Initial commit

plugins/modules/cloud/univention/udm_dns_record.py

@@ -0,0 +1,188 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+# Copyright: (c) 2016, Adfinis SyGroup AG
+# Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = '''
+---
+module: udm_dns_record
+author:
+- Tobias Rüetschi (@keachi)
+short_description: Manage dns entries on a univention corporate server
+description:
+    - "This module allows to manage dns records on a univention corporate server (UCS).
+       It uses the python API of the UCS to create a new object or edit it."
+requirements:
+    - Python >= 2.6
+    - Univention
+options:
+    state:
+        required: false
+        default: "present"
+        choices: [ present, absent ]
+        description:
+            - Whether the dns record is present or not.
+    name:
+        required: true
+        description:
+            - "Name of the record, this is also the DNS record. E.g. www for
+               www.example.com."
+    zone:
+        required: true
+        description:
+            - Corresponding DNS zone for this record, e.g. example.com.
+    type:
+        required: true
+        choices: [ host_record, alias, ptr_record, srv_record, txt_record ]
+        description:
+            - "Define the record type. C(host_record) is a A or AAAA record,
+               C(alias) is a CNAME, C(ptr_record) is a PTR record, C(srv_record)
+               is a SRV record and C(txt_record) is a TXT record."
+    data:
+        required: false
+        default: []
+        description:
+            - "Additional data for this record, e.g. ['a': '192.0.2.1'].
+               Required if C(state=present)."
+'''
+
+
+EXAMPLES = '''
+# Create a DNS record on a UCS
+- udm_dns_record:
+    name: www
+    zone: example.com
+    type: host_record
+    data:
+      - a: 192.0.2.1
+'''
+
+
+RETURN = '''# '''
+
+HAVE_UNIVENTION = False
+try:
+    from univention.admin.handlers.dns import (
+        forward_zone,
+        reverse_zone,
+    )
+    HAVE_UNIVENTION = True
+except ImportError:
+    pass
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.community.general.plugins.module_utils.univention_umc import (
+    umc_module_for_add,
+    umc_module_for_edit,
+    ldap_search,
+    base_dn,
+    config,
+    uldap,
+)
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            type=dict(required=True,
+                      type='str'),
+            zone=dict(required=True,
+                      type='str'),
+            name=dict(required=True,
+                      type='str'),
+            data=dict(default=[],
+                      type='dict'),
+            state=dict(default='present',
+                       choices=['present', 'absent'],
+                       type='str')
+        ),
+        supports_check_mode=True,
+        required_if=([
+            ('state', 'present', ['data'])
+        ])
+    )
+
+    if not HAVE_UNIVENTION:
+        module.fail_json(msg="This module requires univention python bindings")
+
+    type = module.params['type']
+    zone = module.params['zone']
+    name = module.params['name']
+    data = module.params['data']
+    state = module.params['state']
+    changed = False
+    diff = None
+
+    obj = list(ldap_search(
+        '(&(objectClass=dNSZone)(zoneName={0})(relativeDomainName={1}))'.format(zone, name),
+        attr=['dNSZone']
+    ))
+
+    exists = bool(len(obj))
+    container = 'zoneName={0},cn=dns,{1}'.format(zone, base_dn())
+    dn = 'relativeDomainName={0},{1}'.format(name, container)
+
+    if state == 'present':
+        try:
+            if not exists:
+                so = forward_zone.lookup(
+                    config(),
+                    uldap(),
+                    '(zone={0})'.format(zone),
+                    scope='domain',
+                ) or reverse_zone.lookup(
+                    config(),
+                    uldap(),
+                    '(zone={0})'.format(zone),
+                    scope='domain',
+                )
+                obj = umc_module_for_add('dns/{0}'.format(type), container, superordinate=so[0])
+            else:
+                obj = umc_module_for_edit('dns/{0}'.format(type), dn)
+            obj['name'] = name
+            for k, v in data.items():
+                obj[k] = v
+            diff = obj.diff()
+            changed = obj.diff() != []
+            if not module.check_mode:
+                if not exists:
+                    obj.create()
+                else:
+                    obj.modify()
+        except Exception as e:
+            module.fail_json(
+                msg='Creating/editing dns entry {0} in {1} failed: {2}'.format(name, container, e)
+            )
+
+    if state == 'absent' and exists:
+        try:
+            obj = umc_module_for_edit('dns/{0}'.format(type), dn)
+            if not module.check_mode:
+                obj.remove()
+            changed = True
+        except Exception as e:
+            module.fail_json(
+                msg='Removing dns entry {0} in {1} failed: {2}'.format(name, container, e)
+            )
+
+    module.exit_json(
+        changed=changed,
+        name=name,
+        diff=diff,
+        container=container
+    )
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/cloud/univention/udm_dns_zone.py

@@ -0,0 +1,236 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+# Copyright: (c) 2016, Adfinis SyGroup AG
+# Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = '''
+---
+module: udm_dns_zone
+author:
+- Tobias Rüetschi (@keachi)
+short_description: Manage dns zones on a univention corporate server
+description:
+    - "This module allows to manage dns zones on a univention corporate server (UCS).
+       It uses the python API of the UCS to create a new object or edit it."
+requirements:
+    - Python >= 2.6
+options:
+    state:
+        required: false
+        default: "present"
+        choices: [ present, absent ]
+        description:
+            - Whether the dns zone is present or not.
+    type:
+        required: true
+        choices: [ forward_zone, reverse_zone ]
+        description:
+            - Define if the zone is a forward or reverse DNS zone.
+    zone:
+        required: true
+        description:
+            - DNS zone name, e.g. C(example.com).
+    nameserver:
+        required: false
+        description:
+            - List of appropriate name servers. Required if C(state=present).
+    interfaces:
+        required: false
+        description:
+            - List of interface IP addresses, on which the server should
+              response this zone. Required if C(state=present).
+
+    refresh:
+        required: false
+        default: 3600
+        description:
+            - Interval before the zone should be refreshed.
+    retry:
+        required: false
+        default: 1800
+        description:
+            - Interval that should elapse before a failed refresh should be retried.
+    expire:
+        required: false
+        default: 604800
+        description:
+            - Specifies the upper limit on the time interval that can elapse before the zone is no longer authoritative.
+    ttl:
+        required: false
+        default: 600
+        description:
+            - Minimum TTL field that should be exported with any RR from this zone.
+
+    contact:
+        required: false
+        default: ''
+        description:
+            - Contact person in the SOA record.
+    mx:
+        required: false
+        default: []
+        description:
+            - List of MX servers. (Must declared as A or AAAA records).
+'''
+
+
+EXAMPLES = '''
+# Create a DNS zone on a UCS
+- udm_dns_zone:
+    zone: example.com
+    type: forward_zone
+    nameserver:
+      - ucs.example.com
+    interfaces:
+      - 192.0.2.1
+'''
+
+
+RETURN = '''# '''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.community.general.plugins.module_utils.univention_umc import (
+    umc_module_for_add,
+    umc_module_for_edit,
+    ldap_search,
+    base_dn,
+)
+
+
+def convert_time(time):
+    """Convert a time in seconds into the biggest unit"""
+    units = [
+        (24 * 60 * 60, 'days'),
+        (60 * 60, 'hours'),
+        (60, 'minutes'),
+        (1, 'seconds'),
+    ]
+
+    if time == 0:
+        return ('0', 'seconds')
+    for unit in units:
+        if time >= unit[0]:
+            return ('{0}'.format(time // unit[0]), unit[1])
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            type=dict(required=True,
+                      type='str'),
+            zone=dict(required=True,
+                      aliases=['name'],
+                      type='str'),
+            nameserver=dict(default=[],
+                            type='list'),
+            interfaces=dict(default=[],
+                            type='list'),
+            refresh=dict(default=3600,
+                         type='int'),
+            retry=dict(default=1800,
+                       type='int'),
+            expire=dict(default=604800,
+                        type='int'),
+            ttl=dict(default=600,
+                     type='int'),
+            contact=dict(default='',
+                         type='str'),
+            mx=dict(default=[],
+                    type='list'),
+            state=dict(default='present',
+                       choices=['present', 'absent'],
+                       type='str')
+        ),
+        supports_check_mode=True,
+        required_if=([
+            ('state', 'present', ['nameserver', 'interfaces'])
+        ])
+    )
+    type = module.params['type']
+    zone = module.params['zone']
+    nameserver = module.params['nameserver']
+    interfaces = module.params['interfaces']
+    refresh = module.params['refresh']
+    retry = module.params['retry']
+    expire = module.params['expire']
+    ttl = module.params['ttl']
+    contact = module.params['contact']
+    mx = module.params['mx']
+    state = module.params['state']
+    changed = False
+    diff = None
+
+    obj = list(ldap_search(
+        '(&(objectClass=dNSZone)(zoneName={0}))'.format(zone),
+        attr=['dNSZone']
+    ))
+
+    exists = bool(len(obj))
+    container = 'cn=dns,{0}'.format(base_dn())
+    dn = 'zoneName={0},{1}'.format(zone, container)
+    if contact == '':
+        contact = 'root@{0}.'.format(zone)
+
+    if state == 'present':
+        try:
+            if not exists:
+                obj = umc_module_for_add('dns/{0}'.format(type), container)
+            else:
+                obj = umc_module_for_edit('dns/{0}'.format(type), dn)
+            obj['zone'] = zone
+            obj['nameserver'] = nameserver
+            obj['a'] = interfaces
+            obj['refresh'] = convert_time(refresh)
+            obj['retry'] = convert_time(retry)
+            obj['expire'] = convert_time(expire)
+            obj['ttl'] = convert_time(ttl)
+            obj['contact'] = contact
+            obj['mx'] = mx
+            diff = obj.diff()
+            if exists:
+                for k in obj.keys():
+                    if obj.hasChanged(k):
+                        changed = True
+            else:
+                changed = True
+            if not module.check_mode:
+                if not exists:
+                    obj.create()
+                elif changed:
+                    obj.modify()
+        except Exception as e:
+            module.fail_json(
+                msg='Creating/editing dns zone {0} failed: {1}'.format(zone, e)
+            )
+
+    if state == 'absent' and exists:
+        try:
+            obj = umc_module_for_edit('dns/{0}'.format(type), dn)
+            if not module.check_mode:
+                obj.remove()
+            changed = True
+        except Exception as e:
+            module.fail_json(
+                msg='Removing dns zone {0} failed: {1}'.format(zone, e)
+            )
+
+    module.exit_json(
+        changed=changed,
+        diff=diff,
+        zone=zone
+    )
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/cloud/univention/udm_group.py

@@ -0,0 +1,172 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+# Copyright: (c) 2016, Adfinis SyGroup AG
+# Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = '''
+---
+module: udm_group
+author:
+- Tobias Rüetschi (@keachi)
+short_description: Manage of the posix group
+description:
+    - "This module allows to manage user groups on a univention corporate server (UCS).
+       It uses the python API of the UCS to create a new object or edit it."
+requirements:
+    - Python >= 2.6
+options:
+    state:
+        required: false
+        default: "present"
+        choices: [ present, absent ]
+        description:
+            - Whether the group is present or not.
+    name:
+        required: true
+        description:
+            - Name of the posix group.
+    description:
+        required: false
+        description:
+            - Group description.
+    position:
+        required: false
+        description:
+            - define the whole ldap position of the group, e.g.
+              C(cn=g123m-1A,cn=classes,cn=schueler,cn=groups,ou=schule,dc=example,dc=com).
+    ou:
+        required: false
+        description:
+            - LDAP OU, e.g. school for LDAP OU C(ou=school,dc=example,dc=com).
+    subpath:
+        required: false
+        description:
+            - Subpath inside the OU, e.g. C(cn=classes,cn=students,cn=groups).
+'''
+
+
+EXAMPLES = '''
+# Create a POSIX group
+- udm_group:
+    name: g123m-1A
+
+# Create a POSIX group with the exact DN
+# C(cn=g123m-1A,cn=classes,cn=students,cn=groups,ou=school,dc=school,dc=example,dc=com)
+- udm_group:
+    name: g123m-1A
+    subpath: 'cn=classes,cn=students,cn=groups'
+    ou: school
+# or
+- udm_group:
+    name: g123m-1A
+    position: 'cn=classes,cn=students,cn=groups,ou=school,dc=school,dc=example,dc=com'
+'''
+
+
+RETURN = '''# '''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.community.general.plugins.module_utils.univention_umc import (
+    umc_module_for_add,
+    umc_module_for_edit,
+    ldap_search,
+    base_dn,
+)
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            name=dict(required=True,
+                      type='str'),
+            description=dict(default=None,
+                             type='str'),
+            position=dict(default='',
+                          type='str'),
+            ou=dict(default='',
+                    type='str'),
+            subpath=dict(default='cn=groups',
+                         type='str'),
+            state=dict(default='present',
+                       choices=['present', 'absent'],
+                       type='str')
+        ),
+        supports_check_mode=True
+    )
+    name = module.params['name']
+    description = module.params['description']
+    position = module.params['position']
+    ou = module.params['ou']
+    subpath = module.params['subpath']
+    state = module.params['state']
+    changed = False
+    diff = None
+
+    groups = list(ldap_search(
+        '(&(objectClass=posixGroup)(cn={0}))'.format(name),
+        attr=['cn']
+    ))
+    if position != '':
+        container = position
+    else:
+        if ou != '':
+            ou = 'ou={0},'.format(ou)
+        if subpath != '':
+            subpath = '{0},'.format(subpath)
+        container = '{0}{1}{2}'.format(subpath, ou, base_dn())
+    group_dn = 'cn={0},{1}'.format(name, container)
+
+    exists = bool(len(groups))
+
+    if state == 'present':
+        try:
+            if not exists:
+                grp = umc_module_for_add('groups/group', container)
+            else:
+                grp = umc_module_for_edit('groups/group', group_dn)
+            grp['name'] = name
+            grp['description'] = description
+            diff = grp.diff()
+            changed = grp.diff() != []
+            if not module.check_mode:
+                if not exists:
+                    grp.create()
+                else:
+                    grp.modify()
+        except Exception:
+            module.fail_json(
+                msg="Creating/editing group {0} in {1} failed".format(name, container)
+            )
+
+    if state == 'absent' and exists:
+        try:
+            grp = umc_module_for_edit('groups/group', group_dn)
+            if not module.check_mode:
+                grp.remove()
+            changed = True
+        except Exception:
+            module.fail_json(
+                msg="Removing group {0} failed".format(name)
+            )
+
+    module.exit_json(
+        changed=changed,
+        name=name,
+        diff=diff,
+        container=container
+    )
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/cloud/univention/udm_share.py

@@ -0,0 +1,550 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+# Copyright: (c) 2016, Adfinis SyGroup AG
+# Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = '''
+---
+module: udm_share
+author:
+- Tobias Rüetschi (@keachi)
+short_description: Manage samba shares on a univention corporate server
+description:
+    - "This module allows to manage samba shares on a univention corporate
+       server (UCS).
+       It uses the python API of the UCS to create a new object or edit it."
+requirements:
+    - Python >= 2.6
+options:
+    state:
+        default: "present"
+        choices: [ present, absent ]
+        description:
+            - Whether the share is present or not.
+    name:
+        required: true
+        description:
+            - Name
+    host:
+        required: false
+        description:
+            - Host FQDN (server which provides the share), e.g. C({{
+              ansible_fqdn }}). Required if C(state=present).
+    path:
+        required: false
+        description:
+            - Directory on the providing server, e.g. C(/home). Required if C(state=present).
+    samba_name:
+        required: false
+        description:
+            - Windows name. Required if C(state=present).
+        aliases: [ sambaName ]
+    ou:
+        required: true
+        description:
+            - Organisational unit, inside the LDAP Base DN.
+    owner:
+        default: 0
+        description:
+            - Directory owner of the share's root directory.
+    group:
+        default: '0'
+        description:
+            - Directory owner group of the share's root directory.
+    directorymode:
+        default: '00755'
+        description:
+            - Permissions for the share's root directory.
+    root_squash:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Modify user ID for root user (root squashing).
+    subtree_checking:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Subtree checking.
+    sync:
+        default: 'sync'
+        description:
+            - NFS synchronisation.
+    writeable:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - NFS write access.
+    samba_block_size:
+        description:
+            - Blocking size.
+        aliases: [ sambaBlockSize ]
+    samba_blocking_locks:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Blocking locks.
+        aliases: [ sambaBlockingLocks ]
+    samba_browseable:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Show in Windows network environment.
+        aliases: [ sambaBrowseable ]
+    samba_create_mode:
+        default: '0744'
+        description:
+            - File mode.
+        aliases: [ sambaCreateMode ]
+    samba_csc_policy:
+        default: 'manual'
+        description:
+            - Client-side caching policy.
+        aliases: [ sambaCscPolicy ]
+    samba_custom_settings:
+        default: []
+        description:
+            - Option name in smb.conf and its value.
+        aliases: [ sambaCustomSettings ]
+    samba_directory_mode:
+        default: '0755'
+        description:
+            - Directory mode.
+        aliases: [ sambaDirectoryMode ]
+    samba_directory_security_mode:
+        default: '0777'
+        description:
+            - Directory security mode.
+        aliases: [ sambaDirectorySecurityMode ]
+    samba_dos_filemode:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Users with write access may modify permissions.
+        aliases: [ sambaDosFilemode ]
+    samba_fake_oplocks:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Fake oplocks.
+        aliases: [ sambaFakeOplocks ]
+    samba_force_create_mode:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Force file mode.
+        aliases: [ sambaForceCreateMode ]
+    samba_force_directory_mode:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Force directory mode.
+        aliases: [ sambaForceDirectoryMode ]
+    samba_force_directory_security_mode:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Force directory security mode.
+        aliases: [ sambaForceDirectorySecurityMode ]
+    samba_force_group:
+        description:
+            - Force group.
+        aliases: [ sambaForceGroup ]
+    samba_force_security_mode:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Force security mode.
+        aliases: [ sambaForceSecurityMode ]
+    samba_force_user:
+        description:
+            - Force user.
+        aliases: [ sambaForceUser ]
+    samba_hide_files:
+        description:
+            - Hide files.
+        aliases: [ sambaHideFiles ]
+    samba_hide_unreadable:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Hide unreadable files/directories.
+        aliases: [ sambaHideUnreadable ]
+    samba_hosts_allow:
+        default: []
+        description:
+            - Allowed host/network.
+        aliases: [ sambaHostsAllow ]
+    samba_hosts_deny:
+        default: []
+        description:
+            - Denied host/network.
+        aliases: [ sambaHostsDeny ]
+    samba_inherit_acls:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Inherit ACLs.
+        aliases: [ sambaInheritAcls ]
+    samba_inherit_owner:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Create files/directories with the owner of the parent directory.
+        aliases: [ sambaInheritOwner ]
+    samba_inherit_permissions:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Create files/directories with permissions of the parent directory.
+        aliases: [ sambaInheritPermissions ]
+    samba_invalid_users:
+        description:
+            - Invalid users or groups.
+        aliases: [ sambaInvalidUsers ]
+    samba_level_2_oplocks:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Level 2 oplocks.
+        aliases: [ sambaLevel2Oplocks ]
+    samba_locking:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Locking.
+        aliases: [ sambaLocking ]
+    samba_msdfs_root:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - MSDFS root.
+        aliases: [ sambaMSDFSRoot ]
+    samba_nt_acl_support:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - NT ACL support.
+        aliases: [ sambaNtAclSupport ]
+    samba_oplocks:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Oplocks.
+        aliases: [ sambaOplocks ]
+    samba_postexec:
+        description:
+            - Postexec script.
+        aliases: [ sambaPostexec ]
+    samba_preexec:
+        description:
+            - Preexec script.
+        aliases: [ sambaPreexec ]
+    samba_public:
+        default: '0'
+        choices: [ '0', '1' ]
+        description:
+            - Allow anonymous read-only access with a guest user.
+        aliases: [ sambaPublic ]
+    samba_security_mode:
+        default: '0777'
+        description:
+            - Security mode.
+        aliases: [ sambaSecurityMode ]
+    samba_strict_locking:
+        default: 'Auto'
+        description:
+            - Strict locking.
+        aliases: [ sambaStrictLocking ]
+    samba_vfs_objects:
+        description:
+            - VFS objects.
+        aliases: [ sambaVFSObjects ]
+    samba_valid_users:
+        description:
+            - Valid users or groups.
+        aliases: [ sambaValidUsers ]
+    samba_write_list:
+        description:
+            - Restrict write access to these users/groups.
+        aliases: [ sambaWriteList ]
+    samba_writeable:
+        default: '1'
+        choices: [ '0', '1' ]
+        description:
+            - Samba write access.
+        aliases: [ sambaWriteable ]
+    nfs_hosts:
+        default: []
+        description:
+            - Only allow access for this host, IP address or network.
+    nfs_custom_settings:
+        default: []
+        description:
+            - Option name in exports file.
+        aliases: [ nfsCustomSettings ]
+'''
+
+
+EXAMPLES = '''
+# Create a share named home on the server ucs.example.com with the path /home.
+- udm_share:
+    name: home
+    path: /home
+    host: ucs.example.com
+    sambaName: Home
+'''
+
+
+RETURN = '''# '''
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.community.general.plugins.module_utils.univention_umc import (
+    umc_module_for_add,
+    umc_module_for_edit,
+    ldap_search,
+    base_dn,
+)
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec=dict(
+            name=dict(required=True,
+                      type='str'),
+            ou=dict(required=True,
+                    type='str'),
+            owner=dict(type='str',
+                       default='0'),
+            group=dict(type='str',
+                       default='0'),
+            path=dict(type='path',
+                      default=None),
+            directorymode=dict(type='str',
+                               default='00755'),
+            host=dict(type='str',
+                      default=None),
+            root_squash=dict(type='bool',
+                             default=True),
+            subtree_checking=dict(type='bool',
+                                  default=True),
+            sync=dict(type='str',
+                      default='sync'),
+            writeable=dict(type='bool',
+                           default=True),
+            sambaBlockSize=dict(type='str',
+                                aliases=['samba_block_size'],
+                                default=None),
+            sambaBlockingLocks=dict(type='bool',
+                                    aliases=['samba_blocking_locks'],
+                                    default=True),
+            sambaBrowseable=dict(type='bool',
+                                 aliases=['samba_browsable'],
+                                 default=True),
+            sambaCreateMode=dict(type='str',
+                                 aliases=['samba_create_mode'],
+                                 default='0744'),
+            sambaCscPolicy=dict(type='str',
+                                aliases=['samba_csc_policy'],
+                                default='manual'),
+            sambaCustomSettings=dict(type='list',
+                                     aliases=['samba_custom_settings'],
+                                     default=[]),
+            sambaDirectoryMode=dict(type='str',
+                                    aliases=['samba_directory_mode'],
+                                    default='0755'),
+            sambaDirectorySecurityMode=dict(type='str',
+                                            aliases=['samba_directory_security_mode'],
+                                            default='0777'),
+            sambaDosFilemode=dict(type='bool',
+                                  aliases=['samba_dos_filemode'],
+                                  default=False),
+            sambaFakeOplocks=dict(type='bool',
+                                  aliases=['samba_fake_oplocks'],
+                                  default=False),
+            sambaForceCreateMode=dict(type='bool',
+                                      aliases=['samba_force_create_mode'],
+                                      default=False),
+            sambaForceDirectoryMode=dict(type='bool',
+                                         aliases=['samba_force_directory_mode'],
+                                         default=False),
+            sambaForceDirectorySecurityMode=dict(type='bool',
+                                                 aliases=['samba_force_directory_security_mode'],
+                                                 default=False),
+            sambaForceGroup=dict(type='str',
+                                 aliases=['samba_force_group'],
+                                 default=None),
+            sambaForceSecurityMode=dict(type='bool',
+                                        aliases=['samba_force_security_mode'],
+                                        default=False),
+            sambaForceUser=dict(type='str',
+                                aliases=['samba_force_user'],
+                                default=None),
+            sambaHideFiles=dict(type='str',
+                                aliases=['samba_hide_files'],
+                                default=None),
+            sambaHideUnreadable=dict(type='bool',
+                                     aliases=['samba_hide_unreadable'],
+                                     default=False),
+            sambaHostsAllow=dict(type='list',
+                                 aliases=['samba_hosts_allow'],
+                                 default=[]),
+            sambaHostsDeny=dict(type='list',
+                                aliases=['samba_hosts_deny'],
+                                default=[]),
+            sambaInheritAcls=dict(type='bool',
+                                  aliases=['samba_inherit_acls'],
+                                  default=True),
+            sambaInheritOwner=dict(type='bool',
+                                   aliases=['samba_inherit_owner'],
+                                   default=False),
+            sambaInheritPermissions=dict(type='bool',
+                                         aliases=['samba_inherit_permissions'],
+                                         default=False),
+            sambaInvalidUsers=dict(type='str',
+                                   aliases=['samba_invalid_users'],
+                                   default=None),
+            sambaLevel2Oplocks=dict(type='bool',
+                                    aliases=['samba_level_2_oplocks'],
+                                    default=True),
+            sambaLocking=dict(type='bool',
+                              aliases=['samba_locking'],
+                              default=True),
+            sambaMSDFSRoot=dict(type='bool',
+                                aliases=['samba_msdfs_root'],
+                                default=False),
+            sambaName=dict(type='str',
+                           aliases=['samba_name'],
+                           default=None),
+            sambaNtAclSupport=dict(type='bool',
+                                   aliases=['samba_nt_acl_support'],
+                                   default=True),
+            sambaOplocks=dict(type='bool',
+                              aliases=['samba_oplocks'],
+                              default=True),
+            sambaPostexec=dict(type='str',
+                               aliases=['samba_postexec'],
+                               default=None),
+            sambaPreexec=dict(type='str',
+                              aliases=['samba_preexec'],
+                              default=None),
+            sambaPublic=dict(type='bool',
+                             aliases=['samba_public'],
+                             default=False),
+            sambaSecurityMode=dict(type='str',
+                                   aliases=['samba_security_mode'],
+                                   default='0777'),
+            sambaStrictLocking=dict(type='str',
+                                    aliases=['samba_strict_locking'],
+                                    default='Auto'),
+            sambaVFSObjects=dict(type='str',
+                                 aliases=['samba_vfs_objects'],
+                                 default=None),
+            sambaValidUsers=dict(type='str',
+                                 aliases=['samba_valid_users'],
+                                 default=None),
+            sambaWriteList=dict(type='str',
+                                aliases=['samba_write_list'],
+                                default=None),
+            sambaWriteable=dict(type='bool',
+                                aliases=['samba_writeable'],
+                                default=True),
+            nfs_hosts=dict(type='list',
+                           default=[]),
+            nfsCustomSettings=dict(type='list',
+                                   aliases=['nfs_custom_settings'],
+                                   default=[]),
+            state=dict(default='present',
+                       choices=['present', 'absent'],
+                       type='str')
+        ),
+        supports_check_mode=True,
+        required_if=([
+            ('state', 'present', ['path', 'host', 'sambaName'])
+        ])
+    )
+    name = module.params['name']
+    state = module.params['state']
+    changed = False
+    diff = None
+
+    obj = list(ldap_search(
+        '(&(objectClass=univentionShare)(cn={0}))'.format(name),
+        attr=['cn']
+    ))
+
+    exists = bool(len(obj))
+    container = 'cn=shares,ou={0},{1}'.format(module.params['ou'], base_dn())
+    dn = 'cn={0},{1}'.format(name, container)
+
+    if state == 'present':
+        try:
+            if not exists:
+                obj = umc_module_for_add('shares/share', container)
+            else:
+                obj = umc_module_for_edit('shares/share', dn)
+
+            module.params['printablename'] = '{0} ({1})'.format(name, module.params['host'])
+            for k in obj.keys():
+                if module.params[k] is True:
+                    module.params[k] = '1'
+                elif module.params[k] is False:
+                    module.params[k] = '0'
+                obj[k] = module.params[k]
+
+            diff = obj.diff()
+            if exists:
+                for k in obj.keys():
+                    if obj.hasChanged(k):
+                        changed = True
+            else:
+                changed = True
+            if not module.check_mode:
+                if not exists:
+                    obj.create()
+                elif changed:
+                    obj.modify()
+        except Exception as err:
+            module.fail_json(
+                msg='Creating/editing share {0} in {1} failed: {2}'.format(
+                    name,
+                    container,
+                    err,
+                )
+            )
+
+    if state == 'absent' and exists:
+        try:
+            obj = umc_module_for_edit('shares/share', dn)
+            if not module.check_mode:
+                obj.remove()
+            changed = True
+        except Exception as err:
+            module.fail_json(
+                msg='Removing share {0} in {1} failed: {2}'.format(
+                    name,
+                    container,
+                    err,
+                )
+            )
+
+    module.exit_json(
+        changed=changed,
+        name=name,
+        diff=diff,
+        container=container
+    )
+
+
+if __name__ == '__main__':
+    main()

plugins/modules/cloud/univention/udm_user.py

@@ -0,0 +1,525 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+
+# Copyright: (c) 2016, Adfinis SyGroup AG
+# Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+ANSIBLE_METADATA = {'metadata_version': '1.1',
+                    'status': ['preview'],
+                    'supported_by': 'community'}
+
+
+DOCUMENTATION = '''
+---
+module: udm_user
+author:
+- Tobias Rüetschi (@keachi)
+short_description: Manage posix users on a univention corporate server
+description:
+    - "This module allows to manage posix users on a univention corporate
+       server (UCS).
+       It uses the python API of the UCS to create a new object or edit it."
+requirements:
+    - Python >= 2.6
+options:
+    state:
+        default: "present"
+        choices: [ present, absent ]
+        description:
+            - Whether the user is present or not.
+    username:
+        required: true
+        description:
+            - User name
+        aliases: ['name']
+    firstname:
+        description:
+            - First name. Required if C(state=present).
+    lastname:
+        description:
+            - Last name. Required if C(state=present).
+    password:
+        description:
+            - Password. Required if C(state=present).
+    birthday:
+        description:
+            - Birthday
+    city:
+        description:
+            - City of users business address.
+    country:
+        description:
+            - Country of users business address.
+    department_number:
+        description:
+            - Department number of users business address.
+        aliases: [ departmentNumber ]
+    description:
+        description:
+            - Description (not gecos)
+    display_name:
+        description:
+            - Display name (not gecos)
+        aliases: [ displayName ]
+    email:
+        default: []
+        description:
+            - A list of e-mail addresses.
+    employee_number:
+        description:
+            - Employee number
+        aliases: [ employeeNumber ]
+    employee_type:
+        description:
+            - Employee type
+        aliases: [ employeeType ]
+    gecos:
+        description:
+            - GECOS
+    groups:
+        default: []
+        description:
+            - "POSIX groups, the LDAP DNs of the groups will be found with the
+               LDAP filter for each group as $GROUP:
+               C((&(objectClass=posixGroup)(cn=$GROUP)))."
+    home_share:
+        description:
+            - "Home NFS share. Must be a LDAP DN, e.g.
+               C(cn=home,cn=shares,ou=school,dc=example,dc=com)."
+        aliases: [ homeShare ]
+    home_share_path:
+        description:
+            - Path to home NFS share, inside the homeShare.
+        aliases: [ homeSharePath ]
+    home_telephone_number:
+        default: []
+        description:
+            - List of private telephone numbers.
+        aliases: [ homeTelephoneNumber ]
+    homedrive:
+        description:
+            - Windows home drive, e.g. C("H:").
+    mail_alternative_address:
+        default: []
+        description:
+            - List of alternative e-mail addresses.
+        aliases: [ mailAlternativeAddress ]
+    mail_home_server:
+        description:
+            - FQDN of mail server
+        aliases: [ mailHomeServer ]
+    mail_primary_address:
+        description:
+            - Primary e-mail address
+        aliases: [ mailPrimaryAddress ]
+    mobile_telephone_number:
+        default: []
+        description:
+            - Mobile phone number
+        aliases: [ mobileTelephoneNumber ]
+    organisation:
+        description:
+            - Organisation
+        aliases: [ organization ]
+    override_pw_history:
+        type: bool
+        default: 'no'
+        description:
+            - Override password history
+        aliases: [ overridePWHistory ]
+    override_pw_length:
+        type: bool
+        default: 'no'
+        description:
+            - Override password check
+        aliases: [ overridePWLength ]
+    pager_telephonenumber:
+        default: []
+        description:
+            - List of pager telephone numbers.
+        aliases: [ pagerTelephonenumber ]
+    phone:
+        description:
+            - List of telephone numbers.
+    postcode:
+        description:
+            - Postal code of users business address.
+    primary_group:
+        default: cn=Domain Users,cn=groups,$LDAP_BASE_DN
+        description:
+            - Primary group. This must be the group LDAP DN.
+        aliases: [ primaryGroup ]
+    profilepath:
+        description:
+            - Windows profile directory
+    pwd_change_next_login:
+        choices: [ '0', '1' ]
+        description:
+            - Change password on next login.
+        aliases: [ pwdChangeNextLogin ]
+    room_number:
+        description:
+            - Room number of users business address.
+        aliases: [ roomNumber ]
+    samba_privileges:
+        description:
+            - "Samba privilege, like allow printer administration, do domain
+               join."
+        aliases: [ sambaPrivileges ]
+    samba_user_workstations:
+        description:
+            - Allow the authentication only on this Microsoft Windows host.
+        aliases: [ sambaUserWorkstations ]
+    sambahome:
+        description:
+            - Windows home path, e.g. C('\\$FQDN\$USERNAME').
+    scriptpath:
+        description:
+            - Windows logon script.
+    secretary:
+        default: []
+        description:
+            - A list of superiors as LDAP DNs.
+    serviceprovider:
+        default: []
+        description:
+            - Enable user for the following service providers.
+    shell:
+        default: '/bin/bash'
+        description:
+            - Login shell
+    street:
+        description:
+            - Street of users business address.
+    title:
+        description:
+            - Title, e.g. C(Prof.).
+    unixhome:
+        default: '/home/$USERNAME'
+        description:
+            - Unix home directory
+    userexpiry:
+        default: Today + 1 year
+        description:
+            - Account expiry date, e.g. C(1999-12-31).
+    position:
+        default: ''
+        description:
+            - "Define the whole position of users object inside the LDAP tree,
+               e.g. C(cn=employee,cn=users,ou=school,dc=example,dc=com)."
+    update_password:
+        default: always
+        description:
+            - "C(always) will update passwords if they differ.
+               C(on_create) will only set the password for newly created users."
+    ou:
+        default: ''
+        description:
+            - "Organizational Unit inside the LDAP Base DN, e.g. C(school) for
+               LDAP OU C(ou=school,dc=example,dc=com)."
+    subpath:
+        default: 'cn=users'
+        description:
+            - "LDAP subpath inside the organizational unit, e.g.
+               C(cn=teachers,cn=users) for LDAP container
+               C(cn=teachers,cn=users,dc=example,dc=com)."
+'''
+
+
+EXAMPLES = '''
+# Create a user on a UCS
+- udm_user:
+    name: FooBar
+    password: secure_password
+    firstname: Foo
+    lastname: Bar
+
+# Create a user with the DN
+# C(uid=foo,cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com)
+- udm_user:
+    name: foo
+    password: secure_password
+    firstname: Foo
+    lastname: Bar
+    ou: school
+    subpath: 'cn=teachers,cn=users'
+# or define the position
+- udm_user:
+    name: foo
+    password: secure_password
+    firstname: Foo
+    lastname: Bar
+    position: 'cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com'
+'''
+
+
+RETURN = '''# '''
+
+import crypt
+from datetime import date, timedelta
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.community.general.plugins.module_utils.univention_umc import (
+    umc_module_for_add,
+    umc_module_for_edit,
+    ldap_search,
+    base_dn,
+)
+
+
+def main():
+    expiry = date.strftime(date.today() + timedelta(days=365), "%Y-%m-%d")
+    module = AnsibleModule(
+        argument_spec=dict(
+            birthday=dict(default=None,
+                          type='str'),
+            city=dict(default=None,
+                      type='str'),
+            country=dict(default=None,
+                         type='str'),
+            department_number=dict(default=None,
+                                   type='str',
+                                   aliases=['departmentNumber']),
+            description=dict(default=None,
+                             type='str'),
+            display_name=dict(default=None,
+                              type='str',
+                              aliases=['displayName']),
+            email=dict(default=[''],
+                       type='list'),
+            employee_number=dict(default=None,
+                                 type='str',
+                                 aliases=['employeeNumber']),
+            employee_type=dict(default=None,
+                               type='str',
+                               aliases=['employeeType']),
+            firstname=dict(default=None,
+                           type='str'),
+            gecos=dict(default=None,
+                       type='str'),
+            groups=dict(default=[],
+                        type='list'),
+            home_share=dict(default=None,
+                            type='str',
+                            aliases=['homeShare']),
+            home_share_path=dict(default=None,
+                                 type='str',
+                                 aliases=['homeSharePath']),
+            home_telephone_number=dict(default=[],
+                                       type='list',
+                                       aliases=['homeTelephoneNumber']),
+            homedrive=dict(default=None,
+                           type='str'),
+            lastname=dict(default=None,
+                          type='str'),
+            mail_alternative_address=dict(default=[],
+                                          type='list',
+                                          aliases=['mailAlternativeAddress']),
+            mail_home_server=dict(default=None,
+                                  type='str',
+                                  aliases=['mailHomeServer']),
+            mail_primary_address=dict(default=None,
+                                      type='str',
+                                      aliases=['mailPrimaryAddress']),
+            mobile_telephone_number=dict(default=[],
+                                         type='list',
+                                         aliases=['mobileTelephoneNumber']),
+            organisation=dict(default=None,
+                              type='str',
+                              aliases=['organization']),
+            overridePWHistory=dict(default=False,
+                                   type='bool',
+                                   aliases=['override_pw_history']),
+            overridePWLength=dict(default=False,
+                                  type='bool',
+                                  aliases=['override_pw_length']),
+            pager_telephonenumber=dict(default=[],
+                                       type='list',
+                                       aliases=['pagerTelephonenumber']),
+            password=dict(default=None,
+                          type='str',
+                          no_log=True),
+            phone=dict(default=[],
+                       type='list'),
+            postcode=dict(default=None,
+                          type='str'),
+            primary_group=dict(default=None,
+                               type='str',
+                               aliases=['primaryGroup']),
+            profilepath=dict(default=None,
+                             type='str'),
+            pwd_change_next_login=dict(default=None,
+                                       type='str',
+                                       choices=['0', '1'],
+                                       aliases=['pwdChangeNextLogin']),
+            room_number=dict(default=None,
+                             type='str',
+                             aliases=['roomNumber']),
+            samba_privileges=dict(default=[],
+                                  type='list',
+                                  aliases=['sambaPrivileges']),
+            samba_user_workstations=dict(default=[],
+                                         type='list',
+                                         aliases=['sambaUserWorkstations']),
+            sambahome=dict(default=None,
+                           type='str'),
+            scriptpath=dict(default=None,
+                            type='str'),
+            secretary=dict(default=[],
+                           type='list'),
+            serviceprovider=dict(default=[''],
+                                 type='list'),
+            shell=dict(default='/bin/bash',
+                       type='str'),
+            street=dict(default=None,
+                        type='str'),
+            title=dict(default=None,
+                       type='str'),
+            unixhome=dict(default=None,
+                          type='str'),
+            userexpiry=dict(default=expiry,
+                            type='str'),
+            username=dict(required=True,
+                          aliases=['name'],
+                          type='str'),
+            position=dict(default='',
+                          type='str'),
+            update_password=dict(default='always',
+                                 choices=['always', 'on_create'],
+                                 type='str'),
+            ou=dict(default='',
+                    type='str'),
+            subpath=dict(default='cn=users',
+                         type='str'),
+            state=dict(default='present',
+                       choices=['present', 'absent'],
+                       type='str')
+        ),
+        supports_check_mode=True,
+        required_if=([
+            ('state', 'present', ['firstname', 'lastname', 'password'])
+        ])
+    )
+    username = module.params['username']
+    position = module.params['position']
+    ou = module.params['ou']
+    subpath = module.params['subpath']
+    state = module.params['state']
+    changed = False
+    diff = None
+
+    users = list(ldap_search(
+        '(&(objectClass=posixAccount)(uid={0}))'.format(username),
+        attr=['uid']
+    ))
+    if position != '':
+        container = position
+    else:
+        if ou != '':
+            ou = 'ou={0},'.format(ou)
+        if subpath != '':
+            subpath = '{0},'.format(subpath)
+        container = '{0}{1}{2}'.format(subpath, ou, base_dn())
+    user_dn = 'uid={0},{1}'.format(username, container)
+
+    exists = bool(len(users))
+
+    if state == 'present':
+        try:
+            if not exists:
+                obj = umc_module_for_add('users/user', container)
+            else:
+                obj = umc_module_for_edit('users/user', user_dn)
+
+            if module.params['displayName'] is None:
+                module.params['displayName'] = '{0} {1}'.format(
+                    module.params['firstname'],
+                    module.params['lastname']
+                )
+            if module.params['unixhome'] is None:
+                module.params['unixhome'] = '/home/{0}'.format(
+                    module.params['username']
+                )
+            for k in obj.keys():
+                if (k != 'password' and
+                        k != 'groups' and
+                        k != 'overridePWHistory' and
+                        k in module.params and
+                        module.params[k] is not None):
+                    obj[k] = module.params[k]
+            # handle some special values
+            obj['e-mail'] = module.params['email']
+            password = module.params['password']
+            if obj['password'] is None:
+                obj['password'] = password
+            if module.params['update_password'] == 'always':
+                old_password = obj['password'].split('}', 2)[1]
+                if crypt.crypt(password, old_password) != old_password:
+                    obj['overridePWHistory'] = module.params['overridePWHistory']
+                    obj['overridePWLength'] = module.params['overridePWLength']
+                    obj['password'] = password
+
+            diff = obj.diff()
+            if exists:
+                for k in obj.keys():
+                    if obj.hasChanged(k):
+                        changed = True
+            else:
+                changed = True
+            if not module.check_mode:
+                if not exists:
+                    obj.create()
+                elif changed:
+                    obj.modify()
+        except Exception:
+            module.fail_json(
+                msg="Creating/editing user {0} in {1} failed".format(
+                    username,
+                    container
+                )
+            )
+        try:
+            groups = module.params['groups']
+            if groups:
+                filter = '(&(objectClass=posixGroup)(|(cn={0})))'.format(
+                    ')(cn='.join(groups)
+                )
+                group_dns = list(ldap_search(filter, attr=['dn']))
+                for dn in group_dns:
+                    grp = umc_module_for_edit('groups/group', dn[0])
+                    if user_dn not in grp['users']:
+                        grp['users'].append(user_dn)
+                        if not module.check_mode:
+                            grp.modify()
+                        changed = True
+        except Exception:
+            module.fail_json(
+                msg="Adding groups to user {0} failed".format(username)
+            )
+
+    if state == 'absent' and exists:
+        try:
+            obj = umc_module_for_edit('users/user', user_dn)
+            if not module.check_mode:
+                obj.remove()
+            changed = True
+        except Exception:
+            module.fail_json(
+                msg="Removing user {0} failed".format(username)
+            )
+
+    module.exit_json(
+        changed=changed,
+        username=username,
+        diff=diff,
+        container=container
+    )
+
+
+if __name__ == '__main__':
+    main()