* passwordstore: Make compatible with shims, add backend config
This allows using the passwordstore plugin with scripts that wrap other
password managers. Also adds an explicit configuration (`backend` in
`ini` and `passwordstore_backend` in `vars`) to set the backend to `pass`
(the default) or `gopass`, which allows using gopass as the backend
without the need of a wrapper script. Please be aware that gopass
support is currently limited, but will work for basic operations.
Includes integrations tests.
Resolves#4766
* Apply suggestions from code review
(cherry picked from commit 006f3bfa89)
Co-authored-by: grembo <freebsd@grem.de>
* Get first found configuration file
There are three valid places to get the configuration.
https://developer.1password.com/docs/cli/about-biometric-unlock#remove-old-account-information
* Use common config class
* Add changelog fragment
* Explicitly use new style classes for Python 2.7 compatibility
This shouldn’t matter for lookups, but does matter for module_utils
and modules since Python 2.7 is still supported on the managed node.
* Update changelogs/fragments/4065-onepassword-config.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Add error handling to check correct SDK version installed
* Fix CI errors
* Added changelog fragment
* Changed exeption type
* Update changelogs fragment
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* passwordstore: Add configurable locking
Passwordstore cannot be accessed safely in parallel, which causes
various issues:
- When accessing the same path, multiple different secrets are
returned when the secret didn't exist (missing=create).
- When accessing the same _or different_ paths, multiple pinentry
dialogs will be spawned by gpg-agent sequentially, having to enter
the password for the same gpg key multiple times in a row.
- Due to issues in gpg dependencies, accessing gpg-agent in parallel
is not reliable, causing plays to fail (this can be fixed by adding
`auto-expand-secmem` to _~/.gnupg/gpg-agent.conf_ though).
These problems have been described in various github issues in the past,
e.g., ansible/ansible#23816 and ansible/ansible#27277.
This cannot be worked around in playbooks by users in a non-error-prone
way.
It is addressed by adding new configuration options:
- lock:
- readwrite: Lock all operations
- write: Only lock write operations (default)
- none: Disable locking
- locktimeout: Time to wait for getting a lock (s/m/h suffix)
(defaults to 15m)
These options can also be set in ansible.cfg, e.g.:
[passwordstore_lookup]
lock=readwrite
locktimeout=30s
Also, add a note about modifying gpg-agent.conf.
* Tidy up locking config
There is no reason why lock configuration should be part of self.paramvals.
Now locking and its configuration happen all in one place.
* Change timeout description wording to the suggested value.
* Rearrange plugin setup, apply PR feedback
The passwordstore lookup plugin depends on parsing GnuPG's
error messages in English language. As a result, detection of
a specific error failes when users set a different locale.
This change corrects this by setting the `LANGUAGE` environment
variable to `C` when invoking `pass`, as this only affects
gettext translations.
See
https://www.gnu.org/software/gettext/manual/html_node/The-LANGUAGE-variable.html
Given a password stored in _path/to/secret_, requesting the password
_path/to_ will literally return `path/to`. This can lead to using
weak passwords by accident/mess up logic in code, based on the
state of the password store.
This is worked around by applying the same logic `pass` uses:
If a password was returned, check if there is a .gpg file it could
have come from. If not, treat it as missing.
Fixesansible-collections/community.general#4185
* Added token parameter for AccessTokenAuthorizer
Parameters username and password are not required anymore because of
this.
* Added changelog fragments
* Apply suggestions from code review
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
* token authorizer is prioritized
token authorizer is prioritized when token parameter is set
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
* domain optional if token not provided
* Updated examples
- `base_url` is required everywhere
- examples for user, name + domain authorization included
- token authorization included
* Update 3327-tss-token-authorization.yml
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Add option for retry_servfail
cf. https://dnspython.readthedocs.io/en/latest/resolver-class.html#dns.resolver.Resolver.retry_servfail
Setting this option to `True` allows for the possibility of the lookup plugin to retry and thereby recover from potentially transient lookup failures, which would otherwise cause the task or play to bail with an unrecoverable exception.
* Create 3247-retry_servfail-for-dig
* documentation for `retry_servfail` option
* Rename 3247-retry_servfail-for-dig to 3247-retry_servfail-for-dig.yaml
* fix whitespace
* Update plugins/lookup/dig.py
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
* Update plugins/lookup/dig.py
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
* rm try/except block
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
* Added fix for bug report in issue #3192
* Added changelog fragment
* Typo fix
* Added Importerror to exception - as req by linters
* Moved the conditional import statement to try/except block
* Updated the plugin to reflect breaking changes introduced in the underlying SDK v1.0.0 update.
* Added Changelog fragment
* Updates based on feedback/review
* Added newline to pass CI
* Added whitepace for linter
* Update changelogs/fragments/3139-tss-lookup-plugin-update-to-make-compatible-with-sdk-v1.yml
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
* added utf-8 markers to all .py files in plugins/filter
* added utf-8 markers to all .py files in plugins/inventory
* added utf-8 markers to all .py files in plugins/lookup
* Wire token param into consul_api #2124
* Update changelogs/fragments/2124-consul_kv-pass-token.yml
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* #2124 renamed release fragment to match pr, removed parse_params.
* putting look back in, do some linting #2124
* try more linting
* linting
* try overwriting defaults in parse_params with get_option vals, instead of removing that function completely.
* Revert "back to start, from 2nd approach: allow keyword arguments via parse_params for compatibility."
This reverts commit 748be8e366.
* Revert " linting"
This reverts commit 1d57374c3e.
* Revert " try more linting"
This reverts commit 91c8d06e6a.
* Revert "putting look back in, do some linting #2124"
This reverts commit 87eeec7180.
* Revert " #2124 renamed release fragment to match pr, removed parse_params."
This reverts commit d2869b2f22.
* Revert "Update changelogs/fragments/2124-consul_kv-pass-token.yml"
This reverts commit c50b1cf9d4.
* Revert "Wire token param into consul_api #2124"
This reverts commit b60b6433a8.
* minimal chnages for this PR relative to current upstream.
* superfluous newline in changlog fragment.
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
Add ability to ignore error on missing pass file to allow processing the
output further via another filters (mainly the default filter) without
updating the pass file itself.
It also contains the option to create the pass file, like the option
create=true does.
Finally, it also allows to issue a warning only, if the pass file is not
found.
* Add dependent lookup plugin.
* Use correct YAML booleans.
* Began complete rewrite.
* Only match start of error msg.
* Improve tests.
* Work around old Jinja2 versions.
* Fix metadata.
* Fix filter name.
* convert string returned by plugin to unicode
* add changelog fragment
* fix changelog format
* fix changelog format yet again
Co-authored-by: Anubhav Chakraborty <anubchak@cisco.com>
* with_filetree: use splitext for compatibility with template
The example code given deploys files with their .j2 extensions intact, which is probably not what you want.
* Explain how templates interact with splitext|first
* Update plugins/lookup/filetree.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Don't encourage setting the mode of symlinks
On ext4, maybe most filesystems, symlinks always have the artificial mode of 0777, and `chmod $mode $symlink` *writes through* the symlink to its target file.
An effect of this is that if you deploy a file and a symlink to it (e.g. this common situation: /etc/nginx/sites-available/default and /etc/nginx/sites-enabled/default -> ../sites-available/default) then `with_filetree` will forever first deploy the file with the right mode, then corrupt its mode to 0777, and every redeploy will see a change to fix, forever in a loop.
Probably `file:` should refuse `mode:` on `state: link`s, but in the meantime, avoid recommending it in `filetree`
* Use `follow: false` instead of just the mode.
This should be more cross-compatible.
https://github.com/ansible-collections/community.general/pull/2285#discussion_r616571873
* Update plugins/lookup/filetree.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Adding another example for tss lookup
A more detailed example using self-hosted secrets server as investigated in #1943
* Update plugins/lookup/tss.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Better line breaking
* Update plugins/lookup/tss.py
Seconded!
Co-authored-by: Felix Fontein <felix@fontein.de>
* Remove newline to pass tests
* Update plugins/lookup/tss.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* fix passwordstore.py to be compatible with gopass.
...even when used with create=true.
The same output snippet matches for both, `pass` and `gopass`, but while `pass` returns `1` on a non-existant password, `gopass` returns `10`, or `11`, depending on whether a similar named password was stored.
So I'd propose to change `e.returncode == 1` to `e.returncode != 0` to cover both cases here.
What do you think?
* Update passwordstore.py, fix typo
* Add changelog fragment.
* Update changelogs/fragments/1589-passwordstore-fix-passwordstore.py-to-be-compatible-with-gopass.yaml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update changelogs/fragments/1589-passwordstore-fix-passwordstore.py-to-be-compatible-with-gopass.yaml
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Find the password field out of the fields list
With the command line utility `op` version 1.8, the password field exists, while the fields list is empty. This will look for the desired field without it being listed in the fields list.
* Add changelog fragment
* Update changelogs/fragments/1610-bugfix-onepassword-lookup-plugin.yaml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/lookup/onepassword.py
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update tss.py - multiline for an example
Extended line runs past the side of the browser window
* Moved multiline to after the msg.
Cannot believe I missed that again.
* Updated tss.py
Using > as multiline joiner with spaces
