everpure.flashblade.purefb_mgmt_auth_policy module – Manage FlashBlade Management Authentication Policies and their members

Note

This module is part of the everpure.flashblade collection (version 1.29.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flashblade. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flashblade.purefb_mgmt_auth_policy.

New in everpure.flashblade 1.28.0

Synopsis

  • Create, update, or delete a FlashBlade Management Authentication Policy.

  • Management authentication policies define which authentication factors (password, SSH key/certificate/FIDO2 key) admins must or may present. Currently the SSH interface is supported.

  • Reconcile the declarative list of members (admins and/or the array) the policy is attached to.

  • A member can be attached to at most one management authentication policy at a time; the array does not move members between policies implicitly.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.9

  • py-pure-client

  • netaddr

  • datetime

  • pytz

  • distro

  • pycountry

  • urllib3

Parameters

Parameter

Comments

api_token

string

FlashBlade API token for admin privileged user.

client_id

string

added in everpure.flashblade 1.26.0

ID of the API Client that issues the identity token.

Used with private_key_file.

context

string

Name of fleet member on which to perform the operation.

This requires the array receiving the request is a member of a fleet and the context name to be a member of the same fleet.

Default: ""

disable_warnings

boolean

added in everpure.flashblade 1.18.0

Disable insecure certificate warnings

Choices:

  • false ← (default)

  • true

enabled

boolean

Whether the policy is active. Members of a disabled policy fall back to the platform default authentication behavior.

Omit to leave unchanged on an existing policy; defaults to true when creating a new policy.

Choices:

  • false

  • true

fb_url

string

FlashBlade management IP address or Hostname.

id_token

string

added in everpure.flashblade 1.26.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient).

issuer

string

added in everpure.flashblade 1.26.0

The API Client’s trusted identity issuer registered on the array.

Used with private_key_file.

key_id

string

added in everpure.flashblade 1.26.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

members

list / elements=dictionary

Declarative list of members the policy is attached to.

Setting the list will attach missing members and detach any member not listed here.

Omit (or set to null) to leave current membership untouched.

Provide an empty list to detach every member from the policy.

Attaching a member that is attached to a different policy fails unless replace_existing=true.

name

string / required

Name of the member (a local admin name, or the FlashBlade array name for type=array).

type

string / required

Type of the member.

Choices:

  • "admin"

  • "array"

name

string / required

Name of the management authentication policy.

private_key_file

string

added in everpure.flashblade 1.26.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flashblade 1.26.0

Password protecting private_key_file, if encrypted.

replace_existing

boolean

Whether a member currently attached to a different management authentication policy may be detached from it and attached to this policy (detach-then-attach).

When false a conflicting assignment fails the task, naming the conflicting policy.

Choices:

  • false ← (default)

  • true

ssh_allowed_methods

list / elements=string

Authentication methods where any one method is sufficient for SSH login.

Mutually exclusive with ssh_required_methods - a policy uses one mode or the other. Supplying this list switches the policy to allowed mode and clears any required methods.

default permits whatever methods the FlashBlade supports for the interface and version.

Omit to leave the current SSH configuration unchanged.

Choices:

  • "password"

  • "key"

  • "default"

ssh_required_methods

list / elements=string

Authentication methods that must all be presented for SSH login.

Mutually exclusive with ssh_allowed_methods - a policy uses one mode or the other. Supplying this list switches the policy to required mode and clears any allowed methods.

default is not valid as a required method.

Omit to leave the current SSH configuration unchanged.

Choices:

  • "password"

  • "key"

state

string

Whether the policy should exist.

Choices:

  • "absent"

  • "present" ← (default)

username

string

added in everpure.flashblade 1.26.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

Notes

Note

  • Changing an attached policy affects subsequent SSH logins for its members (existing sessions are unaffected). Misconfiguration can lock administrators out of SSH access - review changes with check mode first.

  • The built-in default-authentication-policy is not protected by the array; it can be modified or deleted like any other policy and is the fallback for members without an explicit policy. Change it with care.

  • Moving a member between policies (replace_existing=true) is not atomic on the array; the member is briefly unattached during the move, and if the move fails midway it is left without a policy until the task is re-run.

  • Deletion safety is enforced by this module, not by the array - the array will delete a policy that still has members attached, silently detaching them.

  • When state=absent, configuration and membership options are ignored.

  • You must set PUREFB_URL and PUREFB_API environment variables if fb_url and api_token arguments are not passed to the module directly

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient

Examples

- name: Create a policy allowing password or key
  everpure.flashblade.purefb_mgmt_auth_policy:
    name: ssh-flexible
    ssh_allowed_methods:
      - password
      - key
    fb_url: 10.10.10.2
    api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641

- name: Create an MFA policy (password AND key) attached to two admins
  everpure.flashblade.purefb_mgmt_auth_policy:
    name: ssh-mfa
    ssh_required_methods:
      - password
      - key
    members:
      - name: alice
        type: admin
      - name: bob
        type: admin
    fb_url: 10.10.10.2
    api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641

- name: Switch an existing policy from required to allowed mode
  everpure.flashblade.purefb_mgmt_auth_policy:
    name: ssh-mfa
    ssh_allowed_methods:
      - key
    fb_url: 10.10.10.2
    api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641

- name: Attach the array baseline, moving it from its current policy
  everpure.flashblade.purefb_mgmt_auth_policy:
    name: ssh-mfa
    members:
      - name: my-flashblade
        type: array
    replace_existing: true
    fb_url: 10.10.10.2
    api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641

- name: Detach every member from a policy
  everpure.flashblade.purefb_mgmt_auth_policy:
    name: ssh-mfa
    members: []
    fb_url: 10.10.10.2
    api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641

- name: Delete a policy (fails while members are attached)
  everpure.flashblade.purefb_mgmt_auth_policy:
    name: ssh-mfa
    state: absent
    fb_url: 10.10.10.2
    api_token: T-55a68eb5-c785-4720-a2ca-8b03903bf641

Authors

  • Pure Storage Ansible Team (@avk)