everpure.flasharray.purefa_user module – Create, modify or delete FlashArray local user account
Note
This module is part of the everpure.flasharray collection (version 1.46.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install everpure.flasharray.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: everpure.flasharray.purefa_user.
New in everpure.flasharray 1.0.0
Synopsis
Create, modify or delete local users on a Everpure FlashArray.
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.3
purestorage >= 1.19
py-pure-client >= 1.88.0
netaddr
requests
pycountry
urllib3
Parameters
Parameter |
Comments |
|---|---|
Name of a custom management access policy that gives the local user its permissions, instead of a built-in role. The user gets no built-in role, so its access is limited to what the policy grants. For example, a policy granting The user becomes a member of this policy only, which replaces any role or other policy it had. The new membership is added before the old one is removed. Setting role on a user that has an access policy moves it back to that built-in role. Mutually exclusive with role. Local users only. Requires Purity//FA 6.6.9, or higher (REST 2.36). |
|
Whether the user is in the AD system Not required for local users Choices:
|
|
Define whether to create an API token for this user Token can be exposed using the debug module Choices:
|
|
FlashArray API token for admin privileged user. |
|
ID of the API Client that issues the identity token. Used with private_key_file. |
|
Disable insecure certificate warnings in debug logs Choices:
|
|
FlashArray management IPv4 address or Hostname. |
|
A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient). |
|
The API Client’s trusted identity issuer registered on the array. Used with private_key_file. |
|
Key ID of the API Client that issues the identity token. Used with private_key_file. |
|
The name of the user account. |
|
If changing an existing password, you must provide the old password for security |
|
Password for the local user. |
|
Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username. |
|
Password protecting private_key_file, if encrypted. |
|
Public key for SSH access. To remove existing key use an empty string The array never returns a stored key (it reads back masked), so a task that sets a key is NOT IDEMPOTENT and reports changed on every run. Removing a key with an empty string is idempotent. |
|
Sets the local user’s access level to the array Mutually exclusive with access_policy. A new user gets Choices:
|
|
Create, delete or update local user account Choices:
|
|
The duration of API token validity. Valid values are weeks (w), days(d), hours(h), minutes(m) and seconds(s). Default: |
|
Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file. |
Notes
Note
This module requires the
py-pure-clientPython library.Additional Python libraries may be required for specific modules.
You must set
PUREFA_URLandPUREFA_APIenvironment variables if fa_url and api_token arguments are not passed to the module directly.Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.
Examples
- name: Create new user ansible with API token
everpure.flasharray.purefa_user:
name: ansible
password: apassword
role: storage_admin
api: true
timeout: 2d
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
register: result
debug:
msg: "API Token: {{ result['user_info']['user_api'] }}"
- name: Create a realm-scoped user from a custom management access policy, with an API token
everpure.flasharray.purefa_user:
name: ocp-csi
password: apassword
access_policy: ocp-realm-storage
api: true
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
register: result
- name: Overwrite/add SSH public key for existing user (NOT IDEMPOTENT)
everpure.flasharray.purefa_user:
name: ansible
role: array_admin
public_key: "{{lookup('file', 'id_rsa.pub') }}"
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
- name: Remove existing SSH public key from user
everpure.flasharray.purefa_user:
name: ansible
role: array_admin
public_key: ""
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
- name: Change role type for existing user
everpure.flasharray.purefa_user:
name: ansible
role: array_admin
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
- name: Change password type for existing user (NOT IDEMPOTENT)
everpure.flasharray.purefa_user:
name: ansible
password: anewpassword
old_password: apassword
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
- name: Create an API token (TTL of 2 days) and assign a public key to an AD user (NOT IDEMPOTENT)
everpure.flasharray.purefa_user:
name: ansible-ad
ad_user: true
public_key: "{{lookup('file', 'id_rsa.pub') }}"
api: true
timeout: 2d
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
- name: Change API token and token timeout for existing user
everpure.flasharray.purefa_user:
name: ansible
api: true
role: array_admin
timeout: 1d
fa_url: 10.10.10.2
api_token: e31060a7-21fc-e277-6240-25983c6c4592
register: result
debug:
msg: "API Token: {{ result['user_info']['user_api'] }}"