From 4fa9719c7516bd104f47c5c8817a63421d137a67 Mon Sep 17 00:00:00 2001 From: Jorge-Rodriguez Date: Sat, 12 Sep 2020 13:29:22 +0300 Subject: [PATCH] Add test to verify TLS requirements are removed --- plugins/modules/mysql_user.py | 5 +++++ .../targets/test_mysql_user/tasks/main.yml | 22 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/plugins/modules/mysql_user.py b/plugins/modules/mysql_user.py index 9b1aca8..2fb340a 100644 --- a/plugins/modules/mysql_user.py +++ b/plugins/modules/mysql_user.py @@ -210,6 +210,11 @@ EXAMPLES = r''' subject: '/CN=alice/O=MyDom, Inc./C=US/ST=Oregon/L=Portland' cipher: 'ECDHE-ECDSA-AES256-SHA384' +- name: Modify user to no longer require SSL. + community.mysql.mysql_user: + name: bob + tls_requires: + - name: Ensure no user named 'sally'@'localhost' exists, also passing in the auth credentials. community.mysql.mysql_user: login_user: root diff --git a/tests/integration/targets/test_mysql_user/tasks/main.yml b/tests/integration/targets/test_mysql_user/tasks/main.yml index 0b06ace..0d9edd2 100644 --- a/tests/integration/targets/test_mysql_user/tasks/main.yml +++ b/tests/integration/targets/test_mysql_user/tasks/main.yml @@ -275,6 +275,28 @@ vars: - reqs: "{{(old_result is skipped | ternary(new_result, old_result)).stdout.split('REQUIRE')[1].split(separator)[0].strip()}}" + - name: remove TLS requiremets from user (expect changed=true) + mysql_user: + <<: *mysql_params + name: '{{ user_name_1 }}' + password: '{{ user_password_1 }}' + tls_requires: + + - name: retrieve TLS requiremets for users in old database version + command: "{{ mysql_command }} -L -N -s -e \"SHOW GRANTS for '{{ user_name_1 }}'@'localhost'\"" + register: old_result + when: db_version.version.major <= 5 and db_version.version.minor <= 6 or db_version.version.major == 10 and db_version.version.minor < 2 + + - name: retrieve TLS requiremets for users in new database version + command: "{{ mysql_command }} -L -N -s -e \"SHOW CREATE USER '{{ user_name_1 }}'@'localhost'\"" + register: new_result + when: db_version.version.major == 5 and db_version.version.minor >= 7 or db_version.version.major > 5 and db_version.version.major < 10 or db_version.version.major == 10 and db_version.version.minor >= 2 + + - name: assert user1 TLS requirements + assert: + that: "'NONE' in reqs" + vars: + - reqs: "{{(old_result is skipped | ternary(new_result, old_result)).stdout.split('REQUIRE')[1].split(separator)[0].strip() | default('NONE') }}" - include: remove_user.yml user_name={{user_name_1}} user_password={{ user_password_1 }}