Vh J d dl mZmZmZ eZdZdZdZd dl Z d dl
Z
d dl m Z d dl
mZ d dlmZ d d lmZ d d
lmZmZmZmZmZmZmZmZm Z d d l m Z d d l m Z d
Z! G d de# Z$d Z% G d de# Z& G d de& Z' G d de& Z(d Z)e*dk( r e) yy# e"$ r dZ!Y Iw xY w) )absolute_importdivisionprint_functiona"
module: iosxr_user
author:
- Trishna Guha (@trishnaguha)
- Sebastiaan van Doesselaar (@sebasdoes)
- Kedar Kekan (@kedarX)
short_description: Module to manage the aggregates of local users.
description:
- This module provides declarative management of the local usernames configured on
network devices. It allows playbooks to manage either individual usernames or the
aggregate of usernames in the current running config. It also supports purging usernames
from the configuration that are not explicitly defined.
version_added: 1.0.0
extends_documentation_fragment:
- cisco.iosxr.iosxr
notes:
- This module works with connection C(network_cli) and C(netconf). See L(the IOS-XR
Platform Options,../network/user_guide/platform_iosxr.html).
options:
aggregate:
description:
- The set of username objects to be configured on the remote Cisco IOS XR device.
The list entries can either be the username or a hash of username and properties.
This argument is mutually exclusive with the C(name) argument.
aliases:
- users
- collection
type: list
elements: dict
suboptions:
name:
description:
- The username to be configured on the Cisco IOS XR device. This argument accepts
a string value and is mutually exclusive with the C(aggregate) argument. Please
note that this option is not same as C(provider username).
type: str
required: true
configured_password:
description:
- The password to be configured on the Cisco IOS XR device. The password needs
to be provided in clear text. Password is encrypted on the device when used
with I(cli) and by Ansible when used with I(netconf) using the same MD5 hash
technique with salt size of 3. Please note that this option is not same as C(provider
password).
type: str
update_password:
description:
- Since passwords are encrypted in the device running config, this argument will
instruct the module when to change the password. When set to C(always), the
password will always be updated in the device and when set to C(on_create) the
password will be updated only if the username is created.
type: str
choices:
- on_create
- always
group:
description:
- Configures the group for the username in the device running configuration. The
argument accepts a string value defining the group name. This argument does
not check if the group has been configured on the device.
type: str
aliases:
- role
groups:
description:
- Configures the groups for the username in the device running configuration.
The argument accepts a list of group names. This argument does not check if
the group has been configured on the device. It is similar to the aggregate
command for usernames, but lets you configure multiple groups for the user(s).
type: list
elements: str
admin:
description:
- Enters into administration configuration mode for making config changes to the
device.
- Applicable only when using network_cli transport
type: bool
state:
description:
- Configures the state of the username definition as it relates to the device
operational configuration. When set to I(present), the username(s) should be
configured in the device active configuration and when set to I(absent) the
username(s) should not be in the device active configuration
type: str
choices:
- present
- absent
public_key:
description:
- Configures the contents of the public keyfile to upload to the IOS-XR node.
This enables users to login using the accompanying private key. IOS-XR only
accepts base64 decoded files, so this will be decoded and uploaded to the node.
Do note that this requires an OpenSSL public key file, PuTTy generated files
will not work! Mutually exclusive with public_key_contents. If used with multiple
users in aggregates, then the same key file is used for all users.
type: str
public_key_contents:
description:
- Configures the contents of the public keyfile to upload to the IOS-XR node.
This enables users to login using the accompanying private key. IOS-XR only
accepts base64 decoded files, so this will be decoded and uploaded to the node.
Do note that this requires an OpenSSL public key file, PuTTy generated files
will not work! Mutually exclusive with public_key.If used with multiple users
in aggregates, then the same key file is used for all users.
type: str
name:
description:
- The username to be configured on the Cisco IOS XR device. This argument accepts
a string value and is mutually exclusive with the C(aggregate) argument. Please
note that this option is not same as C(provider username).
type: str
configured_password:
description:
- The password to be configured on the Cisco IOS XR device. The password needs
to be provided in clear text. Password is encrypted on the device when used
with I(cli) and by Ansible when used with I(netconf) using the same MD5 hash
technique with salt size of 3. Please note that this option is not same as C(provider
password).
type: str
update_password:
description:
- Since passwords are encrypted in the device running config, this argument will
instruct the module when to change the password. When set to C(always), the
password will always be updated in the device and when set to C(on_create) the
password will be updated only if the username is created.
type: str
default: always
choices:
- on_create
- always
group:
description:
- Configures the group for the username in the device running configuration. The
argument accepts a string value defining the group name. This argument does
not check if the group has been configured on the device.
type: str
aliases:
- role
groups:
description:
- Configures the groups for the username in the device running configuration.
The argument accepts a list of group names. This argument does not check if
the group has been configured on the device. It is similar to the aggregate
command for usernames, but lets you configure multiple groups for the user(s).
type: list
elements: str
purge:
description:
- Instructs the module to consider the resource definition absolute. It will remove
any previously configured usernames on the device with the exception of the
`admin` user and the current defined set of users.
type: bool
default: false
admin:
description:
- Enters into administration configuration mode for making config changes to the
device.
- Applicable only when using network_cli transport
type: bool
default: false
state:
description:
- Configures the state of the username definition as it relates to the device
operational configuration. When set to I(present), the username(s) should be
configured in the device active configuration and when set to I(absent) the
username(s) should not be in the device active configuration
type: str
default: present
choices:
- present
- absent
public_key:
description:
- Configures the contents of the public keyfile to upload to the IOS-XR node.
This enables users to login using the accompanying private key. IOS-XR only
accepts base64 decoded files, so this will be decoded and uploaded to the node.
Do note that this requires an OpenSSL public key file, PuTTy generated files
will not work! Mutually exclusive with public_key_contents. If used with multiple
users in aggregates, then the same key file is used for all users.
type: str
public_key_contents:
description:
- Configures the contents of the public keyfile to upload to the IOS-XR node.
This enables users to login using the accompanying private key. IOS-XR only
accepts base64 decoded files, so this will be decoded and uploaded to the node.
Do note that this requires an OpenSSL public key file, PuTTy generated files
will not work! Mutually exclusive with public_key.If used with multiple users
in aggregates, then the same key file is used for all users.
type: str
requirements:
- ncclient >= 0.5.3 when using netconf
- lxml >= 4.1.1 when using netconf
- base64 when using I(public_key_contents) or I(public_key)
aQ
- name: create a new user
cisco.iosxr.iosxr_user:
name: ansible
configured_password: mypassword
state: present
- name: create a new user in admin configuration mode
cisco.iosxr.iosxr_user:
name: ansible
configured_password: mypassword
admin: true
state: present
- name: remove all users except admin
cisco.iosxr.iosxr_user:
purge: true
- name: set multiple users to group sys-admin
cisco.iosxr.iosxr_user:
aggregate:
- name: netop
- name: netend
group: sysadmin
state: present
- name: set multiple users to multiple groups
cisco.iosxr.iosxr_user:
aggregate:
- name: netop
- name: netend
groups:
- sysadmin
- root-system
state: present
- name: Change Password for User netop
cisco.iosxr.iosxr_user:
name: netop
configured_password: '{{ new_password }}'
update_password: always
state: present
- name: Add private key authentication for user netop
cisco.iosxr.iosxr_user:
name: netop
state: present
public_key_contents: "{{ lookup('file', '/home/netop/.ssh/id_rsa.pub' }}"
a
commands:
description: The list of configuration mode commands to send to the device
returned: always
type: list
sample:
- username ansible secret password group sysadmin
- username admin secret admin
xml:
description: NetConf rpc xml sent to device with transport C(netconf)
returned: always (empty list when no xml rpc to send)
type: list
sample:
- '
test7
sysadmin
$1$ZsXC$zZ50wqhDC543ZWQkkAHLW0
'
N)deepcopy)partial)
AnsibleModule)remove_default_spec) build_xml copy_file
etree_findallget_capabilities
get_configget_connection
is_cliconf
is_netconf load_config)Version) b64decodeTFc * e Zd Zd Zd Zd Zd Zd Zy)PublicKeyManagerc || _ || _ y N)_module_result)selfmoduleresults j/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/cisco/iosxr/plugins/modules/iosxr_user.py__init__zPublicKeyManager.__init__= s c | j j d rd}n| j j d }| j j d r| j j d }nL| j j d r3t | j j d d }|j }j d }t | }t d|z d }|j
| |j d|z S ) zVIOS-XR only accepts base64 decoded files, this converts the public key to a temp file. aggregatenamepublic_key_contents
public_keyr z/tmp/publickey_%s.b64wb)r paramsopenreadsplitr writeclose)r r# keyreadfile splitfile base64key
base64files r convert_key_to_base64z&PublicKeyManager.convert_key_to_base64A s << { + D<<&&v.D << 4 5,,%%&;r c t | j d }d|v ry |j j d j d }|D ] }|j j }|d j j d }d }t
| dkD r.|d j j }|d dk( r|d }|dd |d }| j j | y )
Nusername)
config_filterzNo such configuration item!r r' ro rH )r# rG rn ro ) r r striprstripr,
splitlineslenr\ rt ) r dataru rL user_configr# ro group_or_secretobjs r map_config_to_objz"CliConfiguration.map_config_to_obj s $,,jA '4 /
##C(..s3 #D **,113K q>'')//1!4DE; !#"-a."6"6"8">">"@"1%0 +A .E )D[`aC JJ c " #r c t }| j D ]` }|d }|d }t || j }|dk( r|r|j d|z @|dk( r|s}d|z }|j | |d r|j |dz |d z |d r|j |d
z |d z |d s|d D ] }|j |d
z |z |dk( s|sd|z }| j
j d d
k( r |d r|j |dz |d z |d r'|d |d k7 r |j |d
z |d z 9|d s@|d D ] }|j |d
z |z c | j
j d rz| j D cg c] }|d } }| j D cg c] }|d }
}t |
j t | D ] } | dk7 s |j d| z d|v r | j
j d g | j d< |r| j
j } | j
j d }
t | j
|| |
}|rt | | j d< || j d< d| j d< y y c c}w c c}w )Nr# rG rI z no username rH z username rn z secret ro z group rp update_passwordalwaysrJ r; zno username %szno username adminz!cannot delete the `admin` accountrl commands)commitr; prepareddiffTchanged)rZ r[ rV r\ rt r r) set
differencerq r rK r rs )r r wr# rG obj_in_haveuser_cmdro x
want_users
have_usersre r r; r s r map_obj_to_commandsz$CliConfiguration.map_obj_to_commands s 6 FAV9DgJE,T4::>K [ 56)#K&-)*+ OOHz$9A>SS << w '-1ZZ8!F)8J8-1ZZ8!F)8J8J223z?C
=7? OO$4t$;<
= ( * LL " "'J " K#% Z 000FLL''0E t||XfERD'+T': V$'/DLL $&*DLL # 98s " K> Kc z | j | j | j | j S r )rw r r r )r s r rN zCliConfiguration.run& s0 "||r )rO rP rQ r r r rN
__classcell__r} s @r ry ry s ?#,5+n r ry c 0 e Zd Z fdZd Zd Zd Z xZS )NCConfigurationc t t | || t j | _ t j | _ y r )r{ r r collections OrderedDict _locald_meta_locald_group_metar| s r r zNCConfiguration.__init__/ s6
ot-ff= ' 3 3 5"-"9"9"; r c t d}t j ||z j d j S )zw
Generate MD5 hash with randomly generated salt size of 3.
:param arg:
:return passwd:
z1openssl passwd -salt `openssl rand -base64 3` -1 r )ospopen readlinesr )r argcmds r generate_md5_hashz!NCConfiguration.generate_md5_hash4 s4 Bxxc ",,.q17799r c |rt | t d kD r| j j dddddfddddd fd
d d ifd
d difdddddfddddfddddfg | j j dddddfddddd fd
d d ifd
d difdddddfd d dddfd d ddfg nv| j j dddddfddddd fd
d d ifddddfg | j j dddddfddddd fd
d d ifdddddfd d dddfd d ddfg | j j
d }t
d!d"# }t | j d$|% }t |d }t }|D ] }t |d& }|j |d' j t | } | d(k( r-| j j |d' j d d d) n| d*k( r:| j j |d' j |d( j d d) ns| d*kD rnt | }
t |
t } |
D ] } | j | j | j j |d' j d | d) |s!t | t d kD s:t |d+ }
t | j d'kD s`| j d, j |
d' j - t }t }d }| j D cg c]. }|j! d. st# |j! d. 0 }}|d/k( rmd0}| j$ D ]Z }|d& |v s t' |d& | j }|r t | t d kD r|d. |d.< d |d1< |j | \ n|d2k( rd3}| j$ D ] }t' |d& | j }|d& |vr|rZt | t d kD rC| j) |d1 |d1< |d, d(z }t+ | |d.< |j | d|d4< | j) |d1 |d1< |j | |d5 |j | |d6 |d6 D ]& }||d5< |j |j- ( |r&t | t d kD r|r
d|d4< |d. |d.< | j j
d7 d8k( r.|d1 )| j) |d1 |d1< |j | nd |d1< |d5 |d5 |d5 k7 r|j | |d6 |d6 D ]& }||d5< |j |j- ( t }| j j
d9 ry| j$ D cg c] }|d& }}| j D cg c] }|d& }}t/ | j1 t/ | D ] }|d:k7 s |j d&|i g | j2 d;< t } |~|r(| j t
d!| j ||< |r(| j t
d!| j ||< |r(| j t
d!| j |d0< d } | r1| j j4 } t7 | j | | ||= } | rN| j j8 rt; | > | j2 d?< | | j2 d;< d| j2 d@< y y c c}w c c}w c c}w )ANz7.0
aaa_localdz
aaa/usernamesT)xpathtagnsr zaaa/usernames/username operation)r r attribza:namer zaaa/usernames/username/nameza:ordering_indexz%aaa/usernames/username/ordering-indexsecretz aaa/usernames/username/secretedit)r r r za:typez"aaa/usernames/username/secret/typetype5)r rf za:configured_passwordz%aaa/usernames/username/secret/secret5)r r
usergroupsz0aaa/usernames/username/usergroup-under-usernames usergroupzIaaa/usernames/username/usergroup-under-usernames/usergroup-under-usernameza:groupzNaaa/usernames/username/usergroup-under-usernames/usergroup-under-username/namerG aaafilter)opcoderunning)sourcer r# r r' )r# ro rp zordering-index)ordering_indexr rI deletern rH merger_ ro rp r r rJ r; xml)xmapr) r )r r
nc_get_filterr r r ) r r updater r r) r
r r rZ rt textr r\ iternextr@ intr[ rV r r` copyr r r rK r _diffrs ) r
os_versionrG _get_filterr elementsru element name_list list_size name_itertmp_listr# r
locald_paramslocald_group_paramsr rL ordering_index_list want_itemr new_ordering_indexro purge_paramsr r r re _edit_filter_listr r s r map_obj_to_xml_rpcz"NCConfiguration.map_obj_to_xml_rpc= s '*-> $ $!_TQU#VW"":4S^_ )F GH''3Z)[\ %D#')/ )MX_ `a/"IX^_#
0
# # * *!_TQU#VW"":4S^_ )F GH''3Z)[\$%W#')/ $%p#')/ "%u)/1 !
F
$ $!_TQU#VW"":4S^_ )F GH/"APVW
# # * *!_TQU#VW"":4S^_ )F GH$%W#')/ $%p#')/ "%u)//
D ##G, h7 T\\);W *5 QG%gv6I LL1 ** +IIA~
!!9Q<+<+(J %&; < H;?;Q;Q %&; << "78 &,,Y7;? "78 "'*6 %g .+g2F F+229="8,8%.x%8 IE16Ig . / 6 6y~~7G HIY.
I` v << w '-1ZZ8!F)8J8-1ZZ8!F)8J8J223z?C
87? ''7
8 ! U F !(( e$*;*;MZ`a #!(( ! 4 4 2 % !(( e$*;*;LYab 000F ! ) D ||!!'+T': V$"3DLL &*DLL # Q
B 98s ']"> ]" ]'4 ],c t | j j d j d }| j | j | | j
S )N device_infonetwork_os_version)r
r r@ rw r r )r r s r rN zNCConfiguration.run9 sK %dll377
FJJK_`
+||r )rO rP rQ r r r rN r r s @r r r . s <
:z+x r r c l t t d t dd t ddddg t dd
t d t d t dd g t d
d t ddddg } t | }t d |d< t | g d}t t d
d|ddg t dd
}|j | t ||d }|j
d s|j
d rt s|j d d g d }d }t | r
t || }nt | r t || }|r|j }|j
d s|j
d r t || }|j } |j d!i | y )"z%main entry point for module executionr` )r_ T)r_ no_logr on_create)r_ defaultchoicesboolF)r_ r role)r_ aliasesrZ )r_ r rH rI ) r# rn r r; r% r$ ro rp rG )requiredr# ))r# r" )r% r$ )ro rp rs ru
collection)r_ r optionsr )r" rJ )ra mutually_exclusivesupports_check_moder$ r% znlibrary base64 is required but does not appear to be installed. It can be installed using `pip install base64`rl )r warningsNrR )rs r r r r r) HAS_B64rq r ry r r rN r exit_json) element_specaggregate_specr ra r r
config_object
pubkey_objects r mainr A s
u
eD 9 %KQYCZ[.U# e ,x0%0y9h:OP
L l+N !4 0N6 ' " l+
.M &
#- F }}*+v}}\/J L
B
/FM&(8
F '7
""$
}}*+v}}\/J(8
""$F v r __main__)+
__future__r r r r_
__metaclass__
DOCUMENTATIONEXAMPLESRETURNr r r r functoolsr ansible.module_utils.basicr Oansible_collections.ansible.netcommon.plugins.module_utils.network.common.utilsr Hansible_collections.cisco.iosxr.plugins.module_utils.network.iosxr.iosxrr
r r r
r r r r r Nansible_collections.cisco.iosxr.plugins.module_utils.network.iosxr.utils.utilsr base64r r ImportErrorobjectr rV rX ry r r rO rR r r r s A @
B
H* X
< 4
c G
W v W t4$ 4$nV z V rP j P fB J zF ] Gs B B"!B"