everpure.flashblade.purefb_local_user module – Manage FlashBlade Local Directory Service users
Note
This module is part of the everpure.flashblade collection (version 1.29.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install everpure.flashblade.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: everpure.flashblade.purefb_local_user.
New in everpure.flashblade 1.28.0
Synopsis
Create, update, rename or delete a local user in a FlashBlade Local Directory Service (LDS). These are the SMB/NFS local identities that live inside an LDS attached to a FlashBlade server. They are not the array management admins - use everpure.flashblade.purefb_user or everpure.flashblade.purefb_admin for those.
Requires FlashBlade REST API version 2.24 or later (Purity//FB 4.6.8+).
Group memberships can be managed inline via the groups option. If you also drive membership from the group side (via everpure.flashblade.purefb_local_group), only manage a given (user,group) edge from one side in a single playbook run.
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.9
py-pure-client
netaddr
datetime
pytz
distro
pycountry
urllib3
Parameters
Parameter |
Comments |
|---|---|
FlashBlade API token for admin privileged user. |
|
ID of the API Client that issues the identity token. Used with private_key_file. |
|
Name of fleet member on which to perform the operation. This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet. Default: |
|
Disable insecure certificate warnings Choices:
|
|
Email address for the user. |
|
Whether the user account is enabled. At create time, if unset the user is created enabled. On update, this field is only applied when explicitly set. This lets you idempotently manage other attributes of a disabled user without accidentally re-enabling the account. Choices:
|
|
FlashBlade management IP address or Hostname. |
|
Force the password to be reset on an existing user, even if unchanged. There is no way to compare the current password on the array, so password change is inherently non-idempotent. Set this true to explicitly ask for a reset. Choices:
|
|
List of non-primary local group names the user should belong to. When set, the module reconciles the user’s group memberships against this list via The primary group (either the current one or a newly requested one) is never removed via this list - the API disallows removing the primary group edge. After a primary-group change the former primary remains a regular member; if it is not listed here, a second run removes it. |
|
A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient). |
|
The API Client’s trusted identity issuer registered on the array. Used with private_key_file. |
|
Key ID of the API Client that issues the identity token. Used with private_key_file. |
|
Name of the Local Directory Service that owns this user. Attach LDSes to servers via everpure.flashblade.purefb_server. |
|
Name of the local user inside the LDS. |
|
New name for the user. Uses the Rejected for built-in users. |
|
Password for the user. Required at create time when enabled=true. Required on the transition of an existing user from enabled=false to enabled=true. Otherwise ignored unless force_password_reset=true. |
|
Name of the local group that is the user’s primary group. Required when state=present - the array will not create a user without one. The primary group must already exist in the same LDS. |
|
Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username. |
|
Password protecting private_key_file, if encrypted. |
|
Whether the local user should exist or not. Choices:
|
|
Numeric UID for the user. Auto-assigned by the array if omitted at create time. Patchable. |
|
Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file. |
Notes
Note
You must set
PUREFB_URLandPUREFB_APIenvironment variables if fb_url and api_token arguments are not passed to the module directlyToken-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient
Examples
- name: Create local user 'alice'
everpure.flashblade.purefb_local_user:
name: alice
local_directory_service: myserver_local
uid: 5001
password: "s3cret!"
primary_group: alice
email: alice@example.com
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Ensure 'alice' also belongs to secondary groups
everpure.flashblade.purefb_local_user:
name: alice
local_directory_service: myserver_local
primary_group: alice
groups:
- developers
- infra
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Disable local user
everpure.flashblade.purefb_local_user:
name: alice
local_directory_service: myserver_local
primary_group: alice
enabled: false
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Rename local user
everpure.flashblade.purefb_local_user:
name: alice
new_name: alice2
local_directory_service: myserver_local
primary_group: alice
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641
- name: Delete local user
everpure.flashblade.purefb_local_user:
name: alice
local_directory_service: myserver_local
state: absent
fb_url: 10.10.10.2
api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641