 +1,36 @@
+---
+- block:
+  - name: Create user with password
+    nxos_user:
+      name: auth_user
+      role: network-operator
+      state: present
+      provider: "{{ nxapi }}"
+      configured_password: pass123
+
+  - name: test login
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "pass123"
+
+  - name: test login with invalid password (shoul fail)
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no show version"
+      responses:
+        (?i)password: "badpass"
+    ignore_errors: yes
+    register: results
+
+  - name: check that attempt failed
+    assert:
+      that:
+        - results.failed
+
+  always:
+  - name: delete user
+    nxos_user:
+      name: auth_user
+      state: absent
+      provider: "{{ nxapi }}"
+    register: result

test/integration/targets/vyos_user/tests/cli/auth.yaml

@@ -0,0 +1,36 @@
+---
+- block:
+  - name: Create user with password
+    vyos_user:
+      name: auth_user
+      role: admin
+      state: present
+      provider: "{{ cli }}"
+      configured_password: pass123
+
+  - name: test login
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no '/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show version'"
+      responses:
+        (?i)password: "pass123"
+
+  - name: test login with invalid password (should fail)
+    expect:
+      command: "ssh auth_user@{{ inventory_hostname }} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no '/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper show version'"
+      responses:
+        (?i)password: "badpass"
+    ignore_errors: yes
+    register: results
+
+  - name: check that attempt failed
+    assert:
+      that:
+        - results.failed
+
+  always:
+  - name: delete user
+    vyos_user:
+      name: auth_user
+      state: absent
+      provider: "{{ cli }}"
+    register: result

test/integration/targets/vyos_user/tests/cli/basic.yaml

@@ -10,7 +10,7 @@
 - name: Create user
   vyos_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     state: present
     provider: "{{ cli }}"
   register: result
@@ -39,7 +39,7 @@
 - name: Add user again (Idempotent)
   vyos_user:
     name: ansibletest1
-    password: test
+    configured_password: test
     state: present
     update_password: on_create
     provider: "{{ cli }}"

test/units/modules/network/eos/test_eos_user.py

@@ -54,7 +54,7 @@ class TestEosUserModule(TestEosModule):
         self.execute_module(changed=True, commands=commands)
 
     def test_eos_user_password(self):
-        set_module_args(dict(name='ansible', password='test'))
+        set_module_args(dict(name='ansible', configured_password='test'))
         commands = ['username ansible secret test']
         self.execute_module(changed=True, commands=commands)
 
@@ -83,15 +83,15 @@ class TestEosUserModule(TestEosModule):
         self.execute_module(changed=True, commands=commands)
 
     def test_eos_user_update_password_changed(self):
-        set_module_args(dict(name='test', password='test', update_password='on_create'))
+        set_module_args(dict(name='test', configured_password='test', update_password='on_create'))
         commands = ['username test secret test']
         self.execute_module(changed=True, commands=commands)
 
     def test_eos_user_update_password_on_create_ok(self):
-        set_module_args(dict(name='ansible', password='test', update_password='on_create'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='on_create'))
         self.execute_module()
 
     def test_eos_user_update_password_always(self):
-        set_module_args(dict(name='ansible', password='test', update_password='always'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='always'))
         commands = ['username ansible secret test']
         self.execute_module(changed=True, commands=commands)

test/units/modules/network/ios/test_ios_user.py

@@ -66,7 +66,7 @@ class TestIosUserModule(TestIosModule):
         self.assertEqual(result_cmd, [cmd])
 
     def test_ios_user_password(self):
-        set_module_args(dict(name='ansible', password='test'))
+        set_module_args(dict(name='ansible', configured_password='test'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['username ansible secret test'])
 
@@ -100,15 +100,15 @@ class TestIosUserModule(TestIosModule):
         self.assertEqual(result['commands'], ['username ansible view test'])
 
     def test_ios_user_update_password_changed(self):
-        set_module_args(dict(name='test', password='test', update_password='on_create'))
+        set_module_args(dict(name='test', configured_password='test', update_password='on_create'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['username test secret test'])
 
     def test_ios_user_update_password_on_create_ok(self):
-        set_module_args(dict(name='ansible', password='test', update_password='on_create'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='on_create'))
         self.execute_module()
 
     def test_ios_user_update_password_always(self):
-        set_module_args(dict(name='ansible', password='test', update_password='always'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='always'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['username ansible secret test'])

test/units/modules/network/iosxr/test_iosxr_user.py

@@ -51,7 +51,7 @@ class TestIosxrUserModule(TestIosxrModule):
         self.assertEqual(result['commands'], ['no username ansible'])
 
     def test_iosxr_user_password(self):
-        set_module_args(dict(name='ansible', password='test'))
+        set_module_args(dict(name='ansible', configured_password='test'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['username ansible secret test'])
 
@@ -66,16 +66,16 @@ class TestIosxrUserModule(TestIosxrModule):
         self.assertEqual(result['commands'], ['username ansible group sysadmin'])
 
     def test_iosxr_user_update_password_changed(self):
-        set_module_args(dict(name='test', password='test', update_password='on_create'))
+        set_module_args(dict(name='test', configured_password='test', update_password='on_create'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'],
                          ['username test', 'username test secret test'])
 
     def test_iosxr_user_update_password_on_create_ok(self):
-        set_module_args(dict(name='ansible', password='test', update_password='on_create'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='on_create'))
         self.execute_module()
 
     def test_iosxr_user_update_password_always(self):
-        set_module_args(dict(name='ansible', password='test', update_password='always'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='always'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['username ansible secret test'])

test/units/modules/network/vyos/test_vyos_user.py

@@ -46,7 +46,7 @@ class TestVyosUserModule(TestVyosModule):
         self.load_config.return_value = dict(diff=None, session='session')
 
     def test_vyos_user_password(self):
-        set_module_args(dict(name='ansible', password='test'))
+        set_module_args(dict(name='ansible', configured_password='test'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['set system login user ansible authentication plaintext-password test'])
 
@@ -71,15 +71,15 @@ class TestVyosUserModule(TestVyosModule):
                                                              'delete system login user admin']))
 
     def test_vyos_user_update_password_changed(self):
-        set_module_args(dict(name='test', password='test', update_password='on_create'))
+        set_module_args(dict(name='test', configured_password='test', update_password='on_create'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['set system login user test authentication plaintext-password test'])
 
     def test_vyos_user_update_password_on_create_ok(self):
-        set_module_args(dict(name='ansible', password='test', update_password='on_create'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='on_create'))
         self.execute_module()
 
     def test_vyos_user_update_password_always(self):
-        set_module_args(dict(name='ansible', password='test', update_password='always'))
+        set_module_args(dict(name='ansible', configured_password='test', update_password='always'))
         result = self.execute_module(changed=True)
         self.assertEqual(result['commands'], ['set system login user ansible authentication plaintext-password test'])