You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
83 lines
3.3 KiB
83 lines
3.3 KiB
#!/usr/bin/python
|
|
|
|
DOCUMENTATION = r'''
|
|
---
|
|
module: decort_jwt
|
|
|
|
description: See L(Module Documentation,https://repository.basistech.ru/BASIS/decort-ansible/wiki/Home).
|
|
'''
|
|
|
|
import requests
|
|
|
|
from ansible.module_utils.basic import AnsibleModule
|
|
from ansible.module_utils.basic import env_fallback
|
|
|
|
|
|
def decort_jwt_parameters():
|
|
"""Build and return a dictionary of parameters expected by decort_jwt module in a form accepted
|
|
by AnsibleModule utility class"""
|
|
|
|
return dict(
|
|
app_id=dict(type='str',
|
|
required=True,
|
|
fallback=(env_fallback, ['DECORT_APP_ID'])),
|
|
app_secret=dict(type='str',
|
|
required=True,
|
|
fallback=(env_fallback, ['DECORT_APP_SECRET']),
|
|
no_log=True),
|
|
oauth2_url=dict(type='str',
|
|
required=True,
|
|
fallback=(env_fallback, ['DECORT_OAUTH2_URL'])),
|
|
validity=dict(type='int',
|
|
required=False,
|
|
default=3600),
|
|
verify_ssl=dict(type='bool', required=False, default=True),
|
|
workflow_callback=dict(type='str', required=False),
|
|
workflow_context=dict(type='str', required=False),
|
|
)
|
|
|
|
def main():
|
|
module_parameters = decort_jwt_parameters()
|
|
|
|
amodule = AnsibleModule(argument_spec=module_parameters,
|
|
supports_check_mode=True,)
|
|
|
|
result = {'failed': False, 'changed': False}
|
|
|
|
token_get_url = amodule.params['oauth2_url'] + "/v1/oauth/access_token"
|
|
req_data = dict(grant_type="client_credentials",
|
|
client_id=amodule.params['app_id'],
|
|
client_secret=amodule.params['app_secret'],
|
|
response_type="id_token",
|
|
validity=amodule.params['validity'],)
|
|
# TODO: Need standard code snippet to handle server timeouts gracefully
|
|
# Consider a few retries before giving up or use requests.Session & requests.HTTPAdapter
|
|
# see https://stackoverflow.com/questions/15431044/can-i-set-max-retries-for-requests-request
|
|
|
|
# catch requests.exceptions.ConnectionError to handle incorrect oauth2_url case
|
|
try:
|
|
token_get_resp = requests.post(token_get_url, data=req_data, verify=amodule.params['verify_ssl'])
|
|
except requests.exceptions.ConnectionError as errco:
|
|
result.update(failed=True)
|
|
result['msg'] = "Failed to connect to {}: {}".format(token_get_url, errco)
|
|
amodule.fail_json(**result)
|
|
except requests.exceptions.Timeout as errti:
|
|
result.update(failed=True)
|
|
result['msg'] = "Timeout when trying to connect to {}: {}".format(token_get_url, errti)
|
|
amodule.fail_json(**result)
|
|
|
|
# alternative -- if resp == requests.codes.ok
|
|
if token_get_resp.status_code != 200:
|
|
result.update(failed=True)
|
|
result['msg'] = "Failed to obtain JWT access token from oauth2_url {} for app_id {}: {} {}".format(
|
|
token_get_url, amodule.params['app_id'],
|
|
token_get_resp.status_code, token_get_resp.reason)
|
|
amodule.fail_json(**result)
|
|
|
|
# Common return values: https://docs.ansible.com/ansible/2.3/common_return_values.html
|
|
result['jwt'] = token_get_resp.content.decode('utf8')
|
|
amodule.exit_json(**result)
|
|
|
|
if __name__ == '__main__':
|
|
main()
|