-
Notifications
You must be signed in to change notification settings - Fork 23.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fortinet's FortiOS user adgrp #52831
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -0,0 +1,260 @@ | ||||||
#!/usr/bin/python | ||||||
from __future__ import (absolute_import, division, print_function) | ||||||
# Copyright 2019 Fortinet, Inc. | ||||||
# | ||||||
# This program is free software: you can redistribute it and/or modify | ||||||
# it under the terms of the GNU General Public License as published by | ||||||
# the Free Software Foundation, either version 3 of the License, or | ||||||
# (at your option) any later version. | ||||||
# | ||||||
# This program is distributed in the hope that it will be useful, | ||||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||||
# GNU General Public License for more details. | ||||||
# | ||||||
# You should have received a copy of the GNU General Public License | ||||||
# along with this program. If not, see <https://www.gnu.org/licenses/>. | ||||||
|
||||||
__metaclass__ = type | ||||||
|
||||||
ANSIBLE_METADATA = {'status': ['preview'], | ||||||
'supported_by': 'community', | ||||||
'metadata_version': '1.1'} | ||||||
|
||||||
DOCUMENTATION = ''' | ||||||
--- | ||||||
module: fortios_user_adgrp | ||||||
short_description: Configure FSSO groups in Fortinet's FortiOS and FortiGate. | ||||||
description: | ||||||
- This module is able to configure a FortiGate or FortiOS by allowing the | ||||||
user to set and modify user feature and adgrp category. | ||||||
Examples include all parameters and values need to be adjusted to datasources before usage. | ||||||
Tested with FOS v6.0.2 | ||||||
version_added: "2.8" | ||||||
author: | ||||||
- Miguel Angel Munoz (@mamunozgonzalez) | ||||||
- Nicolas Thomas (@thomnico) | ||||||
notes: | ||||||
- Requires fortiosapi library developed by Fortinet | ||||||
- Run as a local_action in your playbook | ||||||
requirements: | ||||||
- fortiosapi>=0.9.8 | ||||||
options: | ||||||
host: | ||||||
description: | ||||||
- FortiOS or FortiGate ip address. | ||||||
required: true | ||||||
username: | ||||||
description: | ||||||
- FortiOS or FortiGate username. | ||||||
required: true | ||||||
password: | ||||||
description: | ||||||
- FortiOS or FortiGate password. | ||||||
default: "" | ||||||
vdom: | ||||||
description: | ||||||
- Virtual domain, among those defined previously. A vdom is a | ||||||
virtual instance of the FortiGate that can be configured and | ||||||
used as a different unit. | ||||||
default: root | ||||||
https: | ||||||
description: | ||||||
- Indicates if the requests towards FortiGate must use HTTPS | ||||||
protocol | ||||||
type: bool | ||||||
default: true | ||||||
user_adgrp: | ||||||
description: | ||||||
- Configure FSSO groups. | ||||||
default: null | ||||||
suboptions: | ||||||
state: | ||||||
description: | ||||||
- Indicates whether to create or remove the object | ||||||
choices: | ||||||
- present | ||||||
- absent | ||||||
name: | ||||||
description: | ||||||
- Name. | ||||||
required: true | ||||||
server-name: | ||||||
description: | ||||||
- FSSO agent name. Source user.fsso.name. | ||||||
''' | ||||||
|
||||||
EXAMPLES = ''' | ||||||
- hosts: localhost | ||||||
vars: | ||||||
host: "192.168.122.40" | ||||||
username: "admin" | ||||||
password: "" | ||||||
vdom: "root" | ||||||
tasks: | ||||||
- name: Configure FSSO groups. | ||||||
fortios_user_adgrp: | ||||||
host: "{{ host }}" | ||||||
username: "{{ username }}" | ||||||
password: "{{ password }}" | ||||||
vdom: "{{ vdom }}" | ||||||
https: "False" | ||||||
user_adgrp: | ||||||
state: "present" | ||||||
name: "default_name_3" | ||||||
server-name: "<your_own_value> (source user.fsso.name)" | ||||||
''' | ||||||
|
||||||
RETURN = ''' | ||||||
build: | ||||||
description: Build number of the fortigate image | ||||||
returned: always | ||||||
type: str | ||||||
sample: '1547' | ||||||
http_method: | ||||||
description: Last method used to provision the content into FortiGate | ||||||
returned: always | ||||||
type: str | ||||||
sample: 'PUT' | ||||||
http_status: | ||||||
description: Last result given by FortiGate on last operation applied | ||||||
returned: always | ||||||
type: str | ||||||
sample: "200" | ||||||
mkey: | ||||||
description: Master key (id) used in the last call to FortiGate | ||||||
returned: success | ||||||
type: str | ||||||
sample: "id" | ||||||
name: | ||||||
description: Name of the table used to fulfill the request | ||||||
returned: always | ||||||
type: str | ||||||
sample: "urlfilter" | ||||||
path: | ||||||
description: Path of the table used to fulfill the request | ||||||
returned: always | ||||||
type: str | ||||||
sample: "webfilter" | ||||||
revision: | ||||||
description: Internal revision number | ||||||
returned: always | ||||||
type: str | ||||||
sample: "17.0.2.10658" | ||||||
serial: | ||||||
description: Serial number of the unit | ||||||
returned: always | ||||||
type: str | ||||||
sample: "FGVMEVYYQT3AB5352" | ||||||
status: | ||||||
description: Indication of the operation's result | ||||||
returned: always | ||||||
type: str | ||||||
sample: "success" | ||||||
vdom: | ||||||
description: Virtual domain used | ||||||
returned: always | ||||||
type: str | ||||||
sample: "root" | ||||||
version: | ||||||
description: Version of the FortiGate | ||||||
returned: always | ||||||
type: str | ||||||
sample: "v5.6.3" | ||||||
|
||||||
''' | ||||||
|
||||||
from ansible.module_utils.basic import AnsibleModule | ||||||
|
||||||
|
||||||
def login(data, fos): | ||||||
host = data['host'] | ||||||
username = data['username'] | ||||||
password = data['password'] | ||||||
|
||||||
fos.debug('on') | ||||||
if 'https' in data and not data['https']: | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can be modified as:
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I am a big fan of oneliners so I really like this suggestion. However we decided to do it the other way because we are always receiving comments about readability and avoid oneliners when possible. If it is not a showstopper could we leave it as it is? |
||||||
fos.https('off') | ||||||
else: | ||||||
fos.https('on') | ||||||
|
||||||
fos.login(host, username, password) | ||||||
|
||||||
|
||||||
def filter_user_adgrp_data(json): | ||||||
option_list = ['name', 'server-name'] | ||||||
dictionary = {} | ||||||
|
||||||
for attribute in option_list: | ||||||
if attribute in json and json[attribute] is not None: | ||||||
dictionary[attribute] = json[attribute] | ||||||
|
||||||
return dictionary | ||||||
|
||||||
|
||||||
def user_adgrp(data, fos): | ||||||
vdom = data['vdom'] | ||||||
user_adgrp_data = data['user_adgrp'] | ||||||
filtered_data = filter_user_adgrp_data(user_adgrp_data) | ||||||
|
||||||
if user_adgrp_data['state'] == "present": | ||||||
return fos.set('user', | ||||||
'adgrp', | ||||||
data=filtered_data, | ||||||
vdom=vdom) | ||||||
|
||||||
elif user_adgrp_data['state'] == "absent": | ||||||
return fos.delete('user', | ||||||
'adgrp', | ||||||
mkey=filtered_data['name'], | ||||||
vdom=vdom) | ||||||
|
||||||
|
||||||
def fortios_user(data, fos): | ||||||
login(data, fos) | ||||||
|
||||||
if data['user_adgrp']: | ||||||
resp = user_adgrp(data, fos) | ||||||
|
||||||
fos.logout() | ||||||
return not resp['status'] == "success", resp['status'] == "success", resp | ||||||
|
||||||
|
||||||
def main(): | ||||||
fields = { | ||||||
"host": {"required": True, "type": "str"}, | ||||||
"username": {"required": True, "type": "str"}, | ||||||
"password": {"required": False, "type": "str", "no_log": True}, | ||||||
"vdom": {"required": False, "type": "str", "default": "root"}, | ||||||
"https": {"required": False, "type": "bool", "default": True}, | ||||||
"user_adgrp": { | ||||||
"required": False, "type": "dict", | ||||||
"options": { | ||||||
"state": {"required": True, "type": "str", | ||||||
"choices": ["present", "absent"]}, | ||||||
"name": {"required": True, "type": "str"}, | ||||||
"server-name": {"required": False, "type": "str"} | ||||||
|
||||||
} | ||||||
} | ||||||
} | ||||||
|
||||||
module = AnsibleModule(argument_spec=fields, | ||||||
supports_check_mode=False) | ||||||
try: | ||||||
from fortiosapi import FortiOSAPI | ||||||
except ImportError: | ||||||
module.fail_json(msg="fortiosapi module is required") | ||||||
|
||||||
fos = FortiOSAPI() | ||||||
|
||||||
is_error, has_changed, result = fortios_user(module.params, fos) | ||||||
|
||||||
if not is_error: | ||||||
module.exit_json(changed=has_changed, meta=result) | ||||||
else: | ||||||
module.fail_json(msg="Error in repo", meta=result) | ||||||
|
||||||
|
||||||
if __name__ == '__main__': | ||||||
main() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ideally
state
option shall be used under module (i.e. fortios_user_adgrp), so wanted to verify if here other thanuser_adgrp
paramfortios_user_adgrp
supports other options as well or its planned in future release, if not then it would be better to usestate
option in conjunction with the module as:This is how other ansible modules are written.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, actually it is planned for the future and other modules already do it: https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/network/fortios/fortios_webfilter.py. There are two 'submodules': webfilter_url and webfilter_content