Add module to configure Pure Storage FlashArray Directory Services

lib/ansible/modules/storage/purestorage/purefa_ds.py

@@ -0,0 +1,267 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# (c) 2018, Simon Dodsley (simon@purestorage.com)
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+DOCUMENTATION = r'''
+---
+module: purefa_ds
+version_added: '2.6'
+short_description: Configure FlashArray Directory Service
+description:
+- Set or erase configuration for the directory service. There is no facility
+  to SSL certificates at this time. Use the FlashArray GUI for this
+  additional configuration work.
+- To modify an existing directory service configuration you must first delete
+  an exisitng configuration and then recreate with new settings.
+author:
+- Simon Dodsley (@sdodsley)
+options:
+  state:
+    description:
+    - Create or delete directory service configuration
+    default: present
+    choices: [ absent, present ]
+  enable:
+    description:
+    - Whether to enable or disable directory service support.
+    default: false
+    type: bool
+  uri:
+    description:
+    - A list of up to 30 URIs of the directory servers. Each URI must include
+      the scheme ldap:// or ldaps:// (for LDAP over SSL), a hostname, and a
+      domain name or IP address. For example, ldap://ad.company.com configures
+      the directory service with the hostname "ad" in the domain "company.com"
+      while specifying the unencrypted LDAP protocol.
+  base_dn:
+    description:
+    - Sets the base of the Distinguished Name (DN) of the directory service
+      groups. The base should consist of only Domain Components (DCs). The
+      base_dn will populate with a default value when a URI is entered by
+      parsing domain components from the URI. The base DN should specify DC=
+      for each domain component and multiple DCs should be separated by commas.
+    required: true
+  bind_password:
+    description:
+    - Sets the password of the bind_user user name account.
+  bind_user:
+    description:
+    - Sets the user name that can be used to bind to and query the directory.
+    - For Active Directory, enter the username - often referred to as
+      sAMAccountName or User Logon Name - of the account that is used to
+      perform directory lookups.
+    - For OpenLDAP, enter the full DN of the user.
+  group_base:
+    description:
+    - Specifies where the configured groups are located in the directory
+      tree. This field consists of Organizational Units (OUs) that combine
+      with the base DN attribute and the configured group CNs to complete
+      the full Distinguished Name of the groups. The group base should
+      specify OU= for each OU and multiple OUs should be separated by commas.
+      The order of OUs is important and should get larger in scope from left
+      to right. Each OU should not exceed 64 characters in length.
+  ro_group:
+    description:
+    - Sets the common Name (CN) of the configured directory service group
+      containing users with read-only privileges on the FlashArray. This
+      name should be just the Common Name of the group without the CN=
+      specifier. Common Names should not exceed 64 characters in length.
+  sa_group:
+    description:
+    - Sets the common Name (CN) of the configured directory service group
+      containing administrators with storage-related privileges on the
+      FlashArray. This name should be just the Common Name of the group
+      without the CN= specifier. Common Names should not exceed 64
+      characters in length.
+  aa_group:
+    description:
+    - Sets the common Name (CN) of the directory service group containing
+      administrators with full privileges when managing the FlashArray.
+      The name should be just the Common Name of the group without the
+      CN= specifier. Common Names should not exceed 64 characters in length.
+extends_documentation_fragment:
+- purestorage.fa
+'''
+
+EXAMPLES = r'''
+- name: Delete exisitng directory service
+  purefa_ds:
+    state: absent
+    fa_url: 10.10.10.2
+    api_token: e31060a7-21fc-e277-6240-25983c6c4592
+
+- name: Create directory service (disabled)
+  purefa_ds:
+    uri: "ldap://lab.purestorage.com"
+    base_dn: "DC=lab,DC=purestorage,DC=com"
+    bind_user: Administrator
+    bind_password: password
+    group_base: "OU=Pure-Admin"
+    ro_group: PureReadOnly
+    sa_group: PureStorage
+    aa_group: PureAdmin
+    fa_url: 10.10.10.2
+    api_token: e31060a7-21fc-e277-6240-25983c6c4592
+
+- name: Enable exisitng directory service
+  purefa_ds:
+    enable: true
+    fa_url: 10.10.10.2
+    api_token: e31060a7-21fc-e277-6240-25983c6c4592
+
+- name: Disable exisitng directory service
+  purefa_ds:
+    enable: false
+    fa_url: 10.10.10.2
+    api_token: e31060a7-21fc-e277-6240-25983c6c4592
+
+- name: Create directory service (enabled)
+  purefa_ds:
+    enable: true
+    uri: "ldap://lab.purestorage.com"
+    base_dn: "DC=lab,DC=purestorage,DC=com"
+    bind_user: Administrator
+    bind_password: password
+    group_base: "OU=Pure-Admin"
+    ro_group: PureReadOnly
+    sa_group: PureStorage
+    aa_group: PureAdmin
+    fa_url: 10.10.10.2
+    api_token: e31060a7-21fc-e277-6240-25983c6c4592
+'''
+
+RETURN = r'''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.pure import get_system, purefa_argument_spec
+
+
+def update_ds(module, array):
+    """Update Directory Service"""
+    changed = False
+    module.exit_json(changed=changed)
+
+
+def enable_ds(module, array):
+    """Enable Directory Service"""
+    changed = False
+    try:
+        array.enable_directory_service()
+        changed = True
+    except:
+        module.fail_json(msg='Enable Directory Service failed: Check Configuration')
+    module.exit_json(changed=changed)
+
+
+def disable_ds(module, array):
+    """Disable Directory Service"""
+    """Disable Directory Service"""
+    changed = False
+    try:
+        array.disable_directory_service()
+        changed = True
+    except:
+        module.fail_json(msg='Disable Directory Service failed')
+    module.exit_json(changed=changed)
+
+
+def delete_ds(module, array):
+    """Delete Directory Service"""
+    changed = False
+    try:
+        array.set_directory_service(enabled=False)
+        array.set_directory_service(uri=[''],
+                                    base_dn="",
+                                    group_base="",
+                                    bind_user="",
+                                    bind_password="",
+                                    readonly_group="",
+                                    storage_admin_group="",
+                                    array_admin_group="",
+                                    certificate="")
+        changed = True
+    except:
+        module.fail_json(msg='Delete Directory Service failed')
+    module.exit_json(changed=changed)
+
+
+def create_ds(module, array):
+    """Create Directory Service"""
+    changed = False
+    groups_rule = [not module.params['ro_group'],
+                   not module.params['sa_group'],
+                   not module.params['aa_group']]
+
+    if all(groups_rule):
+        module.fail_json(msg='At least one group must be configured')
+    try:
+        array.set_directory_service(uri=module.params['uri'],
+                                    base_dn=module.params['base_dn'],
+                                    group_base=module.params['group_base'],
+                                    bind_user=module.params['bind_user'],
+                                    bind_password=module.params['bind_password'],
+                                    readonly_group=module.params['ro_group'],
+                                    storage_admin_group=module.params['sa_group'],
+                                    array_admin_group=module.params['aa_group'])
+        array.set_directory_service(enabled=module.params['enable'])
+        changed = True
+    except:
+        module.fail_json(msg='Create Directory Service failed: Check configuration')
+    module.exit_json(changed=changed)
+
+
+def main():
+    argument_spec = purefa_argument_spec()
+    argument_spec.update(dict(
+        uri=dict(type='list'),
+        state=dict(type='str', default='present', choices=['absent', 'present']),
+        enable=dict(type='bool', default=False),
+        bind_password=dict(type='str', no_log=True),
+        bind_user=dict(type='str'),
+        base_dn=dict(type='str'),
+        group_base=dict(type='str'),
+        ro_group=dict(type='str'),
+        sa_group=dict(type='str'),
+        aa_group=dict(type='str'),
+    ))
+
+    required_together = [['uri', 'bind_password', 'bind_user',
+                          'base_dn', 'group_base']]
+
+    module = AnsibleModule(argument_spec,
+                           required_together=required_together,
+                           supports_check_mode=False)
+
+    state = module.params['state']
+    array = get_system(module)
+    ds_exists = False
+    dirserv = array.get_directory_service()
+    ds_enabled = dirserv['enabled']
+    if dirserv['base_dn']:
+        ds_exists = True
+
+    if state == 'absent' and ds_exists:
+        delete_ds(module, array)
+    elif ds_exists and module.params['enable'] and ds_enabled:
+        update_ds(module, array)
+    elif ds_exists and not module.params['enable'] and ds_enabled:
+        disable_ds(module, array)
+    elif ds_exists and module.params['enable'] and not ds_enabled:
+        enable_ds(module, array)
+    elif not ds_exists and state == 'present':
+        create_ds(module, array)
+    else:
+        module.exit_json(changed=False)
+
+if __name__ == '__main__':
+    main()