Package: digdeo-syspass-ansible-lookup
digdeo-ansible-syspassModule page:https://pypi.org/project/digdeo-syspass-ansible-lookup/Documentation:https://www.readthedoc.io/digdeo-syspass-ansible-lookupBug Tracker:https://gitdev.digdeo.fr/digdeo-projets-floss1/digdeo-syspass-ansible-lookup/issuesIntroductiondigdeo-ansible-syspassis aansiblelookupplugin write inpython.That program is aansibleplugin interface it usedigdeo-syspass-clientto dialog with thesyspassAPI.It plugin is dedicated to lookup password's from asyspassserver.InstallationNormal installationpython3-mvenvvenv
.venv/bin/activate
pipinstalldigdeo-syspass-ansible-lookupForce a Ansible versionpython3-mvenvvenv
.venv/bin/activate
pipinstallwheel"ansible == 2.7.17"pipinstalldigdeo-syspass-ansible-lookupForce libxmlOn Linux (and most other well-behaved operating systems), pip will manage to build the source distribution as long aslibxml2andlibxsltare properly installed, including development packages, i.e. header files, etc.See the requirements section above and use your system package management tool to look for packages likelibxml2-devorlibxslt-devel. If the build fails, make sure they are installed.Alternatively, settingSTATIC_DEPS=truewill download and build both libraries automatically in their latest version, e.g.STATIC_DEPS=truepipinstalllxml.Note that module usedigdeo-syspass-clientpython module
Please pay attention about config.yml file in case you need more information's.DISCLAIMER:This module has been heavily inspired byhttps://github.com/ansible/ansible/blob/devel/lib/ansible/plugins/lookup/password.pyfor password generation and term handling and thus is under GPL.lookup: syspass
author: Gousseaud Gaëtan <gousseaud.gaetan.pro@gmail.com>, Pierre-Henry Muller <pierre-henry.muller@digdeo.fr>, Jérôme Ornech <jornech@digdeo.fr>
short_description: get syspass user password and syspass API client
description:
- This lookup returns the contents from Syspass database, a user's password more specificly. Other functions are also implemented for further use.
ansible_version: ansible 2.7.17 and more with mitogen
python_version: 3.5 and more
syspass_version: 3.0, 3.1Ansible usage:Example 1Vars set inside common ansible sub-structure directoryIn case you use the group nameall.Create a sub directory structure./group_vars/alland enter inside it directorycopy paste you variable with right value inside a file namesyspass.ymlsyspass_auth_token: ##################################################
syspass_token_pass: ##################################################
syspass_verify_ssl: True
syspass_api_url: ##################################################
syspass_api_version: 3.1
syspass_debug: False
syspass_debug_level: 3
syspass_verbose: True
syspass_verbose_level: 3start you playbook withansible-playbook playbook.ymlExample 2Vars set inside the playbook fileIn case you use the group nameallthe playbook can look like that:--- # -*- mode: yaml; coding: utf-8 -*-

- hosts: all
  vars:
    syspass_default_length: 42
    syspass_auth_token: ##################################################
    syspass_token_pass: ##################################################
    syspass_verify_ssl: True
    syspass_api_url: ##################################################
    syspass_api_version: 3.1
    syspass_debug: False
    syspass_debug_level: 3
    syspass_verbose: True
    syspass_verbose_level: 3
  tasks:
    - name: SysPass | Force virtual Environement
      set_fact:
        ansible_python_interpreter: "/usr/bin/env python"
    - name: SysPass | Minimal test | get and if not exist insert
      debug:
        msg: "{{ lookup('syspass', 'Account Name minimal', login='mylogin', category='MySQL', customer='PREP') }}"
      register: pass1
      changed_when: false
    - name: SysPass | Minimal test | get and compare
      debug:
        msg: "{{ lookup('syspass', 'Account Name minimal', login='mylogin', category='MySQL', customer='PREP') }}"
      register: pass2
      changed_when: pass1.msg == pass2.msg
      failed_when: pass1.msg != pass2.msgAnsible Vault usage:In case you use the group nameall.Create a sub directory structure./group_vars/alland enter inside it directoryuse command line interface for createsyspass.ymlfileansible-vault create syspass.ymledit thesyspass.ymlfileansible-vault edit syspass.ymlcopy paste you variable with right value insidesyspass.ymlfilesyspass_auth_token: ##################################################
syspass_token_pass: ##################################################
syspass_verify_ssl: True
syspass_api_url: ##################################################
syspass_api_version: 3.1
syspass_debug: False
syspass_debug_level: 3
syspass_verbose: True
syspass_verbose_level: 3create a file to store the vault passwordecho "password1234" > /my_directory/vault_passwd"export env varDEFAULT_VAULT_PASSWORD_FILEviaexport DEFAULT_VAULT_PASSWORD_FILE="/my_directory/vault_passwd"start you playbook withansible-playbook --vault-password-file=$DEFAULT_VAULT_PASSWORD_FILE playbook.ymlSummary> cd directory_where_is_my_ansible.cfg_file
> mkdir -p group_vars/all
> cd group_vars/all
> ansible-vault create syspass.yml
New Vault password: 
Confirm New Vault password: 
> ansible-vault edit syspass.yml
Vault password:
syspass_auth_token: ##################################################
syspass_token_pass: ##################################################
syspass_verify_ssl: True
syspass_api_url: ##################################################
syspass_api_version: 3.1
syspass_debug: False
syspass_debug_level: 3
syspass_verbose: True
syspass_verbose_level: 3
~                                                                                                                                                                                         
~                                                                                                                                                                                         
~                                                                                                                                                                                         
~                                                                                                                                                                                         
-- INSERTION --    
^Z :wq
> export DEFAULT_VAULT_PASSWORD_FILE="/my_private_directory/vault_passwd"
> echo "password1234" > $DEFAULT_VAULT_PASSWORD_FILE
> cd directory_where_is_my_ansible.cfg_file
> ansible-playbook --vault-password-file=$DEFAULT_VAULT_PASSWORD_FILE playbooks/playbook.ymlParameters:chars: (Optional)Type of chars used during a password generation,Allowed value:ascii_letters,digits,allowed_punctuationDefault value: ['ascii_letters','digits','allowed_punctuation']psswd_length: (Optional)password length, during a password generation, that value is automatically clamped frompassword_length_minandpassword_length_maxDefault value: 42password: (Optional)Directly impose a password, it shortcut the password generationhostname: (Optional is set by Ansible)Require by Ansible, it correspond to Ansible host, you can impose a specific host from hereaccount:Match with Syspass API Accounthttps://syspass-doc.readthedocs.io/en/3.1/application/api.html#accountslogin:login given to created accountcategory:Match with Syspass API Categorieshttps://syspass-doc.readthedocs.io/en/3.1/application/api.html#categoriescustomer:Match with Syspass API Clientshttps://syspass-doc.readthedocs.io/en/3.1/application/api.html#clientscustomer_desc: (Optional)Match with Syspass API Clients creation/descriptionhttps://syspass-doc.readthedocs.io/en/3.1/application/api.html#clientstags:Match with Syspass API Tagshttps://syspass-doc.readthedocs.io/en/3.1/application/api.html#tagsurl:url given to created account (Optional)notes:notes given to created account (Optional)state:Default Value:presentAllowed Value:presentorabsentprivate: self.private,is this password private for users who have access or public for all users in acl (default false)privategroup: self.privategroup,is private only for users in same group (default false)expireDate: self.expireDateexpiration date given to created account (Optional)Allowed Value: Expire date in UNIX timestamp formatnotes:Account is only created if exact name has no match.A different field passed to an already existing account wont modify it.Utility of tokenPass:https://github.com/nuxsmin/sysPass/issues/994#issuecomment-409050974Rudimentary list of API accesses (Deprecated):https://github.com/nuxsmin/sysPass/blob/d0056d74a8a2845fb3841b02f4af5eac3e4975ed/lib/SP/Services/Api/ApiService.php#L175Usage of ansible vars:https://github.com/ansible/ansible/issues/33738#issuecomment-350819222syspass function list:
    SyspassClient:
      Account:
        -AccountSearch
        -AccountViewpass
        -AccountCreate
        -AccountDelete
        -AccountView
      Category:
        -CategorySearch
        -CategoryCreate
        -CategoryDelete
      Client:
        -ClientSearch
        -ClientCreate
        -ClientDelete
      Tag:
        -TagCreate
        -TagSearch
        -TagDelete
      UserGroup:
        - UserGroupCreate
        - UserGroupSearch
        - UserGroupDelete
      Others:
        -BackupIN PLAYBOOKNOTE: Default values are handledUSAGE 1- name: SysPass | Minimal test | get and if not exist insert
      debug:
        msg: "{{ lookup('syspass', 'Account Name minimal', login='mylogin', category='MySQL', customer='PREP') }}"
      register: pass1
      changed_when: false

    - name: SysPass | Minimal test | get and compare
      debug:
        msg: "{{ lookup('syspass', 'Account Name minimal', login='mylogin', category='MySQL', customer='PREP') }}"
      register: pass2
      changed_when: pass1.msg == pass2.msg
      failed_when: pass1.msg != pass2.msgAuthors:
Gousseaud Gaëtangousseaud.gaetan.pro@gmail.comPierre-Henry Mullerpierre-henry.muller@digdeo.frJérôme Ornechi.dont.share.my.mail@nothing.fr