From 320168071ff56c00ff65870e781a261075fccc66 Mon Sep 17 00:00:00 2001
From: Rafael Guterres Jeffman <rjeffman@redhat.com>
Date: Wed, 21 Sep 2022 18:28:55 -0300
Subject: [PATCH] ipaconfig: Do not allow enable_sid set to False.
Once enabled, SID cannot be disabled. This patch ensures that an error
is raised if one tries to disable SID.
---
README-config.md | 2 +-
plugins/modules/ipaconfig.py | 15 ++++++++-------
tests/config/test_config_sid.yml | 13 +++++++++++++
3 files changed, 22 insertions(+), 8 deletions(-)
diff --git a/README-config.md b/README-config.md
index 13023ea..d6fe40a 100644
--- a/README-config.md
+++ b/README-config.md
@@ -148,7 +148,7 @@ Variable | Description | Required
`user_auth_type` \| `ipauserauthtype` | set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`). Use `""` to clear this variable. | no
`domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | no
`ca_renewal_master_server` \| `ipacarenewalmasterserver`| Renewal master for IPA certificate authority. | no
-`enable_sid` | New users and groups automatically get a SID assigned. Requires IPA 4.9.8+. (bool) | no
+`enable_sid` | New users and groups automatically get a SID assigned. Cannot be deactivated once activated. Requires IPA 4.9.8+. (bool) | no
`netbios_name` | NetBIOS name of the IPA domain. Requires IPA 4.9.8+ and 'enable_sid: yes'. | no
`add_sids` | Add SIDs for existing users and groups. Requires IPA 4.9.8+ and 'enable_sid: yes'. (bool) | no
diff --git a/plugins/modules/ipaconfig.py b/plugins/modules/ipaconfig.py
index 87810b2..9c19afb 100644
--- a/plugins/modules/ipaconfig.py
+++ b/plugins/modules/ipaconfig.py
@@ -175,7 +175,7 @@ options:
enable_sid:
description: >
New users and groups automatically get a SID assigned.
- Requires IPA 4.9.8+.
+ Cannot be deactivated once activated. Requires IPA 4.9.8+.
required: false
type: bool
netbios_name:
@@ -525,11 +525,16 @@ def main():
result = config_show(ansible_module)
if params:
+ enable_sid = params.get("enable_sid")
+ sid_is_enabled = has_enable_sid and is_enable_sid(ansible_module)
+
+ if sid_is_enabled and enable_sid is False:
+ ansible_module.fail_json(msg="SID cannot be disabled.")
+
netbios_name = params.get("netbios_name")
if netbios_name:
netbios_name = netbios_name.upper()
add_sids = params.get("add_sids")
- enable_sid = params.get("enable_sid")
required_sid = any([netbios_name, add_sids])
if required_sid and not enable_sid:
ansible_module.fail_json(
@@ -551,13 +556,9 @@ def main():
del params["add_sids"]
if (
not any([netbios_name, add_sids])
- and is_enable_sid(ansible_module)
+ and sid_is_enabled
):
del params["enable_sid"]
- else:
- for param in ["enable_sid", "netbios_name", "add_sids"]:
- if param in params:
- del params[params]
params = {
k: v for k, v in params.items()
diff --git a/tests/config/test_config_sid.yml b/tests/config/test_config_sid.yml
index 1761795..bd550a5 100644
--- a/tests/config/test_config_sid.yml
+++ b/tests/config/test_config_sid.yml
@@ -6,6 +6,9 @@
tasks:
+ - name: Set FreeIPA facts.
+ include_tasks: ../env_freeipa_facts.yml
+
# GET CURRENT CONFIG
- name: Return current values of the global configuration options
@@ -32,6 +35,14 @@
register: result
failed_when: result.failed or result.changed
+ - name: Try to Ensure SID is disabled.
+ ipaconfig:
+ ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
+ enable_sid: no
+ register: result
+ failed_when: not result.failed or "SID cannot be disabled." not in result.msg
+
- name: Ensure netbios_name is "IPATESTPLAY"
ipaconfig:
ipaadmin_password: SomeADMINpassword
@@ -59,6 +70,8 @@
enable_sid: yes
add_sids: yes
+ # only run tests if version supports enable-sid
+ when: ipa_version is version("4.9.8", ">=")
# REVERT TO PREVIOUS CONFIG
always:
# Once SID is enabled, it cannot be reverted.
--
2.37.3