everpure.flasharray.purefa_localuser module – Manage Everpure FlashArray local users

Note

This module is part of the everpure.flasharray collection (version 1.46.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flasharray. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flasharray.purefa_localuser.

New in everpure.flasharray 1.45.0

Synopsis 

Create, rename, reconfigure and delete users inside a local directory service on Everpure FlashArrays, and manage the groups they belong to.
Every user belongs to one local directory service, which is managed by everpure.flasharray.purefa_lds. User names are only unique within a service, so local_directory_service is always required. The groups a user joins are managed by everpure.flasharray.purefa_localgroup.
Each local directory service is created holding its own Administrator and Guest users. Those are built-in - the array allows them to be modified, which is how a password is set on a new service’s Administrator, but not deleted.

Requirements 

The below requirements are needed on the host that executes this module.

python >= 3.3
purestorage >= 1.19
py-pure-client >= 1.88.0
netaddr
requests
pycountry
urllib3

Parameters 

Parameter	Comments
api_token string	FlashArray API token for admin privileged user.
client_id string added in everpure.flasharray 1.43.0	ID of the API Client that issues the identity token. Used with private_key_file.
context string	Name of fleet member on which to perform the operation. This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet. Default: `""`
disable_warnings boolean added in everpure.flasharray 1.29.0	Disable insecure certificate warnings in debug logs Choices: `false` ← (default) `true`
email string	Email address to associate with the user.
enabled boolean	Whether the user is allowed to authenticate. Choices: `false` `true`
fa_url string	FlashArray management IPv4 address or Hostname.
groups list / elements=string	The groups the user belongs to besides primary_group. This is declarative - groups not in the list are left, and the user is removed from any others. Omit it to leave the user’s groups alone. The primary group is always a membership and is ignored if listed here.
id_token string added in everpure.flasharray 1.43.0	A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient).
issuer string added in everpure.flasharray 1.43.0	The API Client’s trusted identity issuer registered on the array. Used with private_key_file.
key_id string added in everpure.flasharray 1.43.0	Key ID of the API Client that issues the identity token. Used with private_key_file.
local_directory_service string / required	Name of the local directory service the user belongs to. Required because user names repeat across local directory services.
name string / required	Name of the local user
password string	Password for the local user. Required when creating a user. Whether an existing user’s password is reset is controlled by update_password.
primary_group string	Name of the group to make the user’s primary group. Required when creating a user, and the group has to exist already. A user must belong to a group before it can become their primary group. This module joins the group first when it has to.
private_key_file string added in everpure.flasharray 1.43.0	Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username.
private_key_password string added in everpure.flasharray 1.43.0	Password protecting private_key_file, if encrypted.
rename string	Value to rename the specified local user to Re-running a rename task reports no change, as long as the user is already known by the new name.
state string	Define whether the local user should exist or not. Choices: `"absent"` `"present"` ← (default)
uid integer	User ID to give the user. The array assigns one when the user is created without it. User IDs only have to be unique within a local directory service.
update_password string	`on_create` only sets the password when the user is created, which keeps a task that carries a password idempotent. `always` resets the password on every run. The array does not allow a password to be read back, so there is nothing to compare against and such a task always reports a change. Choices: `"always"` `"on_create"` ← (default)
username string added in everpure.flasharray 1.43.0	Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file.

Notes 

Note

Supported from Purity//FA 6.8.0 or higher. Local users themselves go back further, but the parameters that scope a request to one local directory service arrived with the service object itself, and without them a request cannot be aimed reliably once an array holds more than one service.
The array limits a local user name to 20 characters. Alphanumeric US ASCII, spaces and symbols are allowed, but not control characters, and not the symbols /, \\, [, ], :, ;, |, =, ,, +, *, ?, <, > or @. A name may not be digits alone, and may neither start nor end with a dot or a space.
Creating a user requires both password and primary_group. The array refuses either on its own.
Deleting the local directory service deletes every user in it. See everpure.flasharray.purefa_lds.
This module requires the py-pure-client Python library.
Additional Python libraries may be required for specific modules.
You must set PUREFA_URL and PUREFA_API environment variables if fa_url and api_token arguments are not passed to the module directly.
Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.

Examples 

- name: Create local user fred in local directory service foo
  everpure.flasharray.purefa_localuser:
    name: fred
    local_directory_service: foo
    password: "{{ fred_password }}"
    primary_group: users
    uid: 71000
    email: fred@example.com
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Create local user fred in two extra groups
  everpure.flasharray.purefa_localuser:
    name: fred
    local_directory_service: foo
    password: "{{ fred_password }}"
    primary_group: users
    groups:
      - backup
      - reporting
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Remove fred from every group except his primary one
  everpure.flasharray.purefa_localuser:
    name: fred
    local_directory_service: foo
    groups: []
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Set the password on a new service's built-in Administrator
  everpure.flasharray.purefa_localuser:
    name: Administrator
    local_directory_service: foo
    password: "{{ admin_password }}"
    update_password: always
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Disable local user fred
  everpure.flasharray.purefa_localuser:
    name: fred
    local_directory_service: foo
    enabled: false
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Delete local user fred
  everpure.flasharray.purefa_localuser:
    name: fred
    local_directory_service: foo
    state: absent
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

Authors

Everpure Ansible Team (@sdodsley)

everpure.flasharray.purefa_localuser module – Manage Everpure FlashArray local users

Synopsis

Requirements

Parameters

Notes

Examples