#!/usr/bin/python # -*- coding: UTF-8 -*- # Copyright (c) 2016, Adfinis SyGroup AG # Tobias Rueetschi # # This file is part of Ansible # # Ansible is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # Ansible is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with Ansible. If not, see . # from datetime import date import crypt from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.univention_umc import ( umc_module_for_add, umc_module_for_edit, ldap_search, base_dn, ) from dateutil.relativedelta import relativedelta DOCUMENTATION = ''' --- module: udm_user version_added: "2.2" author: "Tobias Rueetschi (@2-B)" short_description: Manage posix users on a univention corporate server description: - "This module allows to manage posix users on a univention corporate server (UCS). It uses the python API of the UCS to create a new object or edit it." requirements: - Python >= 2.6 options: state: required: false default: "present" choices: [ present, absent ] description: - Whether the user is present or not. username: required: true description: - User name aliases: ['name'] firstname: required: false description: - First name. Required if C(state=present). lastname: required: false description: - Last name. Required if C(state=present). password: required: false default: None description: - Password. Required if C(state=present). birthday: required: false default: None description: - Birthday city: required: false default: None description: - City of users business address. country: required: false default: None description: - Country of users business address. department_number: required: false default: None description: - Department number of users business address. aliases: [ departmentNumber ] description: required: false default: None description: - Description (not gecos) display_name: required: false default: None description: - Display name (not gecos) aliases: [ displayName ] email: required: false default: [''] description: - A list of e-mail addresses. employee_number: required: false default: None description: - Employee number aliases: [ employeeNumber ] employee_type: required: false default: None description: - Employee type aliases: [ employeeType ] gecos: required: false default: None description: - GECOS groups: required: false default: [] description: - "POSIX groups, the LDAP DNs of the groups will be found with the LDAP filter for each group as $GROUP: C((&(objectClass=posixGroup)(cn=$GROUP)))." home_share: required: false default: None description: - "Home NFS share. Must be a LDAP DN, e.g. C(cn=home,cn=shares,ou=school,dc=example,dc=com)." aliases: [ homeShare ] home_share_path: required: false default: None description: - Path to home NFS share, inside the homeShare. aliases: [ homeSharePath ] home_telephone_number: required: false default: [] description: - List of private telephone numbers. aliases: [ homeTelephoneNumber ] homedrive: required: false default: None description: - Windows home drive, e.g. C("H:"). mail_alternative_address: required: false default: [] description: - List of alternative e-mail addresses. aliases: [ mailAlternativeAddress ] mail_home_server: required: false default: None description: - FQDN of mail server aliases: [ mailHomeServer ] mail_primary_address: required: false default: None description: - Primary e-mail address aliases: [ mailPrimaryAddress ] mobile_telephone_number: required: false default: [] description: - Mobile phone number aliases: [ mobileTelephoneNumber ] organisation: required: false default: None description: - Organisation override_pw_history: required: false default: False description: - Override password history aliases: [ overridePWHistory ] override_pw_length: required: false default: False description: - Override password check aliases: [ overridePWLength ] pager_telephonenumber: required: false default: [] description: - List of pager telephone numbers. aliases: [ pagerTelephonenumber ] phone: required: false default: [] description: - List of telephone numbers. postcode: required: false default: None description: - Postal code of users business address. primary_group: required: false default: cn=Domain Users,cn=groups,$LDAP_BASE_DN description: - Primary group. This must be the group LDAP DN. aliases: [ primaryGroup ] profilepath: required: false default: None description: - Windows profile directory pwd_change_next_login: required: false default: None choices: [ '0', '1' ] description: - Change password on next login. aliases: [ pwdChangeNextLogin ] room_number: required: false default: None description: - Room number of users business address. aliases: [ roomNumber ] samba_privileges: required: false default: [] description: - "Samba privilege, like allow printer administration, do domain join." aliases: [ sambaPrivileges ] samba_user_workstations: required: false default: [] description: - Allow the authentication only on this Microsoft Windows host. aliases: [ sambaUserWorkstations ] sambahome: required: false default: None description: - Windows home path, e.g. C('\\\\$FQDN\\$USERNAME'). scriptpath: required: false default: None description: - Windows logon script. secretary: required: false default: [] description: - A list of superiors as LDAP DNs. serviceprovider: required: false default: [''] description: - Enable user for the following service providers. shell: required: false default: '/bin/bash' description: - Login shell street: required: false default: None description: - Street of users business address. title: required: false default: None description: - Title, e.g. C(Prof.). unixhome: required: false default: '/home/$USERNAME' description: - Unix home directory userexpiry: required: false default: Today + 1 year description: - Account expiry date, e.g. C(1999-12-31). position: required: false default: '' description: - "Define the whole position of users object inside the LDAP tree, e.g. C(cn=employee,cn=users,ou=school,dc=example,dc=com)." ou: required: false default: '' description: - "Organizational Unit inside the LDAP Base DN, e.g. C(school) for LDAP OU C(ou=school,dc=example,dc=com)." subpath: required: false default: 'cn=users' description: - "LDAP subpath inside the organizational unit, e.g. C(cn=teachers,cn=users) for LDAP container C(cn=teachers,cn=users,dc=example,dc=com)." ''' EXAMPLES = ''' # Create a user on a UCS - udm_user: name=FooBar password=secure_password firstname=Foo lastname=Bar # Create a user with the DN # C(uid=foo,cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com) - udm_user: name=foo password=secure_password firstname=Foo lastname=Bar ou=school subpath='cn=teachers,cn=users' # or define the position - udm_user: name=foo password=secure_password firstname=Foo lastname=Bar position='cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com' ''' RETURN = '''# ''' def main(): expiry = date.strftime(date.today() + relativedelta(years=1), "%Y-%m-%d") module = AnsibleModule( argument_spec = dict( birthday = dict(default=None, type='str'), city = dict(default=None, type='str'), country = dict(default=None, type='str'), department_number = dict(default=None, type='str', aliases=['departmentNumber']), description = dict(default=None, type='str'), display_name = dict(default=None, type='str', aliases=['displayName']), email = dict(default=[''], type='list'), employee_number = dict(default=None, type='str', aliases=['employeeNumber']), employee_type = dict(default=None, type='str', aliases=['employeeType']), firstname = dict(default=None, type='str'), gecos = dict(default=None, type='str'), groups = dict(default=[], type='list'), home_share = dict(default=None, type='str', aliases=['homeShare']), home_share_path = dict(default=None, type='str', aliases=['homeSharePath']), home_telephone_number = dict(default=[], type='list', aliases=['homeTelephoneNumber']), homedrive = dict(default=None, type='str'), lastname = dict(default=None, type='str'), mail_alternative_address= dict(default=[], type='list', aliases=['mailAlternativeAddress']), mail_home_server = dict(default=None, type='str', aliases=['mailHomeServer']), mail_primary_address = dict(default=None, type='str', aliases=['mailPrimaryAddress']), mobile_telephone_number = dict(default=[], type='list', aliases=['mobileTelephoneNumber']), organisation = dict(default=None, type='str'), overridePWHistory = dict(default=False, type='bool', aliases=['override_pw_history']), overridePWLength = dict(default=False, type='bool', aliases=['override_pw_length']), pager_telephonenumber = dict(default=[], type='list', aliases=['pagerTelephonenumber']), password = dict(default=None, type='str', no_log=True), phone = dict(default=[], type='list'), postcode = dict(default=None, type='str'), primary_group = dict(default=None, type='str', aliases=['primaryGroup']), profilepath = dict(default=None, type='str'), pwd_change_next_login = dict(default=None, type='str', choices=['0', '1'], aliases=['pwdChangeNextLogin']), room_number = dict(default=None, type='str', aliases=['roomNumber']), samba_privileges = dict(default=[], type='list', aliases=['sambaPrivileges']), samba_user_workstations = dict(default=[], type='list', aliases=['sambaUserWorkstations']), sambahome = dict(default=None, type='str'), scriptpath = dict(default=None, type='str'), secretary = dict(default=[], type='list'), serviceprovider = dict(default=[''], type='list'), shell = dict(default='/bin/bash', type='str'), street = dict(default=None, type='str'), title = dict(default=None, type='str'), unixhome = dict(default=None, type='str'), userexpiry = dict(default=expiry, type='str'), username = dict(required=True, aliases=['name'], type='str'), position = dict(default='', type='str'), ou = dict(default='', type='str'), subpath = dict(default='cn=users', type='str'), state = dict(default='present', choices=['present', 'absent'], type='str') ), supports_check_mode=True, required_if = ([ ('state', 'present', ['firstname', 'lastname', 'password']) ]) ) username = module.params['username'] position = module.params['position'] ou = module.params['ou'] subpath = module.params['subpath'] state = module.params['state'] changed = False users = list(ldap_search( '(&(objectClass=posixAccount)(uid={}))'.format(username), attr=['uid'] )) if position != '': container = position else: if ou != '': ou = 'ou={},'.format(ou) if subpath != '': subpath = '{},'.format(subpath) container = '{}{}{}'.format(subpath, ou, base_dn()) user_dn = 'uid={},{}'.format(username, container) exists = bool(len(users)) if state == 'present': try: if not exists: obj = umc_module_for_add('users/user', container) else: obj = umc_module_for_edit('users/user', user_dn) if module.params['displayName'] is None: module.params['displayName'] = '{} {}'.format( module.params['firstname'], module.params['lastname'] ) if module.params['unixhome'] is None: module.params['unixhome'] = '/home/{}'.format( module.params['username'] ) for k in obj.keys(): if (k != 'password' and k != 'groups' and k != 'overridePWHistory' and k in module.params and module.params[k] is not None): obj[k] = module.params[k] # handle some special values obj['e-mail'] = module.params['email'] password = module.params['password'] if obj['password'] is None: obj['password'] = password else: old_password = obj['password'].split('}', 2)[1] if crypt.crypt(password, old_password) != old_password: obj['overridePWHistory'] = module.params['overridePWHistory'] obj['overridePWLength'] = module.params['overridePWLength'] obj['password'] = password diff = obj.diff() if exists: for k in obj.keys(): if obj.hasChanged(k): changed = True else: changed = True if not module.check_mode: if not exists: obj.create() elif changed: obj.modify() except: module.fail_json( msg="Creating/editing user {} in {} failed".format( username, container ) ) try: groups = module.params['groups'] if groups: filter = '(&(objectClass=posixGroup)(|(cn={})))'.format( ')(cn='.join(groups) ) group_dns = list(ldap_search(filter, attr=['dn'])) for dn in group_dns: grp = umc_module_for_edit('groups/group', dn[0]) if user_dn not in grp['users']: grp['users'].append(user_dn) if not module.check_mode: grp.modify() changed = True except: module.fail_json( msg="Adding groups to user {} failed".format(username) ) if state == 'absent' and exists: try: obj = umc_module_for_edit('users/user', user_dn) if not module.check_mode: obj.remove() changed = True except: module.fail_json( msg="Removing user {} failed".format(username) ) module.exit_json( changed=changed, username=username, diff=diff, container=container ) if __name__ == '__main__': main()