Initial commit

plugins/modules/cloud/cloudstack/cs_user.py

@@ -0,0 +1,445 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2015, René Moser <mail@renemoser.net>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['stableinterface'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = '''
+---
+module: cs_user
+short_description: Manages users on Apache CloudStack based clouds.
+description:
+    - Create, update, disable, lock, enable and remove users.
+author: René Moser (@resmo)
+options:
+  username:
+    description:
+      - Username of the user.
+    type: str
+    required: true
+  account:
+    description:
+      - Account the user will be created under.
+      - Required on I(state=present).
+    type: str
+  password:
+    description:
+      - Password of the user to be created.
+      - Required on I(state=present).
+      - Only considered on creation and will not be updated if user exists.
+    type: str
+  first_name:
+    description:
+      - First name of the user.
+      - Required on I(state=present).
+    type: str
+  last_name:
+    description:
+      - Last name of the user.
+      - Required on I(state=present).
+    type: str
+  email:
+    description:
+      - Email of the user.
+      - Required on I(state=present).
+    type: str
+  timezone:
+    description:
+      - Timezone of the user.
+    type: str
+  keys_registered:
+    description:
+      - If API keys of the user should be generated.
+      - "Note: Keys can not be removed by the API again."
+    type: bool
+    default: no
+  domain:
+    description:
+      - Domain the user is related to.
+    type: str
+    default: ROOT
+  state:
+    description:
+      - State of the user.
+      - C(unlocked) is an alias for C(enabled).
+    type: str
+    default: present
+    choices: [ present, absent, enabled, disabled, locked, unlocked ]
+  poll_async:
+    description:
+      - Poll async jobs until job has finished.
+    type: bool
+    default: yes
+extends_documentation_fragment:
+- community.general.cloudstack
+
+'''
+
+EXAMPLES = '''
+- name: Create an user in domain 'CUSTOMERS'
+  cs_user:
+    account: developers
+    username: johndoe
+    password: S3Cur3
+    last_name: Doe
+    first_name: John
+    email: john.doe@example.com
+    domain: CUSTOMERS
+  delegate_to: localhost
+
+- name: Lock an existing user in domain 'CUSTOMERS'
+  cs_user:
+    username: johndoe
+    domain: CUSTOMERS
+    state: locked
+  delegate_to: localhost
+
+- name: Disable an existing user in domain 'CUSTOMERS'
+  cs_user:
+    username: johndoe
+    domain: CUSTOMERS
+    state: disabled
+  delegate_to: localhost
+
+- name: Enable/unlock an existing user in domain 'CUSTOMERS'
+  cs_user:
+    username: johndoe
+    domain: CUSTOMERS
+    state: enabled
+  delegate_to: localhost
+
+- name: Remove an user in domain 'CUSTOMERS'
+  cs_user:
+    name: customer_xy
+    domain: CUSTOMERS
+    state: absent
+  delegate_to: localhost
+'''
+
+RETURN = '''
+---
+id:
+  description: UUID of the user.
+  returned: success
+  type: str
+  sample: 87b1e0ce-4e01-11e4-bb66-0050569e64b8
+username:
+  description: Username of the user.
+  returned: success
+  type: str
+  sample: johndoe
+fist_name:
+  description: First name of the user.
+  returned: success
+  type: str
+  sample: John
+last_name:
+  description: Last name of the user.
+  returned: success
+  type: str
+  sample: Doe
+email:
+  description: Emailof the user.
+  returned: success
+  type: str
+  sample: john.doe@example.com
+user_api_key:
+  description: API key of the user.
+  returned: success
+  type: str
+  sample: JLhcg8VWi8DoFqL2sSLZMXmGojcLnFrOBTipvBHJjySODcV4mCOo29W2duzPv5cALaZnXj5QxDx3xQfaQt3DKg
+user_api_secret:
+  description: API secret of the user.
+  returned: success
+  type: str
+  sample: FUELo3LB9fa1UopjTLPdqLv_6OXQMJZv9g9N4B_Ao3HFz8d6IGFCV9MbPFNM8mwz00wbMevja1DoUNDvI8C9-g
+account:
+  description: Account name of the user.
+  returned: success
+  type: str
+  sample: developers
+account_type:
+  description: Type of the account.
+  returned: success
+  type: str
+  sample: user
+timezone:
+  description: Timezone of the user.
+  returned: success
+  type: str
+  sample: enabled
+created:
+  description: Date the user was created.
+  returned: success
+  type: str
+  sample: Doe
+state:
+  description: State of the user.
+  returned: success
+  type: str
+  sample: enabled
+domain:
+  description: Domain the user is related.
+  returned: success
+  type: str
+  sample: ROOT
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.community.general.plugins.module_utils.cloudstack import (
+    AnsibleCloudStack,
+    cs_argument_spec,
+    cs_required_together,
+)
+
+
+class AnsibleCloudStackUser(AnsibleCloudStack):
+
+    def __init__(self, module):
+        super(AnsibleCloudStackUser, self).__init__(module)
+        self.returns = {
+            'username': 'username',
+            'firstname': 'first_name',
+            'lastname': 'last_name',
+            'email': 'email',
+            'secretkey': 'user_api_secret',
+            'apikey': 'user_api_key',
+            'timezone': 'timezone',
+        }
+        self.account_types = {
+            'user': 0,
+            'root_admin': 1,
+            'domain_admin': 2,
+        }
+        self.user = None
+
+    def get_account_type(self):
+        account_type = self.module.params.get('account_type')
+        return self.account_types[account_type]
+
+    def get_user(self):
+        if not self.user:
+            args = {
+                'domainid': self.get_domain('id'),
+                'fetch_list': True,
+            }
+
+            users = self.query_api('listUsers', **args)
+
+            if users:
+                user_name = self.module.params.get('username')
+                for u in users:
+                    if user_name.lower() == u['username'].lower():
+                        self.user = u
+                        break
+        return self.user
+
+    def enable_user(self):
+        user = self.get_user()
+        if not user:
+            user = self.present_user()
+
+        if user['state'].lower() != 'enabled':
+            self.result['changed'] = True
+            args = {
+                'id': user['id'],
+            }
+            if not self.module.check_mode:
+                res = self.query_api('enableUser', **args)
+                user = res['user']
+        return user
+
+    def lock_user(self):
+        user = self.get_user()
+        if not user:
+            user = self.present_user()
+
+        # we need to enable the user to lock it.
+        if user['state'].lower() == 'disabled':
+            user = self.enable_user()
+
+        if user['state'].lower() != 'locked':
+            self.result['changed'] = True
+
+            args = {
+                'id': user['id'],
+            }
+
+            if not self.module.check_mode:
+                res = self.query_api('lockUser', **args)
+                user = res['user']
+
+        return user
+
+    def disable_user(self):
+        user = self.get_user()
+        if not user:
+            user = self.present_user()
+
+        if user['state'].lower() != 'disabled':
+            self.result['changed'] = True
+            args = {
+                'id': user['id'],
+            }
+            if not self.module.check_mode:
+                user = self.query_api('disableUser', **args)
+
+                poll_async = self.module.params.get('poll_async')
+                if poll_async:
+                    user = self.poll_job(user, 'user')
+        return user
+
+    def present_user(self):
+        required_params = [
+            'account',
+            'email',
+            'password',
+            'first_name',
+            'last_name',
+        ]
+        self.module.fail_on_missing_params(required_params=required_params)
+
+        user = self.get_user()
+        if user:
+            user = self._update_user(user)
+        else:
+            user = self._create_user(user)
+        return user
+
+    def _get_common_args(self):
+        return {
+            'firstname': self.module.params.get('first_name'),
+            'lastname': self.module.params.get('last_name'),
+            'email': self.module.params.get('email'),
+            'timezone': self.module.params.get('timezone'),
+        }
+
+    def _create_user(self, user):
+        self.result['changed'] = True
+
+        args = self._get_common_args()
+        args.update({
+            'account': self.get_account(key='name'),
+            'domainid': self.get_domain('id'),
+            'username': self.module.params.get('username'),
+            'password': self.module.params.get('password'),
+        })
+
+        if not self.module.check_mode:
+            res = self.query_api('createUser', **args)
+            user = res['user']
+
+            # register user api keys
+            if self.module.params.get('keys_registered'):
+                res = self.query_api('registerUserKeys', id=user['id'])
+                user.update(res['userkeys'])
+
+        return user
+
+    def _update_user(self, user):
+        args = self._get_common_args()
+        args.update({
+            'id': user['id'],
+        })
+
+        if self.has_changed(args, user):
+            self.result['changed'] = True
+
+            if not self.module.check_mode:
+                res = self.query_api('updateUser', **args)
+
+                user = res['user']
+
+        # register user api keys
+        if 'apikey' not in user and self.module.params.get('keys_registered'):
+            self.result['changed'] = True
+
+            if not self.module.check_mode:
+                res = self.query_api('registerUserKeys', id=user['id'])
+                user.update(res['userkeys'])
+        return user
+
+    def absent_user(self):
+        user = self.get_user()
+        if user:
+            self.result['changed'] = True
+
+            if not self.module.check_mode:
+                self.query_api('deleteUser', id=user['id'])
+
+        return user
+
+    def get_result(self, user):
+        super(AnsibleCloudStackUser, self).get_result(user)
+        if user:
+            if 'accounttype' in user:
+                for key, value in self.account_types.items():
+                    if value == user['accounttype']:
+                        self.result['account_type'] = key
+                        break
+
+            # secretkey has been removed since CloudStack 4.10 from listUsers API
+            if self.module.params.get('keys_registered') and 'apikey' in user and 'secretkey' not in user:
+                user_keys = self.query_api('getUserKeys', id=user['id'])
+                if user_keys:
+                    self.result['user_api_secret'] = user_keys['userkeys'].get('secretkey')
+
+        return self.result
+
+
+def main():
+    argument_spec = cs_argument_spec()
+    argument_spec.update(dict(
+        username=dict(required=True),
+        account=dict(),
+        state=dict(choices=['present', 'absent', 'enabled', 'disabled', 'locked', 'unlocked'], default='present'),
+        domain=dict(default='ROOT'),
+        email=dict(),
+        first_name=dict(),
+        last_name=dict(),
+        password=dict(no_log=True),
+        timezone=dict(),
+        keys_registered=dict(type='bool', default=False),
+        poll_async=dict(type='bool', default=True),
+    ))
+
+    module = AnsibleModule(
+        argument_spec=argument_spec,
+        required_together=cs_required_together(),
+        supports_check_mode=True
+    )
+
+    acs_acc = AnsibleCloudStackUser(module)
+
+    state = module.params.get('state')
+
+    if state == 'absent':
+        user = acs_acc.absent_user()
+
+    elif state in ['enabled', 'unlocked']:
+        user = acs_acc.enable_user()
+
+    elif state == 'disabled':
+        user = acs_acc.disable_user()
+
+    elif state == 'locked':
+        user = acs_acc.lock_user()
+
+    else:
+        user = acs_acc.present_user()
+
+    result = acs_acc.get_result(user)
+
+    module.exit_json(**result)
+
+
+if __name__ == '__main__':
+    main()