Ansible is unable to configure multiple permitopen authorized_key options

[mulander]

The ansible documentation states that:

 A string of ssh key options to be prepended to the key in the authorized_keys file

source: http://docs.ansible.com/authorized_key_module.html

The ssh documentation states:

permitopen="host:port"
Limit local port forwarding with ssh(1) -L such that it may only connect to the specified host and port. IPv6 addresses can be specified by enclosing the address in square brackets. Multiple permitopen options may be applied separated by commas. No pattern matching is performed on the specified hostnames, they must be literal domains or addresses. A port specification of * matches any port.

With the above in mind I'm testing the following ansible rule:

  authorized_key: user={{ item }}
                  key_options='no-agent-forwarding,no-X11-forwarding,permitopen="10.9.8.1:8080",permitopen="10.9.8.1:9001",permitopen="10.9.8.1:7767",permitopen="10.9.8.1:9900",permitopen="localhost:3001",permitopen="localhost:3002",permitopen="localhost:3003"'
                  key="{{ lookup('file', 'public_keys/' + item + '.pub') }}"
                  path="/home/{{ item }}/.ssh/authorized_keys"
                  manage_dir=no
                  state=present

This results in a key being added but with subsequent permitopen options being overwritten by the last parsed value:

root@build:~# cat /home/mulander/.ssh/authorized_keys 
no-agent-forwarding,no-X11-forwarding,permitopen="localhost:3003",permitopen="localhost:3003",permitopen="localhost:3003",permitopen="localhost:3003",permitopen="localhost:3003",permitopen="localhost:3003",permitopen="localhost:3003" ssh-rsa AAA

Please notice that all hosts and ports were replaced by localhost:3003 which is the last permitopen entry. This overwrites both the host & port. The issue is most probably caused by parsing the values into a dict using the permitopen as the key. The value should be kept as an array in order not to loose configuration.

Tested on ansible 1.7.2

This was initially reported as #11559 on the ansible main repository

[linuxdynasty]

@mulander, I added a fix for this module. Please test it out when you have a chance.

[linuxdynasty]

@mulander, I added a fix for this module. Please test it out when you have a chance.

[jctanner]

@linuxdynasty are you going to send that as a pull request?

[jctanner]

@linuxdynasty are you going to send that as a pull request?

[linuxdynasty]

#3573 is the PR @jctanner

[linuxdynasty]

#3573 is the PR @jctanner