Bug 1783992
| Summary: | [ansible-freeipa] not able to defines Authentication Indicators for host | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Varun Mylaraiah <mvarun> |
| Component: | ansible-freeipa | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.2 | Flags: | pm-rhel:
mirror+
|
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ansible-freeipa-0.1.8-2.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:01:56 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The choices for auth_ind in ipahost are wrong. This is fixing it:
auth_ind=dict(type='list', aliases=["krbprincipalauthind"],
default=None,
- choices=['password', 'radius', 'otp']),
+ choices=['radius', 'otp', 'pkinit', 'hardened']),
Thomas,
I have seen same issue in user-module as well.
[root@ansible ~]# cat useradd.yaml
---
- name: Playbook to handle users
hosts: ipaserver
become: true
tasks:
# Ensure user pinky is present
- ipauser:
ipaadmin_password: <xxxxx>
name: user
first: one
last: user
userauthtype: hardened
[root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts useradd.yaml
ansible-playbook 2.9.2
config file = /etc/ansible/ansible.cfg
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3.6/site-packages/ansible
executable location = /usr/bin/ansible-playbook
python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]
Using /etc/ansible/ansible.cfg as config file
PLAYBOOK: useradd.yaml ***********************************************************************************************
1 plays in useradd.yaml
PLAY [Playbook to handle users] **************************************************************************************
TASK [Gathering Facts] ***********************************************************************************************
task path: /root/useradd.yaml:2
ok: [master.ipadomain.test]
META: ran handlers
TASK [ipauser] *******************************************************************************************************
task path: /root/useradd.yaml:8
fatal: [master.ipadomain.test]: FAILED! => {"changed": false, "msg": "value of userauthtype must be one or more of: password, radius, otp. Got no match for: hardened"}
PLAY RECAP ***********************************************************************************************************
master.ipadomain.test : ok=1 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0
Here is the upstream PR: https://github.com/freeipa/ansible-freeipa/pull/172 Verified Manual execution console output: ================================ # rpm -q ansible-freeipa ansible-freeipa-0.1.8-3.el8.noarch #Test-1 :: host add with authentication indicators "otp" [root@master ~]# ipa host-find hostbz01.ipadomain.test --------------- 0 hosts matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ansible ~]# cat bz1783992a.yaml --- - name: Playbook to handle hosts hosts: ipaserver become: true tasks: - ipahost: ipaadmin_password: <XXXXXX> name: hostbz01.ipadomain.test description: Example hostbz force: yes auth_ind: otp [root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts bz1783992a.yaml ansible-playbook 2.9.5 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible-playbook python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] Using /etc/ansible/ansible.cfg as config file PLAYBOOK: bz1783992a.yaml ******************************************************************************************** 1 plays in bz1783992a.yaml PLAY [Playbook to handle hosts] ************************************************************************************** TASK [Gathering Facts] *********************************************************************************************** task path: /root/bz1783992a.yaml:2 ok: [master.ipadomain.test] META: ran handlers TASK [ipahost] ******************************************************************************************************* task path: /root/bz1783992a.yaml:7 changed: [master.ipadomain.test] => {"changed": true, "host": {}} META: ran handlers META: ran handlers PLAY RECAP *********************************************************************************************************** master.ipadomain.test : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 [root@master ~]# ipa host-find hostbz01.ipadomain.test -------------- 1 host matched -------------- Host name: hostbz01.ipadomain.test Description: Example hostbz Principal name: host/hostbz01.ipadomain.test Principal alias: host/hostbz01.ipadomain.test Authentication Indicators: otp ---------------------------- Number of entries returned 1 ---------------------------- #Test-2 :: host add with authentication indicators "radius", "otp", "pkinit", "hardened" [root@master ~]# ipa host-find hostbz02.ipadomain.test --------------- 0 hosts matched --------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ansible ~]# cat bz1783992b.yaml --- - name: Playbook to handle hosts hosts: ipaserver become: true tasks: - ipahost: ipaadmin_password: <XXXXXX> name: hostbz02.ipadomain.test description: Example hostbz force: yes auth_ind: radius,otp,pkinit,hardened [root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts bz1783992b.yaml ansible-playbook 2.9.5 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible-playbook python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] Using /etc/ansible/ansible.cfg as config file PLAYBOOK: bz1783992b.yaml ******************************************************************************************** 1 plays in bz1783992b.yaml PLAY [Playbook to handle hosts] ************************************************************************************** TASK [Gathering Facts] *********************************************************************************************** task path: /root/bz1783992b.yaml:2 ok: [master.ipadomain.test] META: ran handlers TASK [ipahost] ******************************************************************************************************* task path: /root/bz1783992b.yaml:7 changed: [master.ipadomain.test] => {"changed": true, "host": {}} META: ran handlers META: ran handlers PLAY RECAP *********************************************************************************************************** master.ipadomain.test : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 #Test-3 :: host update with authentication indicators "password" [root@master ~]# ipa host-find hostbz02.ipadomain.test -------------- 1 host matched -------------- Host name: hostbz02.ipadomain.test Description: Example hostbz Principal name: host/hostbz02.ipadomain.test Principal alias: host/hostbz02.ipadomain.test Authentication Indicators: radius, otp, pkinit, hardened ---------------------------- Number of entries returned 1 ---------------------------- [root@ansible ~]# cat bz1783992c.yaml --- - name: Playbook to handle hosts hosts: ipaserver become: true tasks: - ipahost: ipaadmin_password: <XXXXXX> name: hostbz02.ipadomain.test description: Example hostbz force: yes auth_ind: "" [root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts bz1783992c.yaml ansible-playbook 2.9.5 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible-playbook python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] Using /etc/ansible/ansible.cfg as config file PLAYBOOK: bz1783992c.yaml ******************************************************************************************** 1 plays in bz1783992c.yaml PLAY [Playbook to handle hosts] ************************************************************************************** TASK [Gathering Facts] *********************************************************************************************** task path: /root/bz1783992c.yaml:2 ok: [master.ipadomain.test] META: ran handlers TASK [ipahost] ******************************************************************************************************* task path: /root/bz1783992c.yaml:7 changed: [master.ipadomain.test] => {"changed": true, "host": {}} META: ran handlers META: ran handlers PLAY RECAP *********************************************************************************************************** master.ipadomain.test : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 Automated test console output: =============================== 2020-03-02T12:04:55 ansible_freeipa_tests/host_module.py::Testhost30_31_32::test_add_host_with_single_auth_ind 2020-03-02T12:04:55 [1m-------------------------------- live log call ---------------------------------[0m 2020-03-02T12:04:55 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipactl', 'status'] 2020-03-02T12:04:57 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-02T12:04:57 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'host-find'] 2020-03-02T12:04:58 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-02T12:04:58 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m WRITE inventory/host.hosts 2020-03-02T12:04:58 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m PUT host_module.yml 2020-03-02T12:04:58 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/host.hosts', 'host_module.yml'] 2020-03-02T12:05:03 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-02T12:05:03 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'host-find', 'myhost1783992a.ipadomain.test'] 2020-03-02T12:05:04 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-02T12:05:05 [32mPASSED[0m[36m [ 71%][0m 2020-03-02T12:05:05 ansible_freeipa_tests/host_module.py::Testhost30_31_32::test_add_host_with_multiple_auth_ind 2020-03-02T12:05:05 [1m-------------------------------- live log call ---------------------------------[0m 2020-03-02T12:05:05 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-02T12:05:05 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'host-find'] 2020-03-02T12:05:06 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-02T12:05:06 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m WRITE inventory/host.hosts 2020-03-02T12:05:06 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m PUT host_module.yml 2020-03-02T12:05:06 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/host.hosts', 'host_module.yml'] 2020-03-02T12:05:11 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-02T12:05:11 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'host-find', 'myhost1783992b.ipadomain.test'] 2020-03-02T12:05:12 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-02T12:05:12 [32mPASSED[0m[36m [ 85%][0m 2020-03-02T12:05:12 ansible_freeipa_tests/host_module.py::Testhost30_31_32::test_update_host_auth_ind 2020-03-02T12:05:12 [1m-------------------------------- live log call ---------------------------------[0m 2020-03-02T12:05:12 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-02T12:05:12 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'host-find', 'myhost1783992b.ipadomain.test'] 2020-03-02T12:05:13 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kdestroy', '-A'] 2020-03-02T12:05:13 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m WRITE inventory/host.hosts 2020-03-02T12:05:13 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m PUT host_module.yml 2020-03-02T12:05:13 [pytest_multihost.host.Host.ansible.ParamikoTransport] [32mINFO[0m RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/host.hosts', 'host_module.yml'] 2020-03-02T12:05:18 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['kinit', 'admin'] 2020-03-02T12:05:18 [pytest_multihost.host.Host.master.ParamikoTransport] [32mINFO[0m RUN ['ipa', 'host-find', 'myhost1783992b.ipadomain.test'] 2020-03-02T12:05:19 [32mPASSED[0m[36m [100%][0m 2020-03-02T12:05:19 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1705 |
Description of problem: 1) Not able to define Authentication Indicators "pkinit", "hardened" for a host. 2) Not able to reset the authentication indicator to password. Version-Release number of selected component (if applicable): ansible-freeipa-0.1.7-1.el8.noarch Steps to Reproduce: Authentication Indicator as pkinit, hardened ################################################# # cat addhost2.yaml --- - name: Playbook to handle hosts hosts: ipaserver become: true tasks: - ipahost: ipaadmin_password: <XXXXXX> name: host13.ipadomain.test description: Example host-13 force: yes auth_ind: pkinit, hardened # ansible-playbook -vv -i inventory/server.hosts addhost2.yaml ansible-playbook 2.9.2 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible-playbook python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] Using /etc/ansible/ansible.cfg as config file PLAYBOOK: addhost2.yaml ********************************************************************************************** 1 plays in addhost2.yaml PLAY [Playbook to handle hosts] ************************************************************************************** TASK [Gathering Facts] *********************************************************************************************** task path: /root/addhost2.yaml:2 ok: [master.ipadomain.test] META: ran handlers TASK [ipahost] ******************************************************************************************************* task path: /root/addhost2.yaml:7 fatal: [master.ipadomain.test]: FAILED! => {"changed": false, "msg": "value of auth_ind must be one or more of: password, radius, otp. Got no match for: pkinit, hardened"} PLAY RECAP *********************************************************************************************************** master.ipadomain.test : ok=1 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 Reset Authentication Indicator to olny password ################################################# # cat addhost2.yaml --- - name: Playbook to handle hosts hosts: ipaserver become: true tasks: - ipahost: ipaadmin_password: <XXXXXX> name: host13.ipadomain.test description: Example host-13 force: yes auth_ind: password # ansible-playbook -vv -i inventory/server.hosts addhost2.yaml ansible-playbook 2.9.2 config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible-playbook python version = 3.6.8 (default, Dec 5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)] Using /etc/ansible/ansible.cfg as config file PLAYBOOK: addhost2.yaml ********************************************************************************************** 1 plays in addhost2.yaml PLAY [Playbook to handle hosts] ************************************************************************************** TASK [Gathering Facts] *********************************************************************************************** task path: /root/addhost2.yaml:2 ok: [master.ipadomain.test] META: ran handlers TASK [ipahost] ******************************************************************************************************* task path: /root/addhost2.yaml:7 fatal: [master.ipadomain.test]: FAILED! => {"changed": false, "msg": "host_mod: host13.ipadomain.test: invalid 'auth_ind': must be one of 'radius', 'otp', 'pkinit', 'hardened'"} PLAY RECAP *********************************************************************************************************** master.ipadomain.test : ok=1 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 Actual results: 1) fatal: [master.ipadomain.test]: FAILED! => {"changed": false, "msg": "host_mod: host13.ipadomain.test: invalid 'auth_ind': must be one of 'radius', 'otp', 'pkinit', 'hardened'"} 2) fatal: [master.ipadomain.test]: FAILED! => {"changed": false, "msg": "host_mod: host13.ipadomain.test: invalid 'auth_ind': must be one of 'radius', 'otp', 'pkinit', 'hardened'"} Expected results: 1) auth_ind should work with 'pkinit', 'hardened'. 2) auth_ind should allow assigning password only as well.