Fix issue when there is more than one API user

roles/wazuh/ansible-wazuh-manager/files/create_user.py

@@ -29,7 +29,7 @@
 def read_user_file(path=USER_FILE_PATH):
     with open(path) as user_file:
         data = json.load(user_file)
-        return data["username"], data["password"]
+        return [(item["username"], item["password"]) for item in data]
 
 
 def db_users():
@@ -41,19 +41,21 @@ def db_roles():
     roles_result = get_roles()
     return {role["name"]: role["id"] for role in roles_result.affected_items}
 
+
 def disable_user(uid):
     random_pass = "".join(
-                random.choices(
-                    string.ascii_uppercase
-                    + string.ascii_lowercase
-                    + string.digits
-                    + SPECIAL_CHARS,
-                    k=8,
-                )
-            )
-    # assure there must be at least one character from each group
-    random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
-    random_pass = ''.join(random.sample(random_pass,len(random_pass)))
+        random.choices(
+            string.ascii_uppercase
+            + string.ascii_lowercase
+            + string.digits
+            + SPECIAL_CHARS,
+            k=8,
+        )
+    )
+    # Assure there must be at least one character from each group
+    random_pass = random_pass + ''.join([random.choice(chars) for chars in [
+                                        string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
+    random_pass = ''.join(random.sample(random_pass, len(random_pass)))
     update_user(
         user_id=[
             str(uid),
@@ -64,39 +66,42 @@ def disable_user(uid):
 
 if __name__ == "__main__":
     if not os.path.exists(USER_FILE_PATH):
-        # abort if no user file detected
+        # Abort if no user file detected
         sys.exit(0)
-    username, password = read_user_file()
+    users = read_user_file()
 
-    # create RBAC database
+    # Create RBAC database
     create_rbac_db()
 
     initial_users = db_users()
-    if username not in initial_users:
-        # create a new user
-        create_user(username=username, password=password)
-        users = db_users()
-        uid = users[username]
-        roles = db_roles()
-        rid = roles["administrator"]
-        set_user_role(
-            user_id=[
-                str(uid),
-            ],
-            role_ids=[
-                str(rid),
-            ],
-        )
-    else:
-        # modify an existing user ("wazuh" or "wazuh-wui")
-        uid = initial_users[username]
-        update_user(
-            user_id=[
-                str(uid),
-            ],
-            password=password,
-        )
-    # disable unused default users
-    #for def_user in ['wazuh', 'wazuh-wui']:
-    #    if def_user != username:
-    #        disable_user(initial_users[def_user])
+    for username, password in users:
+        if username not in initial_users:
+            # Create a new user
+            create_user(username=username, password=password)
+            new_users = db_users()
+            uid = new_users[username]
+            roles = db_roles()
+            rid = roles["administrator"]
+            set_user_role(
+                user_id=[
+                    str(uid),
+                ],
+                role_ids=[
+                    str(rid),
+                ],
+            )
+            print(f"API user '{username}' created successfully.")
+        else:
+            # Modify an existing user ("wazuh" or "wazuh-wui")
+            uid = initial_users[username]
+            update_user(
+                user_id=[
+                    str(uid),
+                ],
+                password=password,
+            )
+            print(f"API user '{username}' updated successfully.")
+    # Disable unused default users
+    # for def_user in ['wazuh', 'wazuh-wui']:
+    #     if def_user != username:
+    #         disable_user(initial_users[def_user])

roles/wazuh/ansible-wazuh-manager/tasks/main.yml

@@ -1,5 +1,4 @@
 ---
-
 - name: "Install dependencies"
   package:
     name:
@@ -9,7 +8,7 @@
       - curl
     state: present
   register: package_status
-  until: "package_status is not failed"  
+  until: "package_status is not failed"
   retries: 10
   delay: 10
 
@@ -26,9 +25,9 @@
 
 - name: Overlay wazuh_manager_config on top of defaults
   set_fact:
-    wazuh_manager_config: '{{ wazuh_manager_config_defaults | combine(config_layer, recursive=True) }}'
+    wazuh_manager_config: "{{ wazuh_manager_config_defaults | combine(config_layer, recursive=True) }}"
   vars:
-    config_layer: '{{ wazuh_manager_config | default({}) }}'
+    config_layer: "{{ wazuh_manager_config | default({}) }}"
   when: wazuh_manager_config_overlay | bool
 
 - include_tasks: "RedHat.yml"
@@ -289,10 +288,8 @@
     - name: Execute create_user script
       script:
         chdir: "{{ wazuh_dir }}/framework/scripts/"
-        cmd: create_user.py --username "{{ item.username }}" --password "{{ item.password }}"
+        cmd: create_user.py
         executable: "{{ wazuh_dir }}/framework/python/bin/python3"
-      with_items:
-        - "{{ wazuh_api_users }}"
 
   tags:
     - config_api_users

roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2

@@ -1,4 +1,6 @@
-
+[
 {% for api in wazuh_api_users %}
-{"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"}
-{% endfor %}
+  {"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"}{% if not loop.last %},{% endif %}
+
+{% endfor %}
+]