Vh3?ddlmZmZmZeZdZdZdZddl Z ddl m Z ddl m Z ddlmZdd lmZdd lmZmZdd lmZmZmZgd Zd ZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$e%dk(re$yy))absolute_importdivisionprint_functiona module: nxos_user extends_documentation_fragment: - cisco.nxos.nxos author: Peter Sprygada (@privateip) notes: - Limited Support for Cisco MDS short_description: Manage the collection of local users on Nexus devices description: - This module provides declarative management of the local usernames configured on Cisco Nexus devices. It allows playbooks to manage either individual usernames or the collection of usernames in the current running config. It also supports purging usernames from the configuration that are not explicitly defined. version_added: 1.0.0 options: aggregate: description: - The set of username objects to be configured on the remote Cisco Nexus device. The list entries can either be the username or a hash of username and properties. This argument is mutually exclusive with the C(name) argument. aliases: - users - collection type: list elements: dict suboptions: name: description: - The username to be configured on the remote Cisco Nexus device. This argument accepts a string value and is mutually exclusive with the C(aggregate) argument. type: str configured_password: description: - The password to be configured on the network device. The password needs to be provided in cleartext and it will be encrypted on the device. type: str hashed_password: description: - The hashed password to be configured on the network device. The password needs to already be encrypted. type: str update_password: description: - Since passwords are encrypted in the device running config, this argument will instruct the module when to change the password. When set to C(always), the password will always be updated in the device and when set to C(on_create) the password will be updated only if the username is created. choices: - on_create - always type: str roles: description: - The C(role) argument configures the role for the username in the device running configuration. The argument accepts a string value defining the role name. This argument does not check if the role has been configured on the device. aliases: - role type: list elements: str sshkey: description: - The C(sshkey) argument defines the SSH public key to configure for the username. This argument accepts a valid SSH key value. type: str state: description: - The C(state) argument configures the state of the username definition as it relates to the device operational configuration. When set to I(present), the username(s) should be configured in the device active configuration and when set to I(absent) the username(s) should not be in the device active configuration choices: - present - absent type: str name: description: - The username to be configured on the remote Cisco Nexus device. This argument accepts a string value and is mutually exclusive with the C(aggregate) argument. type: str configured_password: description: - The password to be configured on the network device. The password needs to be provided in cleartext and it will be encrypted on the device. type: str hashed_password: description: - The hashed password to be configured on the network device. The password needs to already be encrypted. type: str update_password: description: - Since passwords are encrypted in the device running config, this argument will instruct the module when to change the password. When set to C(always), the password will always be updated in the device and when set to C(on_create) the password will be updated only if the username is created. default: always choices: - on_create - always type: str roles: description: - The C(role) argument configures the role for the username in the device running configuration. The argument accepts a string value defining the role name. This argument does not check if the role has been configured on the device. aliases: - role type: list elements: str sshkey: description: - The C(sshkey) argument defines the SSH public key to configure for the username. This argument accepts a valid SSH key value. type: str purge: description: - The C(purge) argument instructs the module to consider the resource definition absolute. It will remove any previously configured usernames on the device with the exception of the `admin` user which cannot be deleted per nxos constraints. type: bool default: false state: description: - The C(state) argument configures the state of the username definition as it relates to the device operational configuration. When set to I(present), the username(s) should be configured in the device active configuration and when set to I(absent) the username(s) should not be in the device active configuration default: present choices: - present - absent type: str a| - name: create a new user cisco.nxos.nxos_user: name: ansible sshkey: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}" state: present - name: remove all users except admin cisco.nxos.nxos_user: purge: true - name: set multiple users role cisco.nxos.nxos_user: aggregate: - name: netop - name: netend role: network-operator state: present z commands: description: The list of configuration mode commands to send to the device returned: always type: list sample: - name ansible - name ansible password password N)deepcopy)partial) AnsibleModule) iteritems)remove_default_specto_list) get_config load_config run_commands)z network-adminznetwork-operatorz vdc-adminz vdc-operatorzpriv-15zpriv-14zpriv-13zpriv-12zpriv-11zpriv-10zpriv-9zpriv-8zpriv-7zpriv-6zpriv-5zpriv-4zpriv-3zpriv-2zpriv-1zpriv-0zdev-opscdtjdt|dgtjS)Nz^role name (\S+)z| include '^role name')flags)refindallr M)modules h/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/cisco/nxos/plugins/modules/nxos_user.pyget_custom_rolesrs+ ::6":!;<  cdtt|z}|D]}||vs|jdy)Nzinvalid role specifiedmsg) BUILTIN_ROLESr fail_json)valuer valid_rolesitems rvalidate_rolesr s;"26"::K; { "   !9  :;rc t|jd}|D]}|\ fd} fd fd  fd} ddk(rjd d zBd } dd k(r" s |}|sjd d z|d r|dk(s sd d z|dr|dk(s sd dz|drd dz|r|S)Nupdate_passwordcpj|xr#j|j|k7S)Nget)xhavewants r needs_updatez)map_obj_to_commands..needs_updates+88A;?DHHQK488A;$> ?rc8jddd|S)N username name appendr&commandsr(s raddz map_obj_to_commands..adds??tF|Q#GH Hrc8jddd|S)Nz no username r,r-r.r0s rremovez#map_obj_to_commands..removes??$v,#JK KrcdryratdjdD] }d|ztdjdD] }d|zydD] }d|zyy)Nroleszrole %sTF)set difference)rr2r'r4r(s rconfigure_rolesz,map_obj_to_commands..configure_rolessG} #DM 2 = =d7m L1y4/01!$DM 2 = =d7m L.I,-. !%W .I,-.rstateabsentno username %sr,Fpresentz username %sconfigured_passwordalwaysz password %shashed_passwordz password 5 %ssshkeyz sshkey %s)listparamsr/) updatesrr"updater)r9roles_configuredr2r1r'r4r(s @@@@@rmap_obj_to_commandsrGsvHmm$56O1 d @ I L  =H $ OO,tF|; <   =I %d.0 # V <= - .(*$MD)>$??@ ) *(*$Od+<&==>  !  d8n, -  c1f Orc(|jdsyy)N remote_loginz r$)datas rparse_passwordrK1s 88N # $rcd}d|vr|jdd}t}|r$t|D]}|j|d|S)N TABLE_roleROW_rolerole)r%rBr r/)rJconfigured_rolesr6rs r parse_rolesrQ6sXt88L1*= FE,- 'D LLf & ' Lrc t|dddg}|d}t}t|ddD]G}|j|dt |t ||j dt |d d I|S) Nzshow user-accountjsoncommandoutputrTABLE_template ROW_templateusr_name sshkey_infor=)r,r>r@rAr6r:)rrBr r/rKr%rQ)routrJobjectsrs rmap_config_to_objr]Bs v,?6 RS TC q6DfG-.~>?  Z('5d';#1$#7((=1$T*"      Nrc|j|s|j|}|S|j|jdd}|j|}|||||}|S)Ntypestr)r%rC argument_spec _CHECK_ARGUMENT_TYPES_DISPATCHER)keyrrr value_type type_checkers rget_param_valuerfVsk 88C= c" L ))#.2265A >>zJ T#YS  Lrc |jd}|s]|jds|jdr tS|jds|jdnpd|jdig}n]t}|D]N}t|ts|j d|i'd|vr|jd>|j |Pt}D]}t t||}|j|d|d |d |d |d d t|D];\}}|s tjd|z}t||fs3|||=|j ||S)N aggregater,purgezusername is requiredrzname is required)rrr>r@rAr6r:)r>r@rAr6r:z validate_%s) rCrBr isinstancedictr/rrfrEr globalsr%all) rrh collectionrr\ get_valuercr validators rmap_params_to_objrqes} k*I }}V$w)?6Mv&   !7  8!6==#89:JV  (DdD)!!64.1t#  %7 8!!$'  (fGO$vF  '01F'G#,->#?#H-"7+"7+   $D/ -JC#IMM-#*=> y)*eV,  - t'* Nrct}|D]utfd|Dd}t|duddk(fr|jifA|sDt D]$\}}|s |||k7s|j|f&w|S)Nc3:K|]}|ddk(s|yw)r,N).0ientrys r z!update_objects..s C1& U6](BQCsr:r=)rBnextrmr/r )r(r'rDrrcrrws @rupdate_objectsrzsfG2CCTJ  eGn 9: ; NNE2; ' '. 2 UUd3i/NNE4=1 2 2 Nrct|dddg}t}|djD]8}|jds|j d}|j |:|S)Nz'show running-config | section ^usernametextrTrr+)rr7 splitlines startswithsplitr2)r config_output usernameslineusernames rget_configured_usernamesrso >& QRMIa ++-$ ??; 'zz|AH MM( #$ rc tttdtdtdddgtddgd td td d d g }t|}t|ttdd|ddgtdd }|j|ddg}t ||d}d gd}t |}t |}tt|||}|jdrrt|D cgc]} | d c} } t|} t| j| D].} | dk7s | jdd} |jd| z0||d<d |vr|jd!"|jd#5t!j"d%|jd#s|jd&"|r|j$st'||} | D]y}|j)j+d'r|j|"5|d(j-|j/D cgc]} | j+d)s| d*d$c} {d|d+<|j0d,i|y$cc} wcc} w)-z%main entry point for module executionT)no_logr? on_create)defaultchoicesrBrOr`)r_aliaseselementsFr=r;)r,r>r@r"r6rAr:rkrnusers)r_roptionsrbool)r_r)rhri)r,rh)r>r@)ramutually_exclusivesupports_check_mode)changedwarningsrir,admin\z\\r<r1zno username adminz!cannot delete the `admin` accountrr@Nz^\$5\$......\$.*$zProvided hash is not validzwrong passwordrz WARNING: rrt)rkrr rErrqr]rGrzrCr7rr8replacer/rrmatch check_moder lowerrextendr~ exit_json) element_specaggregate_specrarrresultr(r'r1r& want_users have_usersr responsesresps rmainrs V -D)X X7NO5A5!9y(.CDLl+N'"!7+  .M&/1[\ #- F B /F V $D V $D">$#=vFH }}WT2!F)23 -f5  O..z: 9Dw||D&1 04 78 9 "F:h&@A}}&'3xx,fmm  #FH5I! ::<**+;<$$$.:&--(,(9W1Q\\+=V12W  !yFvC38Xs JJ J __main__)& __future__rrrr_ __metaclass__ DOCUMENTATIONEXAMPLESRETURNrcopyr functoolsransible.module_utils.basicransible.module_utils.sixr Oansible_collections.ansible.netcommon.plugins.module_utils.network.common.utilsr r Eansible_collections.cisco.nxos.plugins.module_utils.network.nxos.nxosr r rrrr rGrKrQr]rfrqrzrr__name__rtrrrs$A@ E N (  4.  2;7t ( *Z  Nb zFr