everpure.flashblade.purefb_saml module – Manage FlashBlade SAML2 service and identity providers
Note
This module is part of the everpure.flashblade collection (version 1.29.0).
You might already have this collection installed if you are using the ansible package.
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install everpure.flashblade.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: everpure.flashblade.purefb_saml.
New in everpure.flashblade 1.19.0
Synopsis
Enable or disable FlashBlade SAML2 providers
Requirements
The below requirements are needed on the host that executes this module.
python >= 3.9
py-pure-client
netaddr
datetime
pytz
distro
pycountry
urllib3
Parameters
Parameter |
Comments |
|---|---|
FlashBlade API token for admin privileged user. |
|
The URL of the FlashBlade |
|
ID of the API Client that issues the identity token. Used with private_key_file. |
|
The credential used by the service provider to decrypt encrypted SAML assertions from the identity provider |
|
Disable insecure certificate warnings Choices:
|
|
Defines the enabled state of the identity provider Choices:
|
|
If set to true, SAML assertions will be encrypted by the identity provider Choices:
|
|
A globally unique name for the identity provider |
|
FlashBlade management IP address or Hostname. |
|
A pre-signed JWT to authenticate with, as an alternative to api_token. The token is exchanged by the array for a short-lived access token. Requires a matching API Client to be registered on the array (see everpure.flashblade.purefb_apiclient). |
|
The API Client’s trusted identity issuer registered on the array. Used with private_key_file. |
|
Key ID of the API Client that issues the identity token. Used with private_key_file. |
|
The URL of the identity provider metadata |
|
Name of the SAML2 identity provider (IdP) |
|
Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token. Requires client_id, key_id, issuer and username. |
|
Password protecting private_key_file, if encrypted. |
|
If set to true, SAML requests will be signed by the service provider. Choices:
|
|
The credential used by the service provider to sign SAML requests |
|
Define whether the API client should exist or not, or test. Choices:
|
|
The URL of the identity provider |
|
Username the issued token should be granted to. Must be a valid user on the array. Used with private_key_file. |
|
The X509 certificate that the service provider uses to verify the SAML response signature from the identity provider |
Notes
Note
You must set
PUREFB_URLandPUREFB_APIenvironment variables if fb_url and api_token arguments are not passed to the module directlyToken-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flashblade.purefb_apiclient
Examples
- name: Create (disabled) SAML2 SSO with only metadata URL
everpure.flashblade.purefb_saml:
name: myIDP
array_url: "https://10.10.10.2"
metadata_url: "https://myidp.acme.com/adfs/ls"
x509_cert: "{{lookup('file', 'x509_cert_file') }}"
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Enable SAML2 SSO
everpure.flashblade.purefb_saml:
name: myISO
enabled: true
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6
- name: Delete SAML2 SSO
everpure.flashblade.purefb_saml:
state: absent
name: myIDP
fb_url: 10.10.10.2
api_token: T-9f276a18-50ab-446e-8a0c-666a3529a1b6