
    Vh                         d dl mZmZmZ eZdZdZdZd dl	Z	d dl
mZ d dlmZmZ d dlmZ  G d	 d
e      ZddZd Zd Zd Zedk(  r e        yy)    )absolute_importdivisionprint_functiona  
module: ipa_vault
author: Juan Manuel Parrilla (@jparrill)
short_description: Manage FreeIPA vaults
description:
  - Add, modify and delete vaults and secret vaults.
  - KRA service should be enabled to use this module.
attributes:
  check_mode:
    support: full
  diff_mode:
    support: none
options:
  cn:
    description:
      - Vault name.
      - Can not be changed as it is the unique identifier.
    required: true
    aliases: ["name"]
    type: str
  description:
    description:
      - Description.
    type: str
  ipavaulttype:
    description:
      - Vault types are based on security level.
    default: "symmetric"
    choices: ["asymmetric", "standard", "symmetric"]
    aliases: ["vault_type"]
    type: str
  ipavaultpublickey:
    description:
      - Public key.
    aliases: ["vault_public_key"]
    type: str
  ipavaultsalt:
    description:
      - Vault Salt.
    aliases: ["vault_salt"]
    type: str
  username:
    description:
      - Any user can own one or more user vaults.
      - Mutually exclusive with O(service).
    aliases: ["user"]
    type: list
    elements: str
  service:
    description:
      - Any service can own one or more service vaults.
      - Mutually exclusive with O(user).
    type: str
  state:
    description:
      - State to ensure.
    default: "present"
    choices: ["absent", "present"]
    type: str
  replace:
    description:
      - Force replace the existent vault on IPA server.
    type: bool
    default: false
    choices: ["True", "False"]
  validate_certs:
    description:
      - Validate IPA server certificates.
    type: bool
    default: true
extends_documentation_fragment:
  - community.general.ipa.documentation
  - community.general.attributes
a  
- name: Ensure vault is present
  community.general.ipa_vault:
    name: vault01
    vault_type: standard
    user: user01
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure vault is present for Admin user
  community.general.ipa_vault:
    name: vault01
    vault_type: standard
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure vault is absent
  community.general.ipa_vault:
    name: vault01
    vault_type: standard
    user: user01
    state: absent
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Modify vault if already exists
  community.general.ipa_vault:
    name: vault01
    vault_type: standard
    description: "Vault for test"
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret
    replace: true

- name: Get vault info if already exists
  community.general.ipa_vault:
    name: vault01
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret
zU
vault:
  description: Vault as returned by IPA API.
  returned: always
  type: dict
N)AnsibleModule)	IPAClientipa_argument_spec)	to_nativec                   6     e Zd Z fdZd Zd Zd Zd Z xZS )VaultIPAClientc                 2    t         t        |   ||||       y )N)superr   __init__)selfmodulehostportprotocol	__class__s        o/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/general/plugins/modules/ipa_vault.pyr   zVaultIPAClient.__init__   s    nd,VT4J    c                 0    | j                  dd d|d      S )N
vault_findT)allcnmethodnameitem
_post_jsonr   r   s     r   r   zVaultIPAClient.vault_find   s    lDX\D]^^r   c                 *    | j                  d||      S )Nvault_add_internalr   r   r   r   r   s      r   r#   z!VaultIPAClient.vault_add_internal       &:DQQr   c                 *    | j                  d||      S )Nvault_mod_internalr   r   r$   s      r   r'   z!VaultIPAClient.vault_mod_internal   r%   r   c                 (    | j                  d|      S )N	vault_del)r   r   r   r!   s     r   r)   zVaultIPAClient.vault_del   s    k==r   )	__name__
__module____qualname__r   r   r#   r'   r)   __classcell__)r   s   @r   r   r      s     K_RR>r   r   c                 P    i }| | |d<   |||d<   |||d<   |||d<   |||d<   |S )Ndescriptionipavaulttypeipavaultsaltipavaultpublickeyservice )r/   
vault_type
vault_saltvault_public_keyr3   vaults         r   get_vault_dictr9      s]    E*m *n *n#%5!""iLr   c                 (    | j                  ||      S )N)ipa_datamodule_data)get_diff)client	ipa_vaultmodule_vaultr   s       r   get_vault_diffrA      s    ??I<?HHr   c                    | j                   d   }| j                   d   }| j                   d   }| j                   d   }t        | j                   d   | j                   d   | j                   d   | j                   d   | j                   d	   
      }|j                  |      }d}|dk(  r|s"d}| j                  s|j	                  ||      }n~|r|t        ||||       }	t        |	      dkD  r`d}| j                  sRi }
|	D ]  }|j                  |      |
|<    |j                  ||
       n!|rd}| j                  s|j                  |       ||j                  |      fS )Nstater   usernamereplacer/   r0   r1   r2   r3   )r/   r5   r6   r7   r3   )r   FpresentT)r   r   )r   r   )
paramsr9   r   
check_moder#   rA   lengetr'   r)   )r   r>   rC   r   userrE   r@   r?   changeddiffdatakeys               r   ensurerP      so   MM'"E==D==$DmmI&G!fmmM.JW]WdWdesWt-3]]>-J39==AT3U*0--	*BDL !!t!,IG	G$$"55d5N	 %fivNt9q="G!,,!#' >C(4(8(8(=DI>11t$1G G$$  &F%%4%000r   c                     t               } | j                  t        dddg      t        d      t        ddg ddg	      t        dd
g      t        ddg      t        d      t        ddddg      t        ddddg      t        dddg      	       t        | dddgg      }t	        ||j
                  d   |j
                  d   |j
                  d         }	 |j                  |j
                  d   |j
                  d          t        ||      \  }}|j                  ||        y # t        $ r8}|j                  t        |      t        j                         !       Y d }~y d }~ww xY w)"NstrTr   )typerequiredaliases)rS   	symmetric)standardrV   
asymmetricr5   )rS   defaultchoicesrU   r6   )rS   rU   r7   boolF)rS   rY   rZ   rF   absentlistrK   )rS   elementsrU   )	r   r/   r0   r1   r2   r3   rE   rC   rD   rD   r3   )argument_specsupports_check_modemutually_exclusiveipa_hostipa_portipa_prot)r   r   r   r   ipa_useripa_pass)rD   password)rL   r8   )msg	exception)r   updatedictr   r   rG   loginrP   	exit_json	Exception	fail_jsonr	   	traceback
format_exc)r_   r   r>   rL   r8   es         r   mainrs      sr   %'MDedVHM%)u%5&*{3Zeqdr't&*~&N+/UEWDX+Y!%5!1!%654QV-!X#	IW_K`a"&FUVH"U  	W /30:I/F.GIF 6!'z!:!'z!:%+]]:%>@FMfmmJ7$mmJ7 	 	9/6 MYq\Y5I5I5KLLMs   AD/ /	E08.E++E0__main__)NNNNN)
__future__r   r   r   rS   __metaclass__DOCUMENTATIONEXAMPLESRETURNrp   ansible.module_utils.basicr   >ansible_collections.community.general.plugins.module_utils.ipar   r   +ansible.module_utils.common.text.convertersr	   r   r9   rA   rP   rs   r*   r4   r   r   <module>r}      sp    A @IV,\
  4 g A>Y >" I%1PM< zF r   