From 2a4c00c01586f51623ea2fbe56c0c80bff9eb02a Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 28 Jun 2024 14:45:40 +0100 Subject: [PATCH] Add user password reset and ability to disable an account --- ansible/roles/win_user/defaults/main.yml | 1 + ansible/roles/win_user/tasks/assert.yml | 80 ++++++++++++++++++++++++ ansible/roles/win_user/tasks/check.yml | 44 ------------- ansible/roles/win_user/tasks/create.yml | 3 +- ansible/roles/win_user/tasks/disable.yml | 9 +++ ansible/roles/win_user/tasks/main.yml | 4 +- ansible/roles/win_user/tasks/reset.yaml | 14 +++++ ansible/roles/win_user/vars/main.yml | 4 +- 8 files changed, 110 insertions(+), 49 deletions(-) create mode 100644 ansible/roles/win_user/defaults/main.yml create mode 100644 ansible/roles/win_user/tasks/assert.yml delete mode 100644 ansible/roles/win_user/tasks/check.yml create mode 100644 ansible/roles/win_user/tasks/disable.yml create mode 100644 ansible/roles/win_user/tasks/reset.yaml diff --git a/ansible/roles/win_user/defaults/main.yml b/ansible/roles/win_user/defaults/main.yml new file mode 100644 index 0000000..588d16d --- /dev/null +++ b/ansible/roles/win_user/defaults/main.yml @@ -0,0 +1 @@ +user_action: create \ No newline at end of file diff --git a/ansible/roles/win_user/tasks/assert.yml b/ansible/roles/win_user/tasks/assert.yml new file mode 100644 index 0000000..5e45940 --- /dev/null +++ b/ansible/roles/win_user/tasks/assert.yml @@ -0,0 +1,80 @@ +--- + +- name: Check User Action + ansible.builtin.assert: + that: + - user_action is defined + - user_action is string + - user_action is in valid_actions + quiet: true + +- name: Check User information + block: + - name: Check Username + ansible.builtin.assert: + that: + - username is defined + - username is string + - username is not none + - username|length <= 20 + quiet: true + + - name: Check User Info + ansible.builtin.assert: + that: + - study_code is defined + - password is defined + - firstname is defined + - lastname is defined + - email is defined + - user_role is defined + quiet: true + when: user_action == 'create' + +- name: Check Study folder & group + block: + - name: Check AD group exists + win_domain_group: + name: "{{ study_code }}" + description: "{{ study_code }} study" + path: "ou=Project Groups,dc={{ win_project }},dc=loc" + scope: domainlocal + category: security + state: present + check_mode: true + changed_when: false + register: group + failed_when: group.created == true + + - name: Check if Folder Created + win_stat: + path: "{{ study_folder }}" + register: folder + delegate_to: "{{ os_project }}-{{ win_project }}-fs01" + failed_when: folder.stat.exists == false + +- name: Verify User + block: + - name: Get User account status + win_domain_user: + name: "{{ username }}" + state: query + register: user + + - name: Check user doesn't already exist + ansible.builtin.assert: + that: + - user.state == 'absent' + msg: "Trying to create a user that already exists." + quiet: true + when: user_action == 'create' + + - name: Check user exist + ansible.builtin.assert: + that: + - user.state == 'present' + msg: "Trying to modify a user that doesn't exists." + quiet: true + when: user_action != 'create' + + diff --git a/ansible/roles/win_user/tasks/check.yml b/ansible/roles/win_user/tasks/check.yml deleted file mode 100644 index ae6da98..0000000 --- a/ansible/roles/win_user/tasks/check.yml +++ /dev/null @@ -1,44 +0,0 @@ ---- -- name: Check user - tags: check_user - block: - - name: Verify study group exists - win_domain_group: - name: "{{ study_code }}" - description: "{{ study_code }} study" - path: "ou=Project Groups,dc={{ win_project }},dc=loc" - scope: domainlocal - category: security - state: present - check_mode: true - changed_when: false - register: group - - - name: Check if study folder already exists - win_stat: - path: "{{ study_folder }}" - register: folder - delegate_to: "{{ os_project }}-{{ win_project }}-fs01" - - - name: Verify User does not already exist - win_domain_user: - name: "{{ username }}" - state: query - register: user - - - name: Duplicate User Detected - fail: - msg="This study has not been created yet" - when: group.created == true or - folder.stat.exists == false - - - name: Duplicate User Detected - fail: - msg="This User already exists" - when: user.state == "present" - - - - - - diff --git a/ansible/roles/win_user/tasks/create.yml b/ansible/roles/win_user/tasks/create.yml index 6d98580..d271f22 100644 --- a/ansible/roles/win_user/tasks/create.yml +++ b/ansible/roles/win_user/tasks/create.yml @@ -1,9 +1,8 @@ --- - name: Create AD user - tags: create_user block: - name: Create user in AD - win_domain_user: + microsoft.ad.user: name: "{{ username }}" firstname: "{{ firstname }}" surname: "{{ lastname }}" diff --git a/ansible/roles/win_user/tasks/disable.yml b/ansible/roles/win_user/tasks/disable.yml new file mode 100644 index 0000000..ccd1473 --- /dev/null +++ b/ansible/roles/win_user/tasks/disable.yml @@ -0,0 +1,9 @@ +--- +- name: Disable AD user + block: + - name: Disable user in AD + microsoft.ad.user: + name: "{{ username }}" + path: ou=Project Users,dc={{ win_project }},dc=loc + state: present + enabled: no \ No newline at end of file diff --git a/ansible/roles/win_user/tasks/main.yml b/ansible/roles/win_user/tasks/main.yml index f391fd0..da55724 100644 --- a/ansible/roles/win_user/tasks/main.yml +++ b/ansible/roles/win_user/tasks/main.yml @@ -1,3 +1,3 @@ --- -- import_tasks: check.yml -- import_tasks: create.yml +- import_tasks: assert.yml +- import_tasks: "{{ user_action }}.yml" diff --git a/ansible/roles/win_user/tasks/reset.yaml b/ansible/roles/win_user/tasks/reset.yaml new file mode 100644 index 0000000..de25b36 --- /dev/null +++ b/ansible/roles/win_user/tasks/reset.yaml @@ -0,0 +1,14 @@ +--- +- name: Reset AD user password + block: + - name: debug + debug: + var: password + + - name: Reset AD user password + microsoft.ad.user: + name: "{{ username }}" + path: ou=Project Users,dc={{ win_project }},dc=loc + password: "{{ password }}" + password_expired: true + state: present diff --git a/ansible/roles/win_user/vars/main.yml b/ansible/roles/win_user/vars/main.yml index 837571f..cf0173c 100644 --- a/ansible/roles/win_user/vars/main.yml +++ b/ansible/roles/win_user/vars/main.yml @@ -1 +1,3 @@ -study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }} \ No newline at end of file +study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }} + +valid_actions: ["create", "reset", "disable"] \ No newline at end of file