Repository: ansible-collections/community.general

Issue:
ipa_user doesn't handle comments in ssh public keys that are separated by spaces
### Summary

Using a public ssh key fingerprint that is valid syntax for .authorized_keys and in IPA which has a comment that is more than 1 string (1 block of characters that is not separated by any whitespace), causes the ipa_user module to fail when calling the ipa_user module with no changes.  Said another way, when calling ipa_user for a brand new user, the ipa_user module will succeed.  Subsequent calls to the same parameters will fail with the message ("msg": "response user_mod: no modifications to be performed").  This was eventually traced to the get_ssh_key_fingerprint function, which assumes that the comment is only a single block of text.  It uses the split() string function to isolate the key type, key, and comments and then assumes that the comment is in index position [2].

For example, the following ssh key passed in as the sshpubkey will have no issue with idempotency:
```
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCwzh+C4XxgB0mce2+bB+rt9mF9nNBYtuCO82EHxACMWpsdz6vFjvM3StA0R44YFT2b5tHFa2+tbvMSHL0lYpPpIhNOUPkQ4DpTv+22ehpDN1/86yEF2UeG0PJIKpxLg9XQbybqNxSxWyrJDJshZvDu0WvWTtihE2twC2vbOKziHw== host1
```
But the following will have an issue:
```
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCwzh+C4XxgB0mce2+bB+rt9mF9nNBYtuCO82EHxACMWpsdz6vFjvM3StA0R44YFT2b5tHFa2+tbvMSHL0lYpPpIhNOUPkQ4DpTv+22ehpDN1/86yEF2UeG0PJIKpxLg9XQbybqNxSxWyrJDJshZvDu0WvWTtihE2twC2vbOKziHw== test1 keys
```

The comments in the code were helpful to see the root of the assumption:
```
Return the public key fingerprint of a given public SSH key in format "[fp] [user@host] (ssh-rsa)"
```
I have used comments in my ssh keys that are multi-words long and more descriptive, but I understand the format user@host could be very common.  I tried to look up to see what the format of the comment is allowed to be to see if my usage is disallowed or permitted by the standard, but with a less than crystal clear result.  In the man page for openssh https://man.openbsd.org/sshd.8 the page states that for known_hosts, the comment continues to the end of the line.  It doesn't actually say anything on the topic for authorized_keys, except to note that the 'The comment field is not used for anything (but may be convenient for the user to identify the key).'

Although I have used it like this for many years and it appears to be supported in IPA and authorized_keys, I am unsure if it is proper use.  I will make a small pull request to accommodate the whitespace inclusive comment field (multiple 'words'), but if that is deemed 'wrong', I would suggest that at the least a documentation update is made to clarify the permitted format of the sshpubkey field to indicate that the comment must be one non-whitespace unit (or further validation in the module for if the split has length greater than 3).

### Issue Type

Bug Report

### Component Name

ipa_user

### Ansible Version

```console (paste below)
$ ansible --version
ansible 2.9.18
```


### Configuration

```console (paste below)
$ ansible-config dump --only-changed
(empty)
```


### OS / Environment

Centos 7 controlling a Centos 8 IPA server.  (IPA 4.8.7, API version 2.239)

### Steps to Reproduce

```yaml
- name: Create newuser1
  community.general.ipa_user:
    name: newuser1
    givenname: New User
    sn: User
    sshpubkey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCwzh+C4XxgB0mce2+bB+rt9mF9nNBYtuCO82EHxACMWpsdz6vFjvM3StA0R44YFT2b5tHFa2+tbvMSHL0lYpPpIhNOUPkQ4DpTv+22ehpDN1/86yEF2UeG0PJIKpxLg9XQbybqNxSxWyrJDJshZvDu0WvWTtihE2twC2vbOKziHw== test1 keys"
    ipa_host: IPA_HOST
    ipa_user: USERNAME
    ipa_pass: PASSWORD
```


### Expected Results

Multiple calls with the same sshpubkey, even with multi-word comments, returns with no errors.

### Actual Results

```console (paste below)
"msg": "response user_mod: no modifications to be performed"
```


### Code of Conduct

I agree to follow the Ansible Code of Conduct


Discussion:
Files identified in the description:
* [`plugins/modules/identity/ipa/ipa_user.py`](https://github.com/ansible-collections/community.general/blob/master/plugins/modules/identity/ipa/ipa_user.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @Akasurde @Nosmoht @fxfitz
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->

Resolving patch:
diff --git a/plugins/modules/identity/ipa/ipa_user.py b/plugins/modules/identity/ipa/ipa_user.py
--- a/plugins/modules/identity/ipa/ipa_user.py
+++ b/plugins/modules/identity/ipa/ipa_user.py
@@ -269,16 +269,18 @@ def get_user_diff(client, ipa_user, module_user):
 def get_ssh_key_fingerprint(ssh_key, hash_algo='sha256'):
     """
     Return the public key fingerprint of a given public SSH key
-    in format "[fp] [user@host] (ssh-rsa)" where fp is of the format:
+    in format "[fp] [comment] (ssh-rsa)" where fp is of the format:
     FB:0C:AC:0A:07:94:5B:CE:75:6E:63:32:13:AD:AD:D7
     for md5 or
     SHA256:[base64]
     for sha256
+    Comments are assumed to be all characters past the second
+    whitespace character in the sshpubkey string.
     :param ssh_key:
     :param hash_algo:
     :return:
     """
-    parts = ssh_key.strip().split()
+    parts = ssh_key.strip().split(None, 2)
     if len(parts) == 0:
         return None
     key_type = parts[0]
@@ -293,8 +295,8 @@ def get_ssh_key_fingerprint(ssh_key, hash_algo='sha256'):
     if len(parts) < 3:
         return "%s (%s)" % (key_fp, key_type)
     else:
-        user_host = parts[2]
-        return "%s %s (%s)" % (key_fp, user_host, key_type)
+        comment = parts[2]
+        return "%s %s (%s)" % (key_fp, comment, key_type)
 
 
 def ensure(module, client):


Test patch: