pe_rbac 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e8e46eabe4fa453dae8cef44b5ae0f7371d9a2bb
-  data.tar.gz: d89e915974bd3bd5b7edb4bbc45e4736411905c6
+  metadata.gz: 858d59d7f1c47371a5f8379f5a9aa271d2ad6078
+  data.tar.gz: 0f2bd35912191340c9978a0d08547d87bb6dc09b
 SHA512:
-  metadata.gz: 0033af434edc4f964d0e442e66dca216551052d1e39c424648841d312949bcf3aabb1e82c0c7afbe8e74a15b1cb28a663e87728b5636958d06cc6cd319dad960
-  data.tar.gz: 3a13fd98d0dfd3aaac65e6609fb412bc090183d45bb01a145971e42538047f569e4bd7a53a1038bf39d9533cd6077d1809721ca6ac61fd58738f1638f01b6136
+  metadata.gz: 07a17310e5e1369d72a97eba970a34dd5d33b919eac5a4ae8d9bbca6145ccd5c7692ffc955285a4229aaf00a065f02fd66471e8f56f80ad4299271018eb6d7a1
+  data.tar.gz: 6ade6201c2003bcab6790d99086dfb4d4519ab9e2d226bc805406f0a246e438115dc7dd37b1ac16f721af0c12d1853acf9e46a03fcd0282610d7e03b4e3e8a82

data/exe/pe_rbac

@@ -18,7 +18,7 @@ Escort::App.create do |app|
       username  = options[:global][:commands][cmd][:options][:username]
       password  = options[:global][:commands][cmd][:options][:password]
       email     = options[:global][:commands][cmd][:options][:email]
-  
+
       role_ids = PeRbac::get_role_ids(role)
 
       perms = [{
@@ -29,13 +29,13 @@ Escort::App.create do |app|
 
       # only need to update the role since its built-in
       PeRbac::update_role(
-        role, 
+        role,
         nil,
-        perms, 
+        perms,
       )
 
       PeRbac::ensure_user(username, email, username, password, role_ids)
-      PeRbac::login(username, password, lifetime)     
+      PeRbac::login(username, password, lifetime)
     end
     command.options do |opts|
       opts.opt(:username,
@@ -91,15 +91,15 @@ Escort::App.create do |app|
           "action"      => "edit_data",
           "instance"    => "*",
         })
-      end 
+      end
 
       # create/update the role
       PeRbac::ensure_role(
         role,
-        description, 
+        description,
         perms
       )
-      
+
       # get the ID of the newly created role
       role_ids    = PeRbac::get_role_ids(role)
 
@@ -141,7 +141,33 @@ Escort::App.create do |app|
         'Custommise the role description',
         :long     => '--description',
         :default  => 'Token access to PuppetDB'
-      )    
+      )
+    end
+  end
+
+  app.command :reset_password do |command|
+    command.summary "Reset a logon password"
+    command.description "Obtain a reset token and then reset a password"
+    command.action do |options, arguments|\
+      # fixme - obtain automatically
+      cmd         = :reset_password
+      username    = options[:global][:commands][cmd][:options][:username]
+      password    = options[:global][:commands][cmd][:options][:password]
+
+      PeRbac::reset_password(username, password)
+    end
+    command.options do |opts|
+      opts.opt(:username,
+        'Username to reset',
+        :long     => '--username',
+        :default  => 'admin'
+      )
+      opts.opt(:password,
+        'Password to reset to',
+        :long     => '--password',
+        :default  => 'changeme'
+      )
     end
   end
+
 end

data/lib/pe_rbac/version.rb

@@ -1,3 +1,3 @@
 module PeRbac
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/pe_rbac.rb

@@ -12,7 +12,7 @@ module PeRbac
   pe_new_cert = "#{ssldir}/certs/#{fqdn}.pem"
 
   # pe 2016.4.0 removes the pe-internal-orchestrator.pem file but old systems
-  # will still have the client cert (which won't work), so pick based on 
+  # will still have the client cert (which won't work), so pick based on
   # using pe-internal-orchestrator.pem if its available
   if File.exist?(pe_old_pk)
     pk    = pe_old_pk
@@ -34,7 +34,7 @@ module PeRbac
 
   #
   # user
-  # 
+  #
 
   def self.get_users
     JSON.parse(_request(:get, '/users').body)
@@ -97,8 +97,8 @@ module PeRbac
       user['email'] = email ? email : user['email']
       user['display_name'] = display_name ? display_name : user['display_name']
     end
-    user['role_ids'] = role_ids ? role_ids : user['role_ids']  
-    user['is_revoked'] = (! is_revoked.nil?) ? is_revoked : user['is_revoked'] 
+    user['role_ids'] = role_ids ? role_ids : user['role_ids']
+    user['is_revoked'] = (! is_revoked.nil?) ? is_revoked : user['is_revoked']
 
     _request(:put, "/users/#{user['id']}", user)
   end
@@ -113,7 +113,7 @@ module PeRbac
 
     _request(:post, '/auth/reset', reset)
   end
-  
+
   #
   # role
   #
@@ -138,7 +138,7 @@ module PeRbac
     found
   end
 
-  
+
   # get the role id for a display name
   # eg ['Code Deployers', 'blah'] => [4,8]
   def self.get_role_ids(display_names)
@@ -167,8 +167,8 @@ module PeRbac
       create_role(display_name, description, permissions, user_ids)
     end
   end
- 
-  # https://docs.puppet.com/pe/latest/rbac_roles_v1.html#post-roles 
+
+  # https://docs.puppet.com/pe/latest/rbac_roles_v1.html#post-roles
   def self.create_role(display_name, description=display_name, permissions=[], user_ids=[], group_ids=[])
     role = {
       "permissions"   => permissions,
@@ -182,7 +182,7 @@ module PeRbac
 
   def self.update_role(display_name, description=nil, permissions=nil, user_ids=nil, group_ids=nil)
     role_id = get_role_id(display_name)
-    if role_id 
+    if role_id
       role = get_role(role_id)
       role['display_name']  = display_name ? display_name : role['display_name']
       role['description']   = description ? display_name : role['description']
@@ -195,7 +195,7 @@ module PeRbac
       raise("No such role exists: #{display_name} create it first or use ensure_role")
     end
   end
-  
+
 
   #
   # Permissions
@@ -213,7 +213,7 @@ module PeRbac
       "login"     => login,
       "password"  => password,
     }
-    
+
     # see https://docs.puppet.com/pe/latest/rbac_token_auth.html#setting-a-token-specific-lifetime
     if lifetime
       payload["lifetime"] = lifetime
@@ -232,6 +232,23 @@ module PeRbac
     File.chmod(0600, tokenfile)
   end
 
+  def self.reset_password(login, password)
+    # lookup user id
+    user_id = self.get_user_id(login)
+    if user_id
+      # get password reset token
+      reset_token = _request(:post, "/users/#{user_id}/password/reset")
+
+      # reset password
+      _request(:post, '/auth/reset', {
+        'token'     => reset_token,
+        'password'  => password,
+      })
+    else
+      Escort::Logger.error.error "No such user: #{login}"
+    end
+  end
+
   private
 
   def self._request(method, path, payload=nil, raw=false)
@@ -247,7 +264,7 @@ module PeRbac
     end
     begin
       RestClient::Request.execute(
-        method: method, 
+        method: method,
         url: url,
         ssl_ca_file: CONF[:cacert],
         ssl_client_cert: OpenSSL::X509::Certificate.new(File.read(CONF[:cert])),

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pe_rbac
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Geoff Williams
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-11-16 00:00:00.000000000 Z
+date: 2016-11-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler