Add module ldap_attrs; deprecate ldap_attr

[Noles]

SUMMARY

The current "ldap_attr" module does not support ldap attribute insertations or deletions with objectClass dependencies.

ISSUE TYPE

• New Module Pull Request

COMPONENT NAME

ldap_attrs

ANSIBLE VERSION

ansible 2.8.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/akorinek/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.13 (default, Jan 19 2017, 14:48:08) [GCC 6.3.0 20170118]

ADDITIONAL INFORMATION

For example, if you have the following ldap entry:

dn: dc=test,dc=local
o: test.local
dc: test
objectClass: top
objectClass: dcObject
objectClass: organization

and you like to add:

gosaAclEntry: 0:subtree:Y249YWRtaW4sb3U9YWxjcm9sZXMsZGM9dGVzdCxkYz1sb2NhbAo=
 :dWlkPWZkLWFkbWluLG91PXBlb3BsZSxkYz10ZXN0LGRjPWxvY2FsCg==

you need the additional objectClass gosaAcl.

But because of the schema definition:

objectclass ( 1.3.6.1.4.1.10098.1.2.1.19.18 NAME 'gosaAcl'
  DESC 'GOsa - ACL container to define single ACLs'
  SUP top AUXILIARY
  MUST ( gosaAclEntry  ))

gosaAclEntry must be added on gosaAcl add as well.

With the ldap_attr module these insertation is not possible because every entry will be added one by one and can not be combined in one run.
This results in:
OBJECT_CLASS_VIOLATION: {'info': "object class 'gosaAcl' requires attribute 'gosaAclEntry'", 'desc': 'Object class violation'}
and
OBJECT_CLASS_VIOLATION: {'info': "attribute 'gosaAclEntry' not allowed", 'desc': 'Object class violation'}

For backward compatibility I created a new module with different configuration parameters.

[ansibot]

cc @jtyr
click here for bot help

[Xaroth]

I'm testing this module under python3 in my own test lab; apart from the minor issue I found, it seems to work like a charm. Mind, the current ldap_attr and ldap_entry currently have the same bytes-vs-str issue, so it might be worth a separate PR to fix the py3 compatibility simultaneously

[Noles]

Good point. I never verified the module with py3. But as I remember this code block comes directly from current ldap_attr module. So it should be indeed fixed there and in ldap_entry as well.

[CtrlC-Root]

Actually I think the proper way would be to modify line 193 to from ansible.module_utils._text import to_native, to_bytes and then use to_bytes() instead of six.b().

[Xaroth]

@CtrlC-Root using ansible natives is better, yes.

[drybjed]

@Noles, @jtyr: I'd like to ask what are the plans for inclusion of this module in Ansible?

I think that the ldap_attrs module works much better with ldap_entry module than the current ldap_attr module found in Ansible. You can see this in the debops.ldap role and the debops.slapd role where I was able to define a set of tasks performed in the LDAP directory itself using just one YAML list.

I implemented support for the X-ORDERED extension in the ldap_attrs module which should make LDAP ACL configuration much easier to manage, but it seems that @Noles wants me to create a new PR directly... Since then I'm considering a more secure LDAP environment with TLS Client Certificates being a requirement, which would require additional parameters in the ldap_entry and ldap_attrs modules. Because this PR is now outdated, and parts of the Ansible modules related to python-ldap authentication have been moved to a different file, should I just create a new PR with ldap_attrs and updated LDAP authentication in Ansible that supports Client Certificates?

[Noles]

I rebased my changes but without any client certificate extensions. I think its better to realize this step by step.

[gundalow]

Thank you everybody for the work that's gone into this.
I've just spoken with drybjed, he has an updated version of this code that's used in debops.ldap and debops.slapd roles and supports the X-ORDERED extension as well as other bug fixes.

So I'm going to close this and @drybjed will raise a new PR

[drybjed]

@gundalow The new pull request: #62701