Conversation
|
Note that there's no documentation yet and the actual plugin is very lightly tested. I wanted some feedback from @drybjed first to know if the general idea is acceptable before I sink more time into this.... |
9bfb8b8 to
676e0b2
Compare
drybjed
left a comment
There was a problem hiding this comment.
The idea looks sound. I would need to spin an LDAP environment to test it, but I trust that you use it in some capacity already and it works as expected.
At least some documentation would improve things. Can you add a comment that explains where the value of UUID_NAMESPACE_ANSIBLE comes from? IIRC, it's from the Ansible to_uuid filter which uses a static string as a random seed to ensure idempotency.
I can merge it now or wait for some documentation. Let me know which one you prefer.
Yeah, I've use it both in devel and production for a couple of months.
Correct
I think it can wait a bit, that way I can add the docs and also go through the current codebase and see if there's any new tasks which need to be updated to use the plugin... |
676e0b2 to
216a27f
Compare
216a27f to
343874d
Compare
Ok, I've added the docs, gone through the current codebase, and run the end result through a test run...all seems ok to me...I'd say this is ready to merge now @drybjed |
|
Hi, I just came across this issue when I wanted to make another proposal: instead of using ansible But the approach of @Alphix is even better I think. How is the directory structured? And how is the password file named? Still with uuid? In this case you could combine the approaches and use b64encode. How is backward compatibility planned? |
With my approach there's no difference in directory structure....uuid encoded files are still generated under So backward compatibility is not a problem....and old entries will still be appended to |
ok. Very nice. |
On my devel machine, I have a couple of hundred files under ansible/secret/ldap/credentials/, with no easy way to determine which are still relevant and which aren't. This patch adds a new lookup plugin named "ldap_password", which works in much the same way as the traditional "password" plugin, but adapted to match the LDAP password storage scheme used by DebOps. Instead of a single argument (path and options as one string), the new lookup takes three arguments: base directory, DN, and password options. The plugin will automatically log the UUID <-> DN mapping in a file in the base directory as part of the password generation process.
343874d to
e5b8b88
Compare
On my devel machine, I have a couple of hundred files under ansible/secret/ldap/credentials/, with no easy way to determine which are still relevant and which aren't.
This patch adds a new lookup plugin named "ldap_password", which works in much the same way as the traditional "password" plugin, but adapted to match the LDAP password storage scheme used by DebOps.
Instead of a single argument (path and options as one string), the new lookup takes three arguments: base directory, DN, and password options.
The plugin will automatically log the UUID <-> DN mapping in a file in the base directory as part of the password generation process.