Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
A
Ansible FreeIPA
Manage
Activity
Members
Code
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Deploy
Model registry
Help
Help
Support
GitLab documentation
Compare GitLab plans
GitLab community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Mirror
Ansible FreeIPA
Commits
d6eaf912
Unverified
Commit
d6eaf912
authored
Nov 12, 2021
by
Thomas Woerner
Committed by
GitHub
Nov 12, 2021
Browse files
Options
Downloads
Plain Diff
Merge pull request #670 from rjeffman/ipapermission_fixes
ipaprivilege: Fix permissions handling.
parents
cb95248e
0757bfee
Branches
Branches containing commit
Tags
Tags containing commit
No related merge requests found
Changes
2
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
plugins/modules/ipaprivilege.py
+34
-60
34 additions, 60 deletions
plugins/modules/ipaprivilege.py
tests/privilege/test_privilege.yml
+50
-0
50 additions, 0 deletions
tests/privilege/test_privilege.yml
with
84 additions
and
60 deletions
plugins/modules/ipaprivilege.py
+
34
−
60
View file @
d6eaf912
...
@@ -108,7 +108,8 @@ RETURN = """
...
@@ -108,7 +108,8 @@ RETURN = """
from
ansible.module_utils.ansible_freeipa_module
import
\
from
ansible.module_utils.ansible_freeipa_module
import
\
IPAAnsibleModule
,
compare_args_ipa
,
gen_add_del_lists
IPAAnsibleModule
,
compare_args_ipa
,
gen_add_del_lists
,
gen_add_list
,
\
gen_intersection_list
import
six
import
six
if
six
.
PY3
:
if
six
.
PY3
:
...
@@ -126,22 +127,6 @@ def find_privilege(module, name):
...
@@ -126,22 +127,6 @@ def find_privilege(module, name):
return
_result
[
"
result
"
]
return
_result
[
"
result
"
]
# pylint: disable=unused-argument
def
result_handler
(
module
,
result
,
command
,
name
,
args
,
errors
):
# Get all errors
# All "already a member" and "not a member" failures in the
# result are ignored. All others are reported.
for
failed_item
in
result
.
get
(
"
failed
"
,
[]):
failed
=
result
[
"
failed
"
][
failed_item
]
for
member_type
in
failed
:
for
member
,
failure
in
failed
[
member_type
]:
if
"
already a member
"
in
failure
\
or
"
not a member
"
in
failure
:
continue
errors
.
append
(
"
%s: %s %s: %s
"
%
(
command
,
member_type
,
member
,
failure
))
def
main
():
def
main
():
ansible_module
=
IPAAnsibleModule
(
ansible_module
=
IPAAnsibleModule
(
argument_spec
=
dict
(
argument_spec
=
dict
(
...
@@ -230,33 +215,17 @@ def main():
...
@@ -230,33 +215,17 @@ def main():
if
action
==
"
privilege
"
:
if
action
==
"
privilege
"
:
# Found the privilege
# Found the privilege
if
res_find
is
not
None
:
if
res_find
is
not
None
:
res_cmp
=
{
cmp
=
{
"
description
"
:
res_find
.
get
(
"
description
"
)}
k
:
v
for
k
,
v
in
res_find
.
items
()
if
not
compare_args_ipa
(
ansible_module
,
args
,
cmp
):
if
k
not
in
[
"
objectclass
"
,
"
cn
"
,
"
dn
"
,
"
memberof_permisssion
"
]
}
# For all settings is args, check if there are
# different settings in the find result.
# If yes: modify
if
args
and
not
compare_args_ipa
(
ansible_module
,
args
,
res_cmp
):
commands
.
append
([
name
,
"
privilege_mod
"
,
args
])
commands
.
append
([
name
,
"
privilege_mod
"
,
args
])
else
:
else
:
commands
.
append
([
name
,
"
privilege_add
"
,
args
])
commands
.
append
([
name
,
"
privilege_add
"
,
args
])
res_find
=
{}
res_find
=
{}
member_args
=
{}
if
permission
:
member_args
[
'
permission
'
]
=
permission
if
not
compare_args_ipa
(
ansible_module
,
member_args
,
res_find
):
# Generate addition and removal lists
# Generate addition and removal lists
permission_add
,
permission_del
=
gen_add_del_lists
(
permission_add
,
permission_del
=
gen_add_del_lists
(
permission
,
res_find
.
get
(
"
member_permission
"
))
permission
,
res_find
.
get
(
"
memberof_permission
"
)
)
# Add members
# Add members
if
len
(
permission_add
)
>
0
:
if
len
(
permission_add
)
>
0
:
...
@@ -280,6 +249,9 @@ def main():
...
@@ -280,6 +249,9 @@ def main():
if
permission
is
None
:
if
permission
is
None
:
ansible_module
.
fail_json
(
msg
=
"
No permission given
"
)
ansible_module
.
fail_json
(
msg
=
"
No permission given
"
)
permission
=
gen_add_list
(
permission
,
res_find
.
get
(
"
memberof_permission
"
))
if
permission
:
commands
.
append
([
name
,
"
privilege_add_permission
"
,
commands
.
append
([
name
,
"
privilege_add_permission
"
,
{
"
permission
"
:
permission
}])
{
"
permission
"
:
permission
}])
...
@@ -296,10 +268,11 @@ def main():
...
@@ -296,10 +268,11 @@ def main():
if
permission
is
None
:
if
permission
is
None
:
ansible_module
.
fail_json
(
msg
=
"
No permission given
"
)
ansible_module
.
fail_json
(
msg
=
"
No permission given
"
)
permission
=
gen_intersection_list
(
permission
,
res_find
.
get
(
"
memberof_permission
"
))
if
permission
:
commands
.
append
([
name
,
"
privilege_remove_permission
"
,
commands
.
append
([
name
,
"
privilege_remove_permission
"
,
{
{
"
permission
"
:
permission
}])
"
permission
"
:
permission
,
}])
elif
state
==
"
renamed
"
:
elif
state
==
"
renamed
"
:
if
not
rename
:
if
not
rename
:
...
@@ -318,7 +291,8 @@ def main():
...
@@ -318,7 +291,8 @@ def main():
# Execute commands
# Execute commands
changed
=
ansible_module
.
execute_ipa_commands
(
commands
,
result_handler
)
changed
=
ansible_module
.
execute_ipa_commands
(
commands
,
fail_on_member_errors
=
True
)
# Done
# Done
...
...
This diff is collapsed.
Click to expand it.
tests/privilege/test_privilege.yml
+
50
−
0
View file @
d6eaf912
...
@@ -47,6 +47,20 @@
...
@@ -47,6 +47,20 @@
register
:
result
register
:
result
failed_when
:
not result.changed or result.failed
failed_when
:
not result.changed or result.failed
-
name
:
Check if adding member permissions would cause a change (issue 669).
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaapi_context
:
"
{{
ipa_context
|
default(omit)
}}"
name
:
Broad Privilege
permission
:
-
"
Write
IPA
Configuration"
-
"
System:
Write
DNS
Configuration"
-
"
System:
Update
DNS
Entries"
action
:
member
check_mode
:
yes
register
:
result
failed_when
:
not result.changed or result.failed
-
name
:
Ensure privilege Broad Privilege has permissions
-
name
:
Ensure privilege Broad Privilege has permissions
ipaprivilege
:
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaadmin_password
:
SomeADMINpassword
...
@@ -73,6 +87,20 @@
...
@@ -73,6 +87,20 @@
register
:
result
register
:
result
failed_when
:
result.changed or result.failed
failed_when
:
result.changed or result.failed
-
name
:
Check if existing member permissions would not cause a change (issue 669).
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaapi_context
:
"
{{
ipa_context
|
default(omit)
}}"
name
:
Broad Privilege
permission
:
-
"
Write
IPA
Configuration"
-
"
System:
Write
DNS
Configuration"
-
"
System:
Update
DNS
Entries"
action
:
member
check_mode
:
yes
register
:
result
failed_when
:
result.changed or result.failed
-
name
:
Ensure privilege Broad Privilege member permission "Write IPA Configuration" is absent
-
name
:
Ensure privilege Broad Privilege member permission "Write IPA Configuration" is absent
ipaprivilege
:
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaadmin_password
:
SomeADMINpassword
...
@@ -161,6 +189,17 @@
...
@@ -161,6 +189,17 @@
name
:
Broad Privilege
name
:
Broad Privilege
state
:
absent
state
:
absent
-
name
:
Check if creating privilege Broad Privilege with permission would issue a change. (issue 669)
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaapi_context
:
"
{{
ipa_context
|
default(omit)
}}"
name
:
Broad Privilege
permission
:
-
"
Write
IPA
Configuration"
check_mode
:
yes
register
:
result
failed_when
:
not result.changed or result.failed
-
name
:
Ensure privilege Broad Privilege is created with permission. (issue 529)
-
name
:
Ensure privilege Broad Privilege is created with permission. (issue 529)
ipaprivilege
:
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaadmin_password
:
SomeADMINpassword
...
@@ -181,6 +220,17 @@
...
@@ -181,6 +220,17 @@
register
:
result
register
:
result
failed_when
:
result.changed or result.failed
failed_when
:
result.changed or result.failed
-
name
:
Check if exisintg privilege Broad Privilege with permission would not issue a change. (issue 669)
ipaprivilege
:
ipaadmin_password
:
SomeADMINpassword
ipaapi_context
:
"
{{
ipa_context
|
default(omit)
}}"
name
:
Broad Privilege
permission
:
-
"
Write
IPA
Configuration"
check_mode
:
yes
register
:
result
failed_when
:
result.changed or result.failed
# CLEANUP TEST ITEMS
# CLEANUP TEST ITEMS
-
name
:
Ensure privilege testing privileges are absent
-
name
:
Ensure privilege testing privileges are absent
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
sign in
to comment