pe_rbac 0.1.3 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9d51fc870e1249e5e42c38f4fe54c5ae2595e71a
-  data.tar.gz: 29ba39485a027a14e68476169294e0ff877866bf
+  metadata.gz: e8e46eabe4fa453dae8cef44b5ae0f7371d9a2bb
+  data.tar.gz: d89e915974bd3bd5b7edb4bbc45e4736411905c6
 SHA512:
-  metadata.gz: d13d751aeb2fb9028dd39e341efdf8ab735e7d13e2fd63ff589908d82942d87fa7dc2502f1cd49db5ade40fd09041c4adeb59cd887abd7cf97591fde4275deb6
-  data.tar.gz: cf15c113f866a5b9bb814e01627c61c9b512ecf273140853ad20e06fd71770963cae863efea9f3e272dffd5fe5e46e4e30ac3f9462b62f5af6ae6995278e0b4c
+  metadata.gz: 0033af434edc4f964d0e442e66dca216551052d1e39c424648841d312949bcf3aabb1e82c0c7afbe8e74a15b1cb28a663e87728b5636958d06cc6cd319dad960
+  data.tar.gz: 3a13fd98d0dfd3aaac65e6609fb412bc090183d45bb01a145971e42538047f569e4bd7a53a1038bf39d9533cd6077d1809721ca6ac61fd58738f1638f01b6136

data/README.md

@@ -34,6 +34,15 @@ pe_rbac  code_manager --password t0ps3cret
 Right now, the command line just provides a means to setup code manager.  If you
 want to do more then this, you must use the Ruby API
 
+### Generating a token to use for ro/rw access to PuppetDB API
+```
+# read-only access
+pe_rbac puppetdb --password t0ps3cret
+
+# read-write access
+pe_rbac puppetdb --allow-write --password t0ps3cret
+```
+
 ### Ruby API
 An *IN FLUX* Ruby API exists, see code for more info.  This WILL change (well it 
 will if I do any more development work on this...) - expect module names, 

data/exe/pe_rbac

@@ -13,18 +13,27 @@ Escort::App.create do |app|
     command.action do |options, arguments|
       role      = 'Code Deployers'
       cmd       = :code_manager # FIXME obtain this automatically
+      description = options[:global][:commands][cmd][:options][:description]
       lifetime  = options[:global][:commands][cmd][:options][:lifetime]
       username  = options[:global][:commands][cmd][:options][:username]
       password  = options[:global][:commands][cmd][:options][:password]
       email     = options[:global][:commands][cmd][:options][:email]
+  
       role_ids = PeRbac::get_role_ids(role)
 
-      perms = {
-        "objectType" => "tokens",
-        "action"     => "override_lifetime",
-        "instance"   => nil,
-      }
-      PeRbac::update_role(role, permissions=perms)
+      perms = [{
+        "object_type" => "tokens",
+        "action"      => "override_lifetime",
+        "instance"    => "*",
+      }]
+
+      # only need to update the role since its built-in
+      PeRbac::update_role(
+        role, 
+        nil,
+        perms, 
+      )
+
       PeRbac::ensure_user(username, email, username, password, role_ids)
       PeRbac::login(username, password, lifetime)     
     end
@@ -52,4 +61,87 @@ Escort::App.create do |app|
     end
   end
 
+  app.command :puppetdb do |command|
+    command.summary "Access to PuppetDB"
+    command.description "Create a user and token to access PuppetDB"
+    command.action do |options, arguments|
+      role        = 'PuppetDB Readers'
+      cmd         = :puppetdb # FIXME obtain this automatically
+      description = options[:global][:commands][cmd][:options][:description]
+      lifetime    = options[:global][:commands][cmd][:options][:lifetime]
+      username    = options[:global][:commands][cmd][:options][:username]
+      password    = options[:global][:commands][cmd][:options][:password]
+      email       = options[:global][:commands][cmd][:options][:email]
+      allow_write = options[:global][:commands][cmd][:options][:allow_write]
+      perms       = [
+        {
+          "object_type" => "tokens",
+          "action"      => "override_lifetime",
+          "instance"    => "*",
+        },
+        {
+          "object_type" => "nodes",
+          "action"      => "view_data",
+          "instance"    => "*",
+        }
+      ]
+      if allow_write
+        perms.push({
+          "object_type" => "nodes",
+          "action"      => "edit_data",
+          "instance"    => "*",
+        })
+      end 
+
+      # create/update the role
+      PeRbac::ensure_role(
+        role,
+        description, 
+        perms
+      )
+      
+      # get the ID of the newly created role
+      role_ids    = PeRbac::get_role_ids(role)
+
+      # join a user to the role
+      PeRbac::ensure_user(username, email, username, password, role_ids)
+
+      # Generate and output the token
+      token = PeRbac::token(username, password, lifetime)
+      Escort::Logger.output.puts token
+    end
+    command.options do |opts|
+      opts.opt(:username,
+        'Username for puppetdb user',
+        :long     => '--username',
+        :default  => 'puppetdb_read'
+      )
+      opts.opt(:password,
+        'Initial password for deploy user',
+        :long     => '--password',
+        :default  => 'changeme'
+      )
+      opts.opt(:email,
+        'Email address',
+        :long     => '--email',
+        :default  => 'root@localhost'
+      )
+      opts.opt(:lifetime,
+        'Token validity length',
+        :long     => '--lifetime',
+        :default  => '10y'
+      )
+      opts.opt(:allow_write,
+        'Allow WRITING to PuppetDB?',
+        :long     => '--allow-write',
+        :type     => :boolean,
+        :default  => false
+      )
+      opts.opt(:description,
+        'Custommise the role description',
+        :long     => '--description',
+        :default  => 'Token access to PuppetDB'
+      )    
+    end
+  end
 end

data/lib/pe_rbac/version.rb

@@ -1,3 +1,3 @@
 module PeRbac
-  VERSION = "0.1.3"
+  VERSION = "0.2.0"
 end

data/lib/pe_rbac.rb

@@ -149,30 +149,33 @@ module PeRbac
     ids = []
     display_names.each { |display_name|
       found=get_role_id(display_name)
-      if !found
-        raise("RBAC role '#{display_name}' not found")
+      #if !found
+      #  raise("RBAC role '#{display_name}' not found")
+      #end
+      if found
+        ids.push(found)
       end
-      ids.push(found)
     }
     ids
   end
 
   # CREATE
-  def self.ensure_role(display_name, description, permissions=[], users=[])
+  def self.ensure_role(display_name, description, permissions=[], user_ids=[])
     if get_role_id(display_name)
-      update_role(display_name, description, permissions, users)
+      update_role(display_name, description, permissions, user_ids)
     else
-      create_role(display_name, description, permissions, users)
+      create_role(display_name, description, permissions, user_ids)
     end
   end
-  
-  def self.create_role(display_name, description, permissions=[], users=[])
+ 
+  # https://docs.puppet.com/pe/latest/rbac_roles_v1.html#post-roles 
+  def self.create_role(display_name, description=display_name, permissions=[], user_ids=[], group_ids=[])
     role = {
+      "permissions"   => permissions,
+      "user_ids"      => user_ids,
+      "group_ids"     => group_ids,
       "display_name"  => display_name,
       "description"   => description,
-      "permissions"   => permissions,
-      "user_ids"      => users,
-      "group_ids"     => [], # doesn't seem to be used yet
     }
     _request(:post, '/roles', role)
   end
@@ -181,11 +184,11 @@ module PeRbac
     role_id = get_role_id(display_name)
     if role_id 
       role = get_role(role_id)
-      role['display_name'] = display_name ? display_name : role['display_name']
-      role['description'] = description ? display_name : role['description']
-      role['permissions'] = permissions ? display_name : role['permissions']
-      role['user_ids'] = user_ids ? display_name : role['user_ids']
-      role['group_ids'] = group_ids ? display_name : role['group_ids']
+      role['display_name']  = display_name ? display_name : role['display_name']
+      role['description']   = description ? display_name : role['description']
+      role['permissions']   = permissions ? permissions : role['permissions']
+      role['user_ids']      = user_ids ? user_ids : role['user_ids']
+      role['group_ids']     = group_ids ? group_ids : role['group_ids']
 
       _request(:put, "/roles/#{role_id}", role)
     else
@@ -242,16 +245,23 @@ module PeRbac
     else
       _payload=nil
     end
-    RestClient::Request.execute(
-      method: method, 
-      url: url,
-      ssl_ca_file: CONF[:cacert],
-      ssl_client_cert: OpenSSL::X509::Certificate.new(File.read(CONF[:cert])),
-      ssl_client_key: OpenSSL::PKey::RSA.new(File.read(CONF[:key])),
-      ssl_version: :TLSv1,
-      headers: {:content_type => :json, :accept => :json},
-      payload: _payload,
-    )
+    begin
+      RestClient::Request.execute(
+        method: method, 
+        url: url,
+        ssl_ca_file: CONF[:cacert],
+        ssl_client_cert: OpenSSL::X509::Certificate.new(File.read(CONF[:cert])),
+        ssl_client_key: OpenSSL::PKey::RSA.new(File.read(CONF[:key])),
+        ssl_version: :TLSv1,
+        headers: {:content_type => :json, :accept => :json},
+        payload: _payload,
+      )
+    rescue RestClient::ExceptionWithResponse => e
+      Escort::Logger.error.error url
+      Escort::Logger.error.error _payload
+      Escort::Logger.error.error e.response
+      raise "API Error"
+    end
   end
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pe_rbac
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.2.0
 platform: ruby
 authors:
 - Geoff Williams
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-11-15 00:00:00.000000000 Z
+date: 2016-11-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler