
    Vh7                         d dl mZmZmZ eZdZdZdZd dl	Z	d dl
mZ d dlmZmZ d dlmZ d d	lmZ  G d
 de      Z	 	 	 ddZd Zd Zd Zedk(  r e        yy)    )absolute_importdivisionprint_functiona  
module: ipa_hbacrule
author: Thomas Krahn (@Nosmoht)
short_description: Manage FreeIPA HBAC rule
description:
  - Add, modify or delete an IPA HBAC rule using IPA API.
attributes:
  check_mode:
    support: full
  diff_mode:
    support: none
options:
  cn:
    description:
      - Canonical name.
      - Can not be changed as it is the unique identifier.
    required: true
    aliases: ["name"]
    type: str
  description:
    description: Description.
    type: str
  host:
    description:
      - List of host names to assign.
      - If an empty list is passed all hosts will be removed from the rule.
      - If option is omitted hosts will not be checked or changed.
    required: false
    type: list
    elements: str
  hostcategory:
    description: Host category.
    choices: ['all']
    type: str
  hostgroup:
    description:
      - List of hostgroup names to assign.
      - If an empty list is passed all hostgroups will be removed from the rule.
      - If option is omitted hostgroups will not be checked or changed.
    type: list
    elements: str
  service:
    description:
      - List of service names to assign.
      - If an empty list is passed all services will be removed from the rule.
      - If option is omitted services will not be checked or changed.
    type: list
    elements: str
  servicecategory:
    description: Service category.
    choices: ['all']
    type: str
  servicegroup:
    description:
      - List of service group names to assign.
      - If an empty list is passed all assigned service groups will be removed from the rule.
      - If option is omitted service groups will not be checked or changed.
    type: list
    elements: str
  sourcehost:
    description:
      - List of source host names to assign.
      - If an empty list if passed all assigned source hosts will be removed from the rule.
      - If option is omitted source hosts will not be checked or changed.
    type: list
    elements: str
  sourcehostcategory:
    description: Source host category.
    choices: ['all']
    type: str
  sourcehostgroup:
    description:
      - List of source host group names to assign.
      - If an empty list if passed all assigned source host groups will be removed from the rule.
      - If option is omitted source host groups will not be checked or changed.
    type: list
    elements: str
  state:
    description: State to ensure.
    default: "present"
    choices: ["absent", "disabled", "enabled", "present"]
    type: str
  user:
    description:
      - List of user names to assign.
      - If an empty list if passed all assigned users will be removed from the rule.
      - If option is omitted users will not be checked or changed.
    type: list
    elements: str
  usercategory:
    description: User category.
    choices: ['all']
    type: str
  usergroup:
    description:
      - List of user group names to assign.
      - If an empty list if passed all assigned user groups will be removed from the rule.
      - If option is omitted user groups will not be checked or changed.
    type: list
    elements: str
extends_documentation_fragment:
  - community.general.ipa.documentation
  - community.general.attributes
a  
- name: Ensure rule to allow all users to access any host from any host
  community.general.ipa_hbacrule:
    name: allow_all
    description: Allow all users to access any host from any host
    hostcategory: all
    servicecategory: all
    usercategory: all
    state: present
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure rule with certain limitations
  community.general.ipa_hbacrule:
    name: allow_all_developers_access_to_db
    description: Allow all developers to access any database from any host
    hostgroup:
      - db-server
    usergroup:
      - developers
    state: present
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure rule is absent
  community.general.ipa_hbacrule:
    name: rule_to_be_deleted
    state: absent
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret
z\
hbacrule:
  description: HBAC rule as returned by IPA API.
  returned: always
  type: dict
N)AnsibleModule)	IPAClientipa_argument_spec)	to_native)LooseVersionc                   f     e Zd Z fdZd Zd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Z xZS )HBACRuleIPAClientc                 2    t         t        |   ||||       y )N)superr   __init__)selfmodulehostportprotocol	__class__s        r/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/general/plugins/modules/ipa_hbacrule.pyr   zHBACRuleIPAClient.__init__   s    /dHM    c                 0    | j                  dd d|d      S )Nhbacrule_findT)allcnmethodnameitem
_post_jsonr   r   s     r   r   zHBACRuleIPAClient.hbacrule_find   s    oDt[_G`aar   c                 *    | j                  d||      S )Nhbacrule_addr   r    r   r   r   s      r   r$   zHBACRuleIPAClient.hbacrule_add       n4dKKr   c                 *    | j                  d||      S )Nhbacrule_modr   r    r%   s      r   r(   zHBACRuleIPAClient.hbacrule_mod   r&   r   c                 (    | j                  d|      S )Nhbacrule_del)r   r   r    r"   s     r   r*   zHBACRuleIPAClient.hbacrule_del   s    n4@@r   c                 *    | j                  d||      S )Nhbacrule_add_hostr   r    r%   s      r   r,   z#HBACRuleIPAClient.hbacrule_add_host       &94PPr   c                 *    | j                  d||      S )Nhbacrule_remove_hostr   r    r%   s      r   r/   z&HBACRuleIPAClient.hbacrule_remove_host       &<4dSSr   c                 *    | j                  d||      S )Nhbacrule_add_servicer   r    r%   s      r   r2   z&HBACRuleIPAClient.hbacrule_add_service   r0   r   c                 *    | j                  d||      S )Nhbacrule_remove_servicer   r    r%   s      r   r4   z)HBACRuleIPAClient.hbacrule_remove_service       &?dQUVVr   c                 *    | j                  d||      S )Nhbacrule_add_userr   r    r%   s      r   r7   z#HBACRuleIPAClient.hbacrule_add_user   r-   r   c                 *    | j                  d||      S )Nhbacrule_remove_userr   r    r%   s      r   r9   z&HBACRuleIPAClient.hbacrule_remove_user   r0   r   c                 *    | j                  d||      S )Nhbacrule_add_sourcehostr   r    r%   s      r   r;   z)HBACRuleIPAClient.hbacrule_add_sourcehost   r5   r   c                 *    | j                  d||      S )Nhbacrule_remove_sourcehostr   r    r%   s      r   r=   z,HBACRuleIPAClient.hbacrule_remove_sourcehost   s    &BTXYYr   )__name__
__module____qualname__r   r   r$   r(   r*   r,   r/   r2   r4   r7   r9   r;   r=   __classcell__)r   s   @r   r   r      sQ    NbLLAQTTWQTWZr   r   c                 ^    i }| | |d<   |||d<   |||d<   |||d<   |||d<   |||d<   |S )Ndescriptionhostcategoryipaenabledflagservicecategorysourcehostcategoryusercategory )rC   rD   rE   rF   rG   rH   datas          r   get_hbacrule_dictrK      sq     D)]+^!!/""1%%7!"+^Kr   c                 (    | j                  ||      S )N)ipa_datamodule_data)get_diff)clientipa_hbcarulemodule_hbcarules      r   get_hbcarule_diffrS      s    ??Lo?NNr   c                    | j                   d   }| j                   d   }|j                         }|dv rt        |      t        d      k  rd}nd}nt        |      t        d      k  rd}nd}| j                   d	   }| j                   d
   }| j                   d   }| j                   d   }	| j                   d   }
| j                   d   }| j                   d   }| j                   d   }| j                   d   }| j                   d   }| j                   d   }| j                   d   }t        | j                   d   |||
||      }|j	                  |      }d}|dv r~|s"d}| j
                  sm|j                  ||      }nYt        |||      }t        |      dkD  r>d}| j
                  s0i }|D ]  }|j                  |      ||<    |j                  ||       |>|j                  ||j                  dg       ||j                  |j                  d	      xs |}|>|j                  ||j                  dg       ||j                  |j                  d      xs |}|	>|j                  ||j                  dg       |	|j                  |j                  d      xs |}|>|j                  ||j                  dg       ||j                  |j                  d       xs |}|>|j                  ||j                  d!g       ||j                   |j"                  d	      xs |}|>|j                  ||j                  d"g       ||j                   |j"                  d      xs |}|>|j                  ||j                  d#g       ||j$                  |j&                  d      xs |}|a|j                  ||j                  d$g       ||j$                  |j&                  d%      xs |}n"|r d}| j
                  s|j)                  |       ||j	                  |      fS )&Nr   state)presentenabledz4.9.10TRUETFALSEFr   rD   	hostgroupservicerF   servicegroup
sourcehostrG   sourcehostgroupuserrH   	usergrouprC   )rC   rD   rE   rF   rG   rH   )r   )rV   rW   disabled)r   r   r   memberhost_hostmemberhost_hostgroupmemberservice_hbacsvchbacsvcmemberservice_hbacsvcgrouphbacsvcgroupsourcehost_hostsourcehost_groupmemberuser_usermemberuser_groupgroup)paramsget_ipa_versionr
   rK   r   
check_moder$   rS   lengetr(   modify_if_diffr,   r/   r2   r4   r;   r=   r7   r9   r*   )r   rP   r   rU   ipa_versionrE   r   rD   rZ   r[   rF   r\   r]   rG   r^   r_   rH   r`   module_hbacruleipa_hbacrulechangeddiffrJ   keys                           r   ensurery      s   ==DMM'"E((*K&&$|H'==#N!N$|H'==$N"N== D==0Lk*ImmI&Gmm$56O==0L|,J';<mm$56O== D==0Lk*I'FMM-4P5A7E8G;M5ACO ''T'2LG22G$$%22?2S$V\?KD4y1}((D# =$3$7$7$<S	=''T'=++D,2B2BCTVX2Y[_,2,D,D,2,G,GQ \T[   ++D,2B2BCY[]2^`i,2,D,D,2,G,GV aY`  ++D,2B2BCZ\^2_ah,2,G,G,2,J,JIW bZa  #++D,2B2BC_ac2d,8,2,G,G,2,J,JN\ g `g 
 !++D,2B2BCTVX2Y[e,2,J,J,2,M,MvW bZa  &++D,2B2BCUWY2Z\k,2,J,J,2,M,M{\ g_f  ++D,2B2BCTVX2Y[_,2,D,D,2,G,GQ \T[   ++D,2B2BCUWY2Z\e,2,D,D,2,G,GR ]U\  G$$###.F((d(333r   c                  `   t               } | j                  t        dddg      t        d      t        dd      t        ddg	      t        dd      t        dd      t        ddg	      t        dd      t        dd      t        ddg	      t        dd      t        dd
g d      t        dd      t        ddg	      t        dd             t        | d      }t	        ||j
                  d   |j
                  d   |j
                  d         }	 |j                  |j
                  d   |j
                  d          t        ||      \  }}|j                  ||       y # t        $ r8}|j                  t        |      t        j                                Y d }~y d }~ww xY w)NstrTr   )typerequiredaliases)r|   list)r|   elementsr   )r|   choicesrV   )rV   absentrW   ra   )r|   defaultr   )r   rC   r   rD   rZ   r[   rF   r\   r]   rG   r^   rU   r_   rH   r`   )argument_specsupports_check_modeipa_hostipa_portipa_prot)r   r   r   r   ipa_useripa_pass)usernamepassword)rv   hbacrule)msg	exception)r   updatedictr   r   rm   loginry   	exit_json	Exception	fail_jsonr	   	traceback
format_exc)r   r   rP   rv   r   es         r   mainr   K  s   %'MDedVHM%)u%5"?&*w&G#'Ve#D!%6E!B)-55')J&*&G$(fu$E,0eeW,M)-6E)J#	Kwx"?&*w&G#'Ve#D  F  /3F f$*MM*$=$*MM*$=(.j(ACF
MfmmJ7$mmJ7 	 	9"6628< MYq\Y5I5I5KLLMs   AE, ,	F-5.F((F-__main__)NNNNNN)
__future__r   r   r   r|   __metaclass__DOCUMENTATIONEXAMPLESRETURNr   ansible.module_utils.basicr   >ansible_collections.community.general.plugins.module_utils.ipar   r   +ansible.module_utils.common.text.convertersr	   Bansible_collections.community.general.plugins.module_utils.versionr
   r   rK   rS   ry   r   r>   rI   r   r   <module>r      s    A @gR!F
  4 g A [&Z	 &ZR ae)-#'&Oc4L!MH zF r   