New module: platform agnostic way to manage local users on network devices (network/net_user.) (#25259)

* Add net_user platform agnostic module

Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>

* Integration test for net_user

Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>

* modify eos_user module to support name param as alias to username

Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>

* Test collection of users

Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>

lib/ansible/module_utils/eos.py

@@ -42,7 +42,7 @@ _DEVICE_CONNECTION = None
 eos_argument_spec = {
     'host': dict(),
     'port': dict(type='int'),
-    'username': dict(fallback=(env_fallback, ['ANSIBLE_NET_USERNAME'])),
+    'username': dict(fallback=(env_fallback, ['ANSIBLE_NET_USERNAME']), aliases=['name']),
     'password': dict(fallback=(env_fallback, ['ANSIBLE_NET_PASSWORD']), no_log=True),
     'ssh_keyfile': dict(fallback=(env_fallback, ['ANSIBLE_NET_SSH_KEYFILE']), type='path'),
 

lib/ansible/modules/network/eos/eos_user.py

@@ -143,6 +143,7 @@ session_name:
   type: str
   sample: ansible_1479315771
 """
+
 import re
 
 from functools import partial
@@ -165,10 +166,16 @@ def map_obj_to_commands(updates, module):
         want, have = update
 
         needs_update = lambda x: want.get(x) and (want.get(x) != have.get(x))
-        add = lambda x: commands.append('username %s %s' % (want['username'], x))
+        if 'name' in want:
+            add = lambda x: commands.append('username %s %s' % (want['name'], x))
+        else:
+            add = lambda x: commands.append('username %s %s' % (want['username'], x))
 
         if want['state'] == 'absent':
-            commands.append('no username %s' % want['username'])
+            if 'name' in want:
+                commands.append('no username %s' % want['name'])
+            else:
+                commands.append('no username %s' % want['username'])
             continue
 
         if needs_update('role'):
@@ -188,7 +195,10 @@ def map_obj_to_commands(updates, module):
             if want['nopassword']:
                 add('nopassword')
             else:
-                add('no username %s nopassword' % want['username'])
+                if 'name' in want:
+                    add('no username %s nopassword' % want['name'])
+                else:
+                    add('no username %s nopassword' % want['username'])
 
     return commands
 
@@ -266,7 +276,7 @@ def map_params_to_obj(module):
         for item in users:
             if not isinstance(item, dict):
                 collection.append({'username': item})
-            elif 'username' not in item:
+            elif all(u not in item for u in ['username', 'name']):
                 module.fail_json(msg='username is required')
             else:
                 collection.append(item)
@@ -288,7 +298,11 @@ def map_params_to_obj(module):
 def update_objects(want, have):
     updates = list()
     for entry in want:
-        item = next((i for i in have if i['username'] == entry['username']), None)
+        if 'name' in entry:
+            item = next((i for i in have if i['username'] == entry['name']), None)
+        else:
+            item = next((i for i in have if i['username'] == entry['username']), None)
+
         if all((item is None, entry['state'] == 'present')):
             updates.append((entry, {}))
         elif item:
@@ -301,8 +315,8 @@ def main():
     """ main entry point for module execution
     """
     argument_spec = dict(
-        users=dict(type='list'),
-        username=dict(),
+        users=dict(type='list', aliases=['collection']),
+        username=dict(aliases=['name']),
 
         password=dict(no_log=True),
         nopassword=dict(type='bool'),
@@ -318,7 +332,6 @@ def main():
     )
 
     argument_spec.update(eos_argument_spec)
-
     mutually_exclusive = [('username', 'users')]
 
     module = AnsibleModule(argument_spec=argument_spec,
@@ -338,7 +351,7 @@ def main():
     commands = map_obj_to_commands(update_objects(want, have), module)
 
     if module.params['purge']:
-        want_users = [x['username'] for x in want]
+        want_users = [x['username'] if 'username' in x else x['name'] for x in want]
         have_users = [x['username'] for x in have]
         for item in set(have_users).difference(want_users):
             if item != 'admin':

lib/ansible/modules/network/junos/junos_user.py

@@ -220,7 +220,7 @@ def main():
     """ main entry point for module execution
     """
     argument_spec = dict(
-        users=dict(type='list'),
+        users=dict(type='list', aliases=['collection']),
         name=dict(),
 
         full_name=dict(),

lib/ansible/modules/network/net_user.py

@@ -0,0 +1,138 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# (c) 2017, Ansible by Red Hat, inc
+#
+# This file is part of Ansible by Red Hat
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+ANSIBLE_METADATA = {'metadata_version': '1.0',
+                    'status': ['preview'],
+                    'supported_by': 'core'}
+
+DOCUMENTATION = """
+---
+module: net_user
+version_added: "2.4"
+author: "Trishna Guha (@trishnag)"
+short_description: Manage the collection of local users on network device
+description:
+  - This module provides declarative management of the local usernames
+    configured on network devices. It allows playbooks to manage
+    either individual usernames or the collection of usernames in the
+    current running config. It also supports purging usernames from the
+    configuration that are not explicitly defined.
+options:
+  collection:
+    description:
+      - The set of username objects to be configured on the remote
+        network device. The list entries can either be the username
+        or a hash of username and properties. This argument is mutually
+        exclusive with the C(name) argument.
+  name:
+    description:
+      - The username to be configured on the remote network device.
+        This argument accepts a string value and is mutually exclusive
+        with the C(collection) argument.
+        Please note that this option is not same as C(provider username).
+  password:
+    description:
+      - The password to be configured on the remote network device. The
+        password needs to be provided in clear and it will be encrypted
+        on the device.
+        Please note that this option is not same as C(provider password).
+  update_password:
+    description:
+      - Since passwords are encrypted in the device running config, this
+        argument will instruct the module when to change the password.  When
+        set to C(always), the password will always be updated in the device
+        and when set to C(on_create) the password will be updated only if
+        the username is created.
+    default: always
+    choices: ['on_create', 'always']
+  privilege:
+    description:
+      - The C(privilege) argument configures the privilege level of the
+        user when logged into the system. This argument accepts integer
+        values in the range of 1 to 15.
+  role:
+    description:
+      - Configures the role for the username in the
+        device running configuration. The argument accepts a string value
+        defining the role name. This argument does not check if the role
+        has been configured on the device.
+  sshkey:
+    description:
+      - Specifies the SSH public key to configure
+        for the given username. This argument accepts a valid SSH key value.
+  nopassword:
+    description:
+      - Defines the username without assigning
+        a password. This will allow the user to login to the system
+        without being authenticated by a password.
+    type: bool
+  purge:
+    description:
+      - Instructs the module to consider the
+        resource definition absolute. It will remove any previously
+        configured usernames on the device with the exception of the
+        `admin` user (the current defined set of users).
+    type: bool
+    default: false
+  state:
+    description:
+      - Configures the state of the username definition
+        as it relates to the device operational configuration. When set
+        to I(present), the username(s) should be configured in the device active
+        configuration and when set to I(absent) the username(s) should not be
+        in the device active configuration
+    default: present
+    choices: ['present', 'absent']
+"""
+
+EXAMPLES = """
+- name: create a new user
+  net_user:
+    name: ansible
+    sshkey: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
+    state: present
+- name: remove all users except admin
+  net_user:
+    purge: yes
+- name: set multiple users to privilege level 15
+  net_user:
+    collection:
+      - name: netop
+      - name: netend
+    privilege: 15
+    state: present
+- name: Change Password for User netop
+  net_user:
+    name: netop
+    password: "{{ new_password }}"
+    update_password: always
+    state: present
+"""
+
+RETURN = """
+commands:
+  description: The list of configuration mode commands to send to the device
+  returned: always
+  type: list
+  sample:
+    - username ansible secret password
+    - username admin secret admin
+"""

lib/ansible/modules/network/nxos/nxos_user.py

@@ -298,13 +298,13 @@ def main():
     """ main entry point for module execution
     """
     argument_spec = dict(
-        users=dict(type='list', no_log=True),
+        users=dict(type='list', no_log=True, aliases=['collection']),
         name=dict(),
 
         password=dict(no_log=True),
         update_password=dict(default='always', choices=['on_create', 'always']),
 
-        roles=dict(type='list'),
+        roles=dict(type='list', aliases=['role']),
 
         sshkey=dict(),
 

lib/ansible/plugins/action/net_user.py

@@ -0,0 +1,26 @@
+# (c) 2017, Ansible Inc,
+#
+# This file is part of Ansible
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.plugins.action.net_base import ActionModule as _ActionModule
+
+
+class ActionModule(_ActionModule):
+    def run(self, tmp=None, task_vars=None):
+        result = super(ActionModule, self).run(tmp, task_vars)
+        return result

test/integration/platform_agnostic.yaml

@@ -11,3 +11,4 @@
     - { role: net_system, when: "limit_to in ['*', 'net_system']" }
     - { role: net_banner, when: "limit_to in ['*', 'net_banner']" }
     - { role: net_command, when: "limit_to in ['*', 'net_command']" }
+    - { role: net_user, when: "limit_to_in ['*', 'net_user']" }

test/integration/targets/net_user/aliases

@@ -0,0 +1 @@
+network/ci

test/integration/targets/net_user/defaults/main.yaml

@@ -0,0 +1,2 @@
+---
+testcase: "*"

test/integration/targets/net_user/tasks/cli.yaml

@@ -0,0 +1,16 @@
+---
+- name: collect all cli test cases
+  find:
+    paths: "{{ role_path }}/tests/cli"
+    patterns: "{{ testcase }}.yaml"
+  register: test_cases
+  delegate_to: localhost
+
+- name: set test_items
+  set_fact: test_items="{{ test_cases.files | map(attribute='path') | list }}"
+
+- name: run test case
+  include: "{{ test_case_to_run }}"
+  with_items: "{{ test_items }}"
+  loop_control:
+    loop_var: test_case_to_run

test/integration/targets/net_user/tasks/main.yaml

@@ -0,0 +1,2 @@
+---
+- { include: cli.yaml, tags: ['cli'] }

test/integration/targets/net_user/tests/cli/userprivilege.yaml

@@ -0,0 +1,3 @@
+---
+- include: "{{ role_path }}/tests/eos/userprivilege.yaml"
+  when: hostvars[inventory_hostname]['ansible_network_os'] == 'eos'

test/integration/targets/net_user/tests/cli/userrole.yaml

@@ -0,0 +1,6 @@
+---
+- include: "{{ role_path }}/tests/nxos/userrole.yaml"
+  when: hostvars[inventory_hostname]['ansible_network_os'] == 'nxos'
+
+- include: "{{ role_path }}/tests/eos/userrole.yaml"
+  when: hostvars[inventory_hostname]['ansible_network_os'] == 'eos'

test/integration/targets/net_user/tests/cli/users.yaml

@@ -0,0 +1,6 @@
+---
+- include: "{{ role_path }}/tests/nxos/users.yaml"
+  when: hostvars[inventory_hostname]['ansible_network_os'] == 'nxos'
+
+- include: "{{ role_path }}/tests/eos/users.yaml"
+  when: hostvars[inventory_hostname]['ansible_network_os'] == 'eos'

test/integration/targets/net_user/tests/eos/userprivilege.yaml

@@ -0,0 +1,19 @@
+---
+- name: Set user to privilege level 15
+  net_user:
+    name: netop
+    privilege: 15
+    state: present
+    authorize: yes
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - 'result.commands == ["username netop privilege 15"]'
+
+- name: tearDown
+  net_user:
+    purge: yes
+    provider: "{{ cli }}"

test/integration/targets/net_user/tests/eos/userrole.yaml

@@ -0,0 +1,22 @@
+---
+- name: Set multiple users role
+  net_user:
+    collection:
+      - name: netop
+      - name: netend
+    role: network-operator
+    state: present
+    authorize: yes
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - 'result.commands == ["username netop role network-operator", "username netend role network-operator"]'
+
+- name: tearDown
+  net_user:
+    purge: yes
+    authorize: yes
+    provider: "{{ cli }}"

test/integration/targets/net_user/tests/eos/users.yaml

@@ -0,0 +1,23 @@
+---
+- name: Create user
+  net_user:
+    name: netop
+    state: present
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - 'result.commands == ["username netop"]'
+
+- name: Purge users
+  net_user:
+    purge: yes
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - 'result.commands == ["no username netop"]'

test/integration/targets/net_user/tests/nxos/userrole.yaml

@@ -0,0 +1,20 @@
+---
+- name: Set multiple users role
+  net_user:
+    collection:
+      - name: netop
+      - name: netend
+    role: network-operator
+    state: present
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - '"role network-operator" in result.commands'
+
+- name: tearDown
+  net_user:
+    purge: yes
+    provider: "{{ cli }}"

test/integration/targets/net_user/tests/nxos/users.yaml

@@ -0,0 +1,23 @@
+---
+- name: Create user
+  net_user:
+    name: netop
+    state: present
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - 'result.commands == ["username netop"]'
+
+- name: Purge users
+  net_user:
+    purge: yes
+    provider: "{{ cli }}"
+  register: result
+
+- assert:
+    that:
+      - 'result.changed == true'
+      - 'result.commands == ["no username netop"]'