# (c) 2023, Branko Majic <branko@majic.rs>

#

# This file is part of Ansible

#

# Ansible is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# Ansible is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.

import hashlib

import os

import base64

from ansible import errors

def ldap_password_hash(password, salt=None):

    if not salt:

        salt = os.urandom(4)

    elif len(salt) != 4:

        raise errors.AnsibleFilterError("When passing in salt to ldap_password_hash filter, it must be exactly 4 characters long!")

    else:

        salt = salt.encode("utf-8")

    hashed_password = hashlib.sha1(password.encode("utf-8"))

    hashed_password.update(salt)

    return "{SSHA}" + base64.encodebytes(hashed_password.digest() + salt).strip().decode("utf-8")

class FilterModule(object):

    def filters(self):

        return {

            'ldap_password_hash': ldap_password_hash

        }

  - name: parameters-mandatory-buster

        ip: 192.168.56.21

  - name: parameters-optional-buster

        ip: 192.168.56.22

        - name: parameters-mandatory-buster_ldap

        - name: parameters-optional-buster_ldap

        192.168.56.21: parameters-mandatory-buster

        192.168.56.22: parameters-optional-buster

    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-*-buster')

import os

import testinfra.utils.ansible_runner

from helpers import parse_ldif

testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(

    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-*')

def test_server_admin_entry_absent(host):

    """

    Tests if the explicit admin entry is absent from directory tree.

    """

    with host.sudo():

        ldapsearch = host.run('ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b dc=local cn=admin dn')

        assert ldapsearch.rc == 0

        assert ldapsearch.stdout.strip() == ''

- name: Drop the admin entry corresponding to olcRootDN for database from directory

  ldap_entry:

    dn: "cn=admin,{{ ldap_server_int_basedn }}"

    state: absent

# @TODO: This whole thing could be dropped if newer version of Ansible

#        was in use (where community collection has the ldap_search

#        module.

  ldap_attr:

    dn: "olcDatabase={1}mdb,cn=config"

    name: olcRootPW

    values: "{{ ldap_admin_password | ldap_password_hash }}"

    state: exact