diff --git a/tests/integration/targets/test_mysql_user/tasks/test_user_plugin_auth.yml b/tests/integration/targets/test_mysql_user/tasks/test_user_plugin_auth.yml index da99c11..b4e28d3 100644 --- a/tests/integration/targets/test_mysql_user/tasks/test_user_plugin_auth.yml +++ b/tests/integration/targets/test_mysql_user/tasks/test_user_plugin_auth.yml @@ -10,11 +10,79 @@ test_plugin_type: 'mysql_native_password' test_plugin_hash: '*0CB5B86F23FDC24DB19A29B8854EB860CBC47793' test_plugin_auth_string: 'Fdt8fd^34ds' + test_plugin_new_hash: '*E74368AC90460FA669F6D41BFB7F2A877DB73745' + test_plugin_new_auth_string: 'c$K01LsmK7nJnIR4!h' test_default_priv_type: 'SELECT' test_default_priv: '*.*:{{ test_default_priv_type }}' block: + # ============================================================ + # Test plugin auth initially with a hash and then changing to a different hash. + # + + - name: Create user with plugin auth (with hash string) + mysql_user: + <<: *mysql_params + name: '{{ test_user_name }}' + plugin: '{{ test_plugin_type }}' + plugin_hash_string: '{{ test_plugin_hash }}' + priv: '{{ test_default_priv }}' + register: result + + - name: Check that the module made a change + assert: + that: + - "result.changed == true" + + - include: assert_user.yml user_name={{ test_user_name }} priv={{ test_default_priv_type }} + + - name: Get the MySQL version using the newly created creds + mysql_info: + login_user: '{{ test_user_name }}' + login_password: '{{ test_plugin_auth_string }}' + login_host: '{{ mysql_host }}' + login_port: '{{ mysql_primary_port }}' + filter: version + register: result + + - name: Assert that mysql_info was successful + assert: + that: + - "result.failed == false" + + - name: Update the user with a different hash + mysql_user: + <<: *mysql_params + name: '{{ test_user_name }}' + plugin: '{{ test_plugin_type }}' + plugin_hash_string: '{{ test_plugin_new_hash }}' + register: result + + - name: Check that the module makes the change because the hash changed + assert: + that: + - "result.changed == true" + + - include: assert_user.yml user_name={{ test_user_name }} priv={{ test_default_priv_type }} + + - name: Getting the MySQL info with the new password should work + mysql_info: + login_user: '{{ test_user_name }}' + login_password: '{{ test_plugin_new_auth_string }}' + login_host: '{{ mysql_host }}' + login_port: '{{ mysql_primary_port }}' + filter: version + register: result + + - name: Assert that mysql_info was successful + assert: + that: + - "result.failed == false" + + # Cleanup + - include: remove_user.yml user_name={{ test_user_name }} user_password={{ test_plugin_new_auth_string }} + # ============================================================ # Test plugin auth initially setting a hash and then switching to a plaintext auth string. # @@ -240,3 +308,64 @@ # Cleanup - include: remove_user.yml user_name={{ test_user_name }} user_password={{ test_plugin_auth_string }} + + # ============================================================ + # Test plugin auth switching from one type of plugin to another. + # + + - name: Create user with plugin auth (empty auth string) + mysql_user: + <<: *mysql_params + name: '{{ test_user_name }}' + plugin: '{{ test_plugin_type }}' + priv: '{{ test_default_priv }}' + register: result + + - name: Check that the module made a change + assert: + that: + - "result.changed == true" + + - include: assert_user.yml user_name={{ test_user_name }} priv={{ test_default_priv_type }} + + - name: Get the MySQL version using an empty password for the newly created user + mysql_info: + login_user: '{{ test_user_name }}' + login_password: '' + login_host: '{{ mysql_host }}' + login_port: '{{ mysql_primary_port }}' + filter: version + register: result + ignore_errors: true + + - name: Assert that mysql_info was successful + assert: + that: + - "result.failed == false" + + - name: Switch user to sha256_password auth plugin + mysql_user: + <<: *mysql_params + name: '{{ test_user_name }}' + plugin: sha256_password + plugin_auth_string: '{{ test_plugin_auth_string }}' + priv: '{{ test_default_priv }}' + register: result + + - name: Get the MySQL version using the new plugin auth string + mysql_info: + login_user: '{{ test_user_name }}' + login_password: '{{ test_plugin_auth_string }}' + login_host: '{{ mysql_host }}' + login_port: '{{ mysql_primary_port }}' + filter: version + register: result + ignore_errors: true + + - name: Assert that mysql_info was successful + assert: + that: + - "result.failed == false" + + # Cleanup + - include: remove_user.yml user_name={{ test_user_name }} user_password={{ test_plugin_auth_string }}