Compare commits
No commits in common. "ef4f6dcb01411d391caf5479d023fb1736874484" and "1b5163c9a481489f906adacc44138b8f04711f50" have entirely different histories.
ef4f6dcb01
...
1b5163c9a4
@ -1,76 +0,0 @@
|
|||||||
from dataclasses import dataclass
|
|
||||||
from typing import List, Tuple
|
|
||||||
|
|
||||||
import requests
|
|
||||||
|
|
||||||
API_BASE_PATH: str = "/api2/json"
|
|
||||||
|
|
||||||
|
|
||||||
@dataclass()
|
|
||||||
class ProxmoxAuthInfo:
|
|
||||||
instance_url: str
|
|
||||||
token_id: str
|
|
||||||
secret: str
|
|
||||||
verify_cert: bool = True
|
|
||||||
|
|
||||||
|
|
||||||
@dataclass(frozen=True)
|
|
||||||
class ProxmoxRealm:
|
|
||||||
type: str
|
|
||||||
realm: str
|
|
||||||
comment: str = None
|
|
||||||
default: bool = False
|
|
||||||
|
|
||||||
|
|
||||||
def get_realms(auth_info: ProxmoxAuthInfo) -> List['ProxmoxRealm']:
|
|
||||||
realm_answer = _proxmox_request('get', '/access/domains', auth_info).json()
|
|
||||||
return list(map(
|
|
||||||
lambda r: ProxmoxRealm(r['type'], r['realm'], r.get('comment', None), r.get('default', False)),
|
|
||||||
realm_answer['data']
|
|
||||||
))
|
|
||||||
|
|
||||||
|
|
||||||
def set_realm_data(auth_info: ProxmoxAuthInfo, realm: str, config: dict[str, str], dry_run: bool, state: str = 'present') -> Tuple[dict, dict]:
|
|
||||||
existing_realm = _proxmox_request('get', f"/access/domains/{realm}", auth_info)
|
|
||||||
existing_realm_data = None
|
|
||||||
new_realm_data = {}
|
|
||||||
if state == 'present':
|
|
||||||
if existing_realm.ok:
|
|
||||||
existing_realm_data = existing_realm.json()['data']
|
|
||||||
if not dry_run:
|
|
||||||
realm_res = _proxmox_request('put', f"/access/domains/{realm}", auth_info, data=config)
|
|
||||||
realm_res.raise_for_status()
|
|
||||||
else:
|
|
||||||
if not dry_run:
|
|
||||||
realm_res = _proxmox_request('post', '/access/domains', auth_info, data=(config | {'realm': realm}))
|
|
||||||
realm_res.raise_for_status()
|
|
||||||
if not dry_run:
|
|
||||||
if realm_res.ok:
|
|
||||||
new_realm_data = _proxmox_request('get', f"/access/domains/{realm}", auth_info).json()['data']
|
|
||||||
else:
|
|
||||||
new_realm_data = config | {'name': realm}
|
|
||||||
else:
|
|
||||||
if existing_realm.ok:
|
|
||||||
existing_realm_data = existing_realm.json()['data']
|
|
||||||
if not dry_run:
|
|
||||||
realm_res = _proxmox_request('delete', f"/access/domains/{realm}", auth_info)
|
|
||||||
realm_res.raise_for_status()
|
|
||||||
if realm_res.ok:
|
|
||||||
new_realm_data = None
|
|
||||||
else:
|
|
||||||
new_realm_data = None
|
|
||||||
else:
|
|
||||||
new_realm_data = None
|
|
||||||
return existing_realm_data, new_realm_data
|
|
||||||
|
|
||||||
|
|
||||||
def _get_token_from_auth_info(auth_info: ProxmoxAuthInfo) -> str:
|
|
||||||
return f"PVEAPIToken={auth_info.token_id}={auth_info.secret}"
|
|
||||||
|
|
||||||
|
|
||||||
def _proxmox_request(method: str, endpoint: str, auth_info: ProxmoxAuthInfo, **params):
|
|
||||||
return requests.request(method,
|
|
||||||
f"{auth_info.instance_url}{API_BASE_PATH}{endpoint}",
|
|
||||||
headers={'Authorization': _get_token_from_auth_info(auth_info)},
|
|
||||||
verify=auth_info.verify_cert,
|
|
||||||
**params)
|
|
||||||
@ -1,161 +0,0 @@
|
|||||||
#!/usr/bin/python
|
|
||||||
# coding: utf-8
|
|
||||||
|
|
||||||
# (c) 2022, Johanna Dorothea Reichmann <transcaffeine@finally.coffee>
|
|
||||||
|
|
||||||
__metaclass__ = type
|
|
||||||
|
|
||||||
import dataclasses
|
|
||||||
import json
|
|
||||||
import traceback
|
|
||||||
|
|
||||||
from ansible.module_utils.basic import AnsibleModule
|
|
||||||
|
|
||||||
LIB_IMP_ERR = None
|
|
||||||
try:
|
|
||||||
from ansible_collections.finallycoffee.proxmox.plugins.module_utils.proxmox_api import *
|
|
||||||
HAS_LIB = True
|
|
||||||
except:
|
|
||||||
HAS_LIB = False
|
|
||||||
LIB_IMP_ERR = traceback.format_exc()
|
|
||||||
|
|
||||||
|
|
||||||
DOCUMENTATION = r'''
|
|
||||||
---
|
|
||||||
module: realm
|
|
||||||
author:
|
|
||||||
- Johanna Dorothea Reichmann (transcaffeine@finally.coffee)
|
|
||||||
requirements:
|
|
||||||
- python >= 3.9
|
|
||||||
short_description: Configures an authentication realm in a proxmox node
|
|
||||||
description:
|
|
||||||
- "Configue realm in a proxmox instance"
|
|
||||||
options:
|
|
||||||
proxmox_instance:
|
|
||||||
description: Location of the proxmox API with scheme, domain name/ip and port, e.g. https://localhost:8006
|
|
||||||
type: str
|
|
||||||
required: true
|
|
||||||
proxmox_api_token_id:
|
|
||||||
description: The token ID containing username, realm and token name (format: user@realm!name)
|
|
||||||
type: str
|
|
||||||
required: true
|
|
||||||
proxmox_api_secret:
|
|
||||||
description: The secret
|
|
||||||
type: str
|
|
||||||
required: true
|
|
||||||
proxmox_api_verify_cert:
|
|
||||||
description: If the certificate presented for `proxmox_instance_url` should be verified
|
|
||||||
type: bool
|
|
||||||
required: false
|
|
||||||
default: true
|
|
||||||
name:
|
|
||||||
description: Realm to retrieve information about. If left omitted, return all realms
|
|
||||||
type: str
|
|
||||||
required: false
|
|
||||||
config:
|
|
||||||
description: Configuration of the realm, including it's `type`. See https://pve.proxmox.com/pve-docs/api-viewer/index.html#/access/domains for a list of config options
|
|
||||||
type: dict[str, str]
|
|
||||||
required: true
|
|
||||||
state:
|
|
||||||
description: If the realm should be present or absent
|
|
||||||
type: str
|
|
||||||
choices: [present, absent]
|
|
||||||
default: present
|
|
||||||
required: false
|
|
||||||
'''
|
|
||||||
|
|
||||||
EXAMPLES = r'''
|
|
||||||
- name: Configure LDAP realm
|
|
||||||
finallycoffee.proxmox.realm:
|
|
||||||
proxmox_instance: https://my.proxmox-node.local:8006
|
|
||||||
promox_api_token_id: root@pam!token
|
|
||||||
proxmox_api_secret: supersecuretokencontent
|
|
||||||
realms: org_ldap
|
|
||||||
config:
|
|
||||||
type: ldap
|
|
||||||
comment: Long description of the authentication source
|
|
||||||
base_dn: dc=myorg,dc=de
|
|
||||||
bind_dn: uid=proxmox,dc=services,dc=myorg,dc=de
|
|
||||||
passwort: supersecret
|
|
||||||
mode: ldap
|
|
||||||
server1: ldap.myorg.de
|
|
||||||
port: 389
|
|
||||||
default: 1
|
|
||||||
user_attr: uid
|
|
||||||
- name: Configure OIDC realm
|
|
||||||
finallycoffee.proxmox.realm:
|
|
||||||
proxmox_instance: https://my.proxmox-node.local:8006
|
|
||||||
promox_api_token_id: root@pam!token
|
|
||||||
proxmox_api_secret: supersecuretokencontent
|
|
||||||
realm: external_oidc
|
|
||||||
config:
|
|
||||||
type: openid
|
|
||||||
issuer-url: https://idp.my-org.de/issuer
|
|
||||||
client_id: myapp
|
|
||||||
client_key: secret
|
|
||||||
scopes: profile email
|
|
||||||
username-claim: sub
|
|
||||||
'''
|
|
||||||
|
|
||||||
RETURN = r'''
|
|
||||||
realm:
|
|
||||||
description: The updated/created realm
|
|
||||||
returned: When realms were found (matching the filter)
|
|
||||||
type: list
|
|
||||||
elements: dict[str, str, str, str]
|
|
||||||
|
|
||||||
'''
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
_ = dict
|
|
||||||
module = AnsibleModule(
|
|
||||||
argument_spec=_(
|
|
||||||
proxmox_instance=_(required=True, type='str'),
|
|
||||||
proxmox_api_token_id=_(required=True, type='str'),
|
|
||||||
proxmox_api_secret=_(type='str', required=True, no_log=True),
|
|
||||||
proxmox_api_verify_cert=_(type='bool', required=False, default=True),
|
|
||||||
name=_(required=True, type='str'),
|
|
||||||
config=_(required=True, type='dict'),
|
|
||||||
state=_(type='str', required=False, default='present', choices=['present', 'absent'])
|
|
||||||
),
|
|
||||||
supports_check_mode=True
|
|
||||||
)
|
|
||||||
|
|
||||||
result = _(
|
|
||||||
changed=False,
|
|
||||||
diff={},
|
|
||||||
message=''
|
|
||||||
)
|
|
||||||
|
|
||||||
realms = []
|
|
||||||
try:
|
|
||||||
realm_change = set_realm_data(ProxmoxAuthInfo(
|
|
||||||
module.params['proxmox_instance'],
|
|
||||||
module.params['proxmox_api_token_id'],
|
|
||||||
module.params['proxmox_api_secret'],
|
|
||||||
module.params['proxmox_api_verify_cert'],
|
|
||||||
),
|
|
||||||
module.params['name'],
|
|
||||||
module.params['config'],
|
|
||||||
module.check_mode,
|
|
||||||
module.params['state'])
|
|
||||||
except IOError as owie:
|
|
||||||
result['msg'] = owie
|
|
||||||
module.exit_json(**result)
|
|
||||||
|
|
||||||
diff_excluded_keys = ['name', 'password', 'digest']
|
|
||||||
result['realm'] = realm_change[1]
|
|
||||||
result['diff'] = {
|
|
||||||
'before_header': f"{realm_change[0].get('name', module.params['name'])}@{realm_change[0]['type']}" if realm_change[0] and 'type' in realm_change[0] else '',
|
|
||||||
'after_header': f"{realm_change[1].get('name', module.params['name'])}@{realm_change[1]['type']}" if realm_change[1] and 'type' in realm_change[1] else '',
|
|
||||||
'before': {k: v for k, v in realm_change[0].items() if k not in diff_excluded_keys} if realm_change[0] else realm_change[0],
|
|
||||||
'after': {k: v for k, v in realm_change[1].items() if k not in diff_excluded_keys} if realm_change[1] else realm_change[1],
|
|
||||||
}
|
|
||||||
result['changed'] = realm_change[0] != realm_change[1]
|
|
||||||
|
|
||||||
module.exit_json(**result)
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
main()
|
|
||||||
@ -1,124 +0,0 @@
|
|||||||
#!/usr/bin/python
|
|
||||||
# coding: utf-8
|
|
||||||
|
|
||||||
# (c) 2022, Johanna Dorothea Reichmann <transcaffeine@finally.coffee>
|
|
||||||
|
|
||||||
__metaclass__ = type
|
|
||||||
|
|
||||||
import dataclasses
|
|
||||||
import traceback
|
|
||||||
|
|
||||||
from ansible.module_utils.basic import AnsibleModule
|
|
||||||
|
|
||||||
LIB_IMP_ERR = None
|
|
||||||
try:
|
|
||||||
from ansible_collections.finallycoffee.proxmox.plugins.module_utils.proxmox_api import *
|
|
||||||
HAS_LIB = True
|
|
||||||
except:
|
|
||||||
HAS_LIB = False
|
|
||||||
LIB_IMP_ERR = traceback.format_exc()
|
|
||||||
|
|
||||||
|
|
||||||
DOCUMENTATION = r'''
|
|
||||||
---
|
|
||||||
module: realm_info
|
|
||||||
author:
|
|
||||||
- Johanna Dorothea Reichmann (transcaffeine@finally.coffee)
|
|
||||||
requirements:
|
|
||||||
- python >= 3.9
|
|
||||||
short_description: Get configured realms of a proxmox node
|
|
||||||
description:
|
|
||||||
- "Lists all configured realms in a proxmox instance"
|
|
||||||
options:
|
|
||||||
proxmox_instance:
|
|
||||||
description: Location of the proxmox API with scheme, domain name/ip and port, e.g. https://localhost:8006
|
|
||||||
type: str
|
|
||||||
required: true
|
|
||||||
proxmox_api_token_id:
|
|
||||||
description: The token ID containing username, realm and token name (format: user@realm!name)
|
|
||||||
type: str
|
|
||||||
required: true
|
|
||||||
proxmox_api_secret:
|
|
||||||
description: The secret
|
|
||||||
type: str
|
|
||||||
required: true
|
|
||||||
proxmox_api_verify_cert:
|
|
||||||
description: If the certificate presented for `proxmox_instance_url` should be verified
|
|
||||||
type: bool
|
|
||||||
required: false
|
|
||||||
default: true
|
|
||||||
realm:
|
|
||||||
description: Realm to retrieve information about. If left omitted, return all realms
|
|
||||||
type: str
|
|
||||||
required: false
|
|
||||||
'''
|
|
||||||
|
|
||||||
EXAMPLES = r'''
|
|
||||||
- name: Retrieve all reams
|
|
||||||
finallycoffee.proxmox.realm_info:
|
|
||||||
proxmox_instance: https://my.proxmox-node.local:8006
|
|
||||||
promox_api_token_id: root@pam!token
|
|
||||||
proxmox_api_secret: supersecuretokencontent
|
|
||||||
- name: Retrieve realm information for 'myrealm'
|
|
||||||
finallycoffee.proxmox.realm_info:
|
|
||||||
proxmox_instance: https://my.proxmox-node.local:8006
|
|
||||||
promox_api_token_id: root@pam!token
|
|
||||||
proxmox_api_secret: supersecuretokencontent
|
|
||||||
realm: myrealm
|
|
||||||
'''
|
|
||||||
|
|
||||||
RETURN = r'''
|
|
||||||
realms:
|
|
||||||
description: The retrieved realms
|
|
||||||
returned: When realms were found (matching the filter)
|
|
||||||
type: list
|
|
||||||
elements: dict[str, str, str, str]
|
|
||||||
|
|
||||||
'''
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
_ = dict
|
|
||||||
module = AnsibleModule(
|
|
||||||
argument_spec=_(
|
|
||||||
proxmox_instance=_(required=True, type='str'),
|
|
||||||
proxmox_api_token_id=_(required=True, type='str'),
|
|
||||||
proxmox_api_secret=_(type='str', required=True, no_log=True),
|
|
||||||
proxmox_api_verify_cert=_(type='bool', required=False, default=True),
|
|
||||||
realm=_(required=False, type='str'),
|
|
||||||
),
|
|
||||||
supports_check_mode=True
|
|
||||||
)
|
|
||||||
|
|
||||||
result = _(
|
|
||||||
changed=False,
|
|
||||||
diff={},
|
|
||||||
message=''
|
|
||||||
)
|
|
||||||
|
|
||||||
realms = []
|
|
||||||
try:
|
|
||||||
realms = get_realms(ProxmoxAuthInfo(
|
|
||||||
module.params['proxmox_instance'],
|
|
||||||
module.params['proxmox_api_token_id'],
|
|
||||||
module.params['proxmox_api_secret'],
|
|
||||||
module.params['proxmox_api_verify_cert'],
|
|
||||||
))
|
|
||||||
except IOError as owie:
|
|
||||||
result['msg'] = owie
|
|
||||||
module.exit_json(**result)
|
|
||||||
|
|
||||||
result['realms'] = list(
|
|
||||||
map(lambda r: dataclasses.asdict(r),
|
|
||||||
filter(lambda r: r.realm == module.params['realm']
|
|
||||||
if module.params['realm'] is not None
|
|
||||||
else True,
|
|
||||||
realms)
|
|
||||||
)
|
|
||||||
)
|
|
||||||
|
|
||||||
module.exit_json(**result)
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
main()
|
|
||||||
Loading…
x
Reference in New Issue
Block a user