New module for managing IPA Sub CA (#25640)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
This commit is contained in:
Abhijeet Kasurde
GitHub
parent
6506c4bfbc
commit
aeb896375d
2 changed files with 230 additions and 1 deletions
|
|
@ -32,6 +32,7 @@ try:
|
|||
except ImportError:
|
||||
import simplejson as json
|
||||
|
||||
import re
|
||||
from ansible.module_utils._text import to_bytes, to_native, to_text
|
||||
from ansible.module_utils.six import PY3
|
||||
from ansible.module_utils.six.moves.urllib.parse import quote
|
||||
|
|
@ -78,11 +79,28 @@ class IPAClient(object):
|
|||
err_string = e
|
||||
self.module.fail_json(msg='%s: %s' % (msg, err_string))
|
||||
|
||||
def get_ipa_version(self):
|
||||
response = self.ping()['summary']
|
||||
ipa_ver_regex = re.compile(r'IPA server version (\d\.\d\.\d).*')
|
||||
version_match = ipa_ver_regex.match(response)
|
||||
ipa_version = None
|
||||
if version_match:
|
||||
ipa_version = version_match.groups()[0]
|
||||
return ipa_version
|
||||
|
||||
def ping(self):
|
||||
return self._post_json(method='ping', name=None)
|
||||
|
||||
def _post_json(self, method, name, item=None):
|
||||
if item is None:
|
||||
item = {}
|
||||
url = '%s/session/json' % self.get_base_url()
|
||||
data = {'method': method, 'params': [[name], item]}
|
||||
data = dict(method=method)
|
||||
if method != 'ping':
|
||||
data['params'] = [[name], item]
|
||||
else:
|
||||
data['params'] = [[], {}]
|
||||
|
||||
try:
|
||||
resp, info = fetch_url(module=self.module, url=url, data=to_bytes(json.dumps(data)), headers=self.headers)
|
||||
status_code = info['status']
|
||||
|
|
|
|||
211
lib/ansible/modules/identity/ipa/ipa_subca.py
Normal file
211
lib/ansible/modules/identity/ipa/ipa_subca.py
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
# Copyright (c) 2017, Abhijeet Kasurde (akasurde@redhat.com)
|
||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
ANSIBLE_METADATA = {'metadata_version': '1.1',
|
||||
'status': ['preview'],
|
||||
'supported_by': 'community'}
|
||||
|
||||
|
||||
DOCUMENTATION = '''
|
||||
---
|
||||
module: ipa_subca
|
||||
author: Abhijeet Kasurde (@akasurde)
|
||||
short_description: Manage FreeIPA Lightweight Sub Certificate Authorities.
|
||||
description:
|
||||
- Add, modify, enable, disable and delete an IPA Lightweight Sub Certificate Authorities using IPA API.
|
||||
version_added: "2.5"
|
||||
options:
|
||||
subca_name:
|
||||
description:
|
||||
- The Sub Certificate Authority name which needs to be managed.
|
||||
required: true
|
||||
subca_subject:
|
||||
description:
|
||||
- The Sub Certificate Authority's Subject. e.g., 'CN=SampleSubCA1,O=testrelm.test'
|
||||
required: true
|
||||
subca_desc:
|
||||
description:
|
||||
- The Sub Certificate Authority's description.
|
||||
required: true
|
||||
state:
|
||||
description:
|
||||
- State to ensure
|
||||
- State 'disable' and 'enable' is available for FreeIPA 4.4.2 version and onwards
|
||||
required: false
|
||||
default: present
|
||||
choices: ["present", "absent", "enable", "disable"]
|
||||
extends_documentation_fragment: ipa.documentation
|
||||
'''
|
||||
|
||||
EXAMPLES = '''
|
||||
# Ensure IPA Sub CA is present
|
||||
- ipa_subca:
|
||||
ipa_host: spider.example.com
|
||||
ipa_pass: Passw0rd!
|
||||
state: present
|
||||
subca_name: AnsibleSubCA1
|
||||
subca_subject: 'CN=AnsibleSubCA1,O=example.com'
|
||||
subca_desc: Ansible Sub CA
|
||||
|
||||
# Ensure that IPA Sub CA is removed
|
||||
- ipa_subca:
|
||||
ipa_host: spider.example.com
|
||||
ipa_pass: Passw0rd!
|
||||
state: absent
|
||||
subca_name: AnsibleSubCA1
|
||||
|
||||
# Ensure that IPA Sub CA is disabled
|
||||
- ipa_subca:
|
||||
ipa_host: spider.example.com
|
||||
ipa_pass: Passw0rd!
|
||||
state: disable
|
||||
subca_name: AnsibleSubCA1
|
||||
'''
|
||||
|
||||
RETURN = '''
|
||||
subca:
|
||||
description: IPA Sub CA record as returned by IPA API.
|
||||
returned: always
|
||||
type: dict
|
||||
'''
|
||||
|
||||
from distutils.version import LooseVersion
|
||||
from ansible.module_utils.basic import AnsibleModule
|
||||
from ansible.module_utils.ipa import IPAClient, ipa_argument_spec
|
||||
from ansible.module_utils._text import to_native
|
||||
|
||||
|
||||
class SubCAIPAClient(IPAClient):
|
||||
def __init__(self, module, host, port, protocol):
|
||||
super(SubCAIPAClient, self).__init__(module, host, port, protocol)
|
||||
|
||||
def subca_find(self, subca_name):
|
||||
return self._post_json(method='ca_find', name=subca_name, item=None)
|
||||
|
||||
def subca_add(self, subca_name=None, subject_dn=None, details=None):
|
||||
item = dict(ipacasubjectdn=subject_dn)
|
||||
subca_desc = details.get('description', None)
|
||||
if subca_desc is not None:
|
||||
item.update(description=subca_desc)
|
||||
return self._post_json(method='ca_add', name=subca_name, item=item)
|
||||
|
||||
def subca_mod(self, subca_name=None, diff=None, details=None):
|
||||
item = get_subca_dict(details)
|
||||
for change in diff:
|
||||
update_detail = dict()
|
||||
if item[change] is not None:
|
||||
update_detail.update(setattr="{0}={1}".format(change, item[change]))
|
||||
self._post_json(method='ca_mod', name=subca_name, item=update_detail)
|
||||
|
||||
def subca_del(self, subca_name=None):
|
||||
return self._post_json(method='ca_del', name=subca_name)
|
||||
|
||||
def subca_disable(self, subca_name=None):
|
||||
return self._post_json(method='ca_disable', name=subca_name)
|
||||
|
||||
def subca_enable(self, subca_name=None):
|
||||
return self._post_json(method='ca_enable', name=subca_name)
|
||||
|
||||
|
||||
def get_subca_dict(details=None):
|
||||
module_subca = dict()
|
||||
if details['description'] is not None:
|
||||
module_subca['description'] = details['description']
|
||||
if details['subca_subject'] is not None:
|
||||
module_subca['ipacasubjectdn'] = details['subca_subject']
|
||||
return module_subca
|
||||
|
||||
|
||||
def get_subca_diff(client, ipa_subca, module_subca):
|
||||
details = get_subca_dict(module_subca)
|
||||
return client.get_diff(ipa_data=ipa_subca, module_data=details)
|
||||
|
||||
|
||||
def ensure(module, client):
|
||||
subca_name = module.params['subca_name']
|
||||
subca_subject_dn = module.params['subca_subject']
|
||||
subca_desc = module.params['subca_desc']
|
||||
|
||||
state = module.params['state']
|
||||
|
||||
ipa_subca = client.subca_find(subca_name)
|
||||
module_subca = dict(description=subca_desc,
|
||||
subca_subject=subca_subject_dn)
|
||||
|
||||
changed = False
|
||||
if state == 'present':
|
||||
if not ipa_subca:
|
||||
changed = True
|
||||
if not module.check_mode:
|
||||
client.subca_add(subca_name=subca_name, subject_dn=subca_subject_dn, details=module_subca)
|
||||
else:
|
||||
diff = get_subca_diff(client, ipa_subca, module_subca)
|
||||
# IPA does not allow to modify Sub CA's subject DN
|
||||
# So skip it for now.
|
||||
if 'ipacasubjectdn' in diff:
|
||||
diff.remove('ipacasubjectdn')
|
||||
del module_subca['subca_subject']
|
||||
|
||||
if len(diff) > 0:
|
||||
changed = True
|
||||
if not module.check_mode:
|
||||
client.subca_mod(subca_name=subca_name, diff=diff, details=module_subca)
|
||||
elif state == 'absent':
|
||||
if ipa_subca:
|
||||
changed = True
|
||||
if not module.check_mode:
|
||||
client.subca_del(subca_name=subca_name)
|
||||
elif state == 'disable':
|
||||
ipa_version = client.get_ipa_version()
|
||||
if LooseVersion(ipa_version) < LooseVersion('4.4.2'):
|
||||
module.fail_json(msg="Current version of IPA server [%s] does not support 'CA disable' option. Please upgrade to "
|
||||
"version greater than 4.4.2")
|
||||
if ipa_subca:
|
||||
changed = True
|
||||
if not module.check_mode:
|
||||
client.subca_disable(subca_name=subca_name)
|
||||
elif state == 'enable':
|
||||
ipa_version = client.get_ipa_version()
|
||||
if LooseVersion(ipa_version) < LooseVersion('4.4.2'):
|
||||
module.fail_json(msg="Current version of IPA server [%s] does not support 'CA enable' option. Please upgrade to "
|
||||
"version greater than 4.4.2")
|
||||
if ipa_subca:
|
||||
changed = True
|
||||
if not module.check_mode:
|
||||
client.subca_enable(subca_name=subca_name)
|
||||
|
||||
return changed, client.subca_find(subca_name)
|
||||
|
||||
|
||||
def main():
|
||||
argument_spec = ipa_argument_spec()
|
||||
argument_spec.update(subca_name=dict(type='str', required=True, aliases=['name']),
|
||||
subca_subject=dict(type='str', required=True),
|
||||
subca_desc=dict(type='str'),
|
||||
state=dict(type='str', default='present',
|
||||
choices=['present', 'absent', 'enabled', 'disabled']),)
|
||||
|
||||
module = AnsibleModule(argument_spec=argument_spec,
|
||||
supports_check_mode=True,)
|
||||
|
||||
client = SubCAIPAClient(module=module,
|
||||
host=module.params['ipa_host'],
|
||||
port=module.params['ipa_port'],
|
||||
protocol=module.params['ipa_prot'])
|
||||
|
||||
try:
|
||||
client.login(username=module.params['ipa_user'],
|
||||
password=module.params['ipa_pass'])
|
||||
changed, record = ensure(module, client)
|
||||
module.exit_json(changed=changed, record=record)
|
||||
except Exception as exc:
|
||||
module.fail_json(msg=to_native(exc))
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Loading…
Reference in a new issue