cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

VMware: new module vmware_host_ad_auth (#47901)

Browse source
This commit is contained in:
Christian Kotte 2018-12-18 18:04:11 +07:00 committed by Abhijeet Kasurde
parent e733d6e557
commit e65b721283
3 changed files with 503 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

369
lib/ansible/modules/cloud/vmware/vmware_host_active_directory.py Normal file
View file

@ -0,0 +1,369 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
# Copyright: (c) 2018, Christian Kotte <christian.kotte@gmx.de>
#
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
from __future__ import absolute_import, division, print_function
__metaclass__ = type
ANSIBLE_METADATA = {
'metadata_version': '1.1',
'status': ['preview'],
'supported_by': 'community'
}
DOCUMENTATION = r'''
---
module: vmware_host_active_directory
short_description: Joins an ESXi host system to an Active Directory domain or leaves it
description:
- This module can be used to join or leave an ESXi host to or from an Active Directory domain.
version_added: 2.8
author:
- Christian Kotte (@ckotte)
notes:
- Tested on vSphere 6.5
requirements:
- python >= 2.6
- PyVmomi
options:
ad_domain:
description:
- AD Domain to join.
type: str
aliases: [ domain, domain_name ]
ad_user:
description:
- Username for AD domain join.
type: str
ad_password:
description:
- Password for AD domain join.
type: str
ad_state:
description:
- Wheter the ESXi host is joined to an AD domain or not.
type: str
choices: [ present, absent ]
default: 'absent'
aliases: [ state ]
esxi_hostname:
description:
- Name of the host system to work with.
- This parameter is required if C(cluster_name) is not specified.
type: str
cluster_name:
description:
- Name of the cluster from which all host systems will be used.
- This parameter is required if C(esxi_hostname) is not specified.
type: str
extends_documentation_fragment: vmware.documentation
'''
EXAMPLES = r'''
- name: Join an AD domain
vmware_host_active_directory:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
esxi_hostname: '{{ esxi_hostname }}'
ad_domain: example.local
ad_user: adjoin
ad_password: Password123$
ad_state: present
validate_certs: no
delegate_to: localhost
- name: Leave AD domain
vmware_host_active_directory:
hostname: '{{ vcenter_hostname }}'
username: '{{ vcenter_username }}'
password: '{{ vcenter_password }}'
esxi_hostname: '{{ esxi_hostname }}'
ad_state: absent
validate_certs: no
delegate_to: localhost
'''
RETURN = r'''
results:
description: metadata about host system's AD domain join state
returned: always
type: dict
sample: {
"esxi01": {
"changed": true,
"domain": "example.local",
"membership_state": "ok",
"msg": "Host joined to AD domain",
"ad_state": "present",
"ad_state_current": "present",
"ad_state_previous": "absent",
},
}
'''
try:
from pyVmomi import vim
except ImportError:
pass
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.vmware import PyVmomi, TaskError, vmware_argument_spec, wait_for_task
from ansible.module_utils._text import to_native
class VmwareHostAdAuthentication(PyVmomi):
"""Manage Active Directory Authentication for an ESXi host system"""
def __init__(self, module):
super(VmwareHostAdAuthentication, self).__init__(module)
cluster_name = self.params.get('cluster_name')
esxi_host_name = self.params.get('esxi_hostname')
self.hosts = self.get_all_host_objs(cluster_name=cluster_name, esxi_host_name=esxi_host_name)
if not self.hosts:
self.module.fail_json(msg="Failed to find host system.")
def ensure(self):
"""Manage Active Directory Authentication for an ESXi host system"""
results = dict(changed=False, result=dict())
desired_state = self.params.get('ad_state')
domain = self.params.get('ad_domain')
ad_user = self.params.get('ad_user')
ad_password = self.params.get('ad_password')
host_change_list = []
for host in self.hosts:
changed = False
results['result'][host.name] = dict(msg='')
active_directory_info = self.get_ad_info(host)
results['result'][host.name]['ad_state'] = desired_state
results['result'][host.name]['ad_domain'] = domain
if desired_state == 'present':
# Don't do anything if already enabled and joined
if active_directory_info.enabled:
# Joined and no problems with the domain membership
if active_directory_info.domainMembershipStatus == 'ok':
results['result'][host.name]['changed'] = False
results['result'][host.name]['membership_state'] = active_directory_info.domainMembershipStatus
results['result'][host.name]['joined_domain'] = active_directory_info.joinedDomain
results['result'][host.name]['trusted_domains'] = active_directory_info.trustedDomain
results['result'][host.name]['msg'] = (
"Host is joined to AD domain and there are no problems with the domain membership"
)
# Joined, but problems with the domain membership
else:
changed = results['result'][host.name]['changed'] = True
results['result'][host.name]['membership_state'] = active_directory_info.domainMembershipStatus
results['result'][host.name]['joined_domain'] = active_directory_info.joinedDomain
results['result'][host.name]['trusted_domains'] = active_directory_info.trustedDomain
msg = "Host is joined to AD domain, but "
if active_directory_info.domainMembershipStatus == 'clientTrustBroken':
msg += "the client side of the trust relationship is broken"
elif active_directory_info.domainMembershipStatus == 'inconsistentTrust':
msg += "unexpected domain controller responded"
elif active_directory_info.domainMembershipStatus == 'noServers':
msg += "the host thinks it's part of a domain and " \
"no domain controllers could be reached to confirm"
elif active_directory_info.domainMembershipStatus == 'serverTrustBroken':
msg += "the server side of the trust relationship is broken (or bad machine password)"
elif active_directory_info.domainMembershipStatus == 'otherProblem':
msg += "there are some problems with the domain membership"
elif active_directory_info.domainMembershipStatus == 'unknown':
msg += "the Active Directory integration provider does not support domain trust checks"
results['result'][host.name]['msg'] = msg
# Enable and join AD domain
else:
if self.module.check_mode:
changed = results['result'][host.name]['changed'] = True
results['result'][host.name]['ad_state_previous'] = "absent"
results['result'][host.name]['ad_state_current'] = "present"
results['result'][host.name]['msg'] = "Host would be joined to AD domain"
else:
ad_authentication = self.get_ad_auth_object(host)
try:
try:
task = ad_authentication.JoinDomain(
domainName=domain, userName=ad_user, password=ad_password
)
wait_for_task(task)
except TaskError as task_err:
self.module.fail_json(
msg="Failed to join domain : %s" % to_native(task_err)
)
changed = results['result'][host.name]['changed'] = True
results['result'][host.name]['ad_state_previous'] = "absent"
results['result'][host.name]['ad_state_current'] = "present"
results['result'][host.name]['msg'] = "Host joined to AD domain"
active_directory_info = self.get_ad_info(host)
results['result'][host.name]['membership_state'] = active_directory_info.domainMembershipStatus
except vim.fault.InvalidState as invalid_state:
self.module.fail_json(
msg="The host has already joined a domain : %s" % to_native(invalid_state.msg)
)
except vim.fault.HostConfigFault as host_fault:
self.module.fail_json(
msg="The host configuration prevents the join operation from succeeding : %s" %
to_native(host_fault.msg)
)
except vim.fault.InvalidLogin as invalid_login:
self.module.fail_json(
msg="Credentials aren't valid : %s" % to_native(invalid_login.msg)
)
except vim.fault.TaskInProgress as task_in_progress:
self.module.fail_json(
msg="The ActiveDirectoryAuthentication object is busy : %s" %
to_native(task_in_progress.msg)
)
except vim.fault.BlockedByFirewall as blocked_by_firewall:
self.module.fail_json(
msg="Ports needed by the join operation are blocked by the firewall : %s" %
to_native(blocked_by_firewall.msg)
)
except vim.fault.DomainNotFound as not_found:
self.module.fail_json(
msg="The domain controller can't be reached : %s" % to_native(not_found.msg)
)
except vim.fault.NoPermissionOnAD as no_permission:
self.module.fail_json(
msg="The specified user has no right to add hosts to the domain : %s" %
to_native(no_permission.msg)
)
except vim.fault.InvalidHostName as invalid_host:
self.module.fail_json(
msg="The domain part of the host's FQDN doesn't match the domain being joined : %s" %
to_native(invalid_host.msg)
)
except vim.fault.ClockSkew as clock_skew:
self.module.fail_json(
msg="The clocks of the host and the domain controller differ by more "
"than the allowed amount of time : %s" % to_native(clock_skew.msg)
)
except vim.fault.ActiveDirectoryFault as ad_fault:
self.module.fail_json(
msg="An error occurred during AD join : %s" %
to_native(ad_fault.msg)
)
elif desired_state == 'absent':
# Don't do anything not joined to any AD domain
if not active_directory_info.enabled:
results['result'][host.name]['changed'] = False
results['result'][host.name]['ad_state_current'] = "absent"
results['result'][host.name]['msg'] = "Host isn't joined to an AD domain"
# Disable and leave AD domain
else:
if self.module.check_mode:
changed = results['result'][host.name]['changed'] = True
results['result'][host.name]['ad_state_previous'] = "present"
results['result'][host.name]['ad_state_current'] = "absent"
results['result'][host.name]['msg'] = "Host would leave the AD domain '%s'" % \
active_directory_info.joinedDomain
else:
ad_authentication = self.get_ad_auth_object(host)
try:
try:
task = ad_authentication.LeaveCurrentDomain(force=True)
wait_for_task(task)
except TaskError as task_err:
self.module.fail_json(
msg="Failed to join domain : %s" % to_native(task_err)
)
changed = results['result'][host.name]['changed'] = True
results['result'][host.name]['ad_state_previous'] = "present"
results['result'][host.name]['ad_state_current'] = "absent"
results['result'][host.name]['msg'] = "Host left the AD domain '%s'" % \
active_directory_info.joinedDomain
except vim.fault.InvalidState as invalid_state:
self.module.fail_json(
msg="The host is not in a domain or there are active permissions for "
"Active Directory users : %s" % to_native(invalid_state.msg)
)
except vim.fault.AuthMinimumAdminPermission as admin_permission:
self.module.fail_json(
msg="This change would leave the system with no Administrator permission "
"on the root node : %s" % to_native(admin_permission.msg)
)
except vim.fault.TaskInProgress as task_in_progress:
self.module.fail_json(
msg="The ActiveDirectoryAuthentication object is busy : %s" %
to_native(task_in_progress.msg)
)
except vim.fault.NonADUserRequired as non_ad_user:
self.module.fail_json(
msg="Only non Active Directory users can initiate the leave domain operation : %s" %
to_native(non_ad_user.msg)
)
except vim.fault.ActiveDirectoryFault as ad_fault:
self.module.fail_json(
msg="An error occurred during AD leave : %s" %
to_native(ad_fault.msg)
)
host_change_list.append(changed)
if any(host_change_list):
results['changed'] = True
self.module.exit_json(**results)
def get_ad_info(self, host_object):
"""Get info about AD membership"""
active_directory_info = None
authentication_store_info = host_object.config.authenticationManagerInfo.authConfig
for authentication_info in authentication_store_info:
if isinstance(authentication_info, vim.host.ActiveDirectoryInfo):
active_directory_info = authentication_info
break
if not active_directory_info:
self.module.fail_json(
msg="Failed to get Active Directory info from authentication manager"
)
return active_directory_info
def get_ad_auth_object(self, host_object):
"""Get AD authentication managed object"""
ad_authentication = None
authentication_store_info = host_object.configManager.authenticationManager.supportedStore
for store_info in authentication_store_info:
if isinstance(store_info, vim.host.ActiveDirectoryAuthentication):
ad_authentication = store_info
break
if not ad_authentication:
self.module.fail_json(
msg="Failed to get Active Directory authentication managed object from authentication manager"
)
return ad_authentication
def main():
"""Main"""
argument_spec = vmware_argument_spec()
argument_spec.update(
ad_domain=dict(type='str', default='', aliases=['domain', 'domain_name']),
ad_user=dict(type='str', default=''),
ad_password=dict(type='str', default='', no_log=True),
ad_state=dict(default='absent', choices=['present', 'absent'], aliases=['state']),
esxi_hostname=dict(type='str', required=False),
cluster_name=dict(type='str', required=False),
)
module = AnsibleModule(
argument_spec=argument_spec,
required_one_of=[
['cluster_name', 'esxi_hostname'],
],
required_if=[
['ad_state', 'present', ['ad_domain', 'ad_user', 'ad_password']],
],
supports_check_mode=True
)
ad_auth = VmwareHostAdAuthentication(module)
ad_auth.ensure()
if __name__ == '__main__':
main()

2
test/integration/targets/vmware_host_active_directory/aliases Normal file
View file

@ -0,0 +1,2 @@
cloud/vcenter
unsupported

132
test/integration/targets/vmware_host_active_directory/tasks/main.yml Normal file
View file

@ -0,0 +1,132 @@
# Test code for the vmware_host_active_directory module.
# Copyright: (c) 2018, Christian Kotte <christian.kotte@gmx.de>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
- name: store the vcenter container ip
set_fact:
vcsim: "{{ lookup('env', 'vcenter_host') }}"
- debug: var=vcsim
- name: Wait for Flask controller to come up online
wait_for:
host: "{{ vcsim }}"
port: 5000
state: started
- name: kill vcsim
uri:
url: http://{{ vcsim }}:5000/killall
- name: start vcsim
uri:
url: http://{{ vcsim }}:5000/spawn?cluster=2
register: vcsim_instance
- debug:
var: vcsim_instance
- name: Wait for vcsim server to come up online
wait_for:
host: "{{ vcsim }}"
port: 443
state: started
- name: get a list of clusters from vcsim
uri:
url: http://{{ vcsim }}:5000/govc_find?filter=CCR
register: clusters
- name: get a cluster
set_fact:
ccr1: "{{ clusters.json[0] | basename }}"
- name: get a list of hosts from vcsim
uri:
url: http://{{ vcsim }}:5000/govc_find?filter=H
register: hosts
- name: get a host
set_fact:
host1: "{{ hosts.json[0] | basename }}"
- debug: var=ccr1
- debug: var=host1
# Active Directory domain isn't available
- name: Join an AD domain in check mode
vmware_host_active_directory:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
esxi_hostname: "{{ host1 }}"
ad_domain: example.local
ad_user: adjoin
ad_password: Password123$
ad_state: present
validate_certs: no
register: host_active_directory_facts_check_mode
check_mode: yes
- debug: var=host_active_directory_facts_check_mode
- assert:
that:
- host_active_directory_facts_check_mode is defined
- host_active_directory_facts_check_mode.changed
- name: Join an AD domain
vmware_host_active_directory:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
esxi_hostname: "{{ host1 }}"
ad_domain: example.local
ad_user: adjoin
ad_password: Password123$
ad_state: present
validate_certs: no
register: host_active_directory_facts
- debug: var=host_active_directory_facts
- assert:
that:
- host_active_directory_facts is defined
- host_active_directory_facts.changed
- name: Leave AD domain in check mode
vmware_host_active_directory:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
esxi_hostname: "{{ host1 }}"
ad_state: absent
validate_certs: no
register: host_active_directory_facts_2_check_mode
check_mode: yes
- debug: var=host_active_directory_facts_2_check_mode
- assert:
that:
- host_active_directory_facts_2_check_mode is defined
- host_active_directory_facts_2_check_mode.changed
- name: Leave AD domain
vmware_host_active_directory:
hostname: "{{ vcsim }}"
username: "{{ vcsim_instance.json.username }}"
password: "{{ vcsim_instance.json.password }}"
esxi_hostname: "{{ host1 }}"
ad_state: absent
validate_certs: no
register: host_active_directory_facts_2
- debug: var=host_active_directory_facts_2
- assert:
that:
- host_active_directory_facts_2 is defined
- host_active_directory_facts_2.changed