LDAPS security profile ansible support

changelogs/fragments/414-ldap-security-profile.yaml

@@ -0,0 +1,2 @@
+minor_changes:
+ - sonic_ldap - Add ldap security profile support for sonic_ldap module (https://github.com/ansible-collections/dellemc.enterprise_sonic/pull/414).

plugins/module_utils/network/sonic/argspec/ldap/ldap.py

@@ -147,6 +147,7 @@ def __init__(self, **kwargs):
  'type': 'list'
  },
  'source_interface': {'type': 'str'},
+ 'security_profile': {'type': 'str'},
  'ssl': {
  'choices': ['on', 'off', 'start_tls'],
  'type': 'str'

plugins/module_utils/network/sonic/config/ldap/ldap.py

@@ -76,7 +76,7 @@
  'nss_base_shadow', 'nss_base_sudoers', 'nss_initgroups_ignoreusers']
 ONLY_PAM_ATTRIBUTES = ['pam_filter', 'pam_group_dn', 'pam_login_attribute', 'pam_member_attribute']
 
-GLOBAL_ATTRIBUTES = COMMON_ATTRIBUTES + ['servers', 'idle_timelimit', 'nss_skipmembers', 'map', 'source_interface', 'scope', 'sudoers_base',
+GLOBAL_ATTRIBUTES = COMMON_ATTRIBUTES + ['servers', 'idle_timelimit', 'nss_skipmembers', 'map', 'source_interface', 'security_profile', 'scope', 'sudoers_base',
  'sudoers_search_filter', 'vrf'] + ONLY_NSS_ATTRIBUTES + ONLY_PAM_ATTRIBUTES
 NSS_ATTRIBUTES = COMMON_ATTRIBUTES + ONLY_NSS_ATTRIBUTES + ['idle_timelimit', 'scope']
 PAM_ATTRIBUTES = COMMON_ATTRIBUTES + ONLY_PAM_ATTRIBUTES + ['nss_base_passwd', 'scope']
@@ -323,7 +323,6 @@ def _state_replaced_or_overridden(self, want, have):
  if len(mod_requests) > 0:
  commands.extend(update_states(add_config, self._module.params['state']))
  requests.extend(mod_requests)
-
  return commands, requests
 
  def _state_merged(self, want, have):
@@ -526,6 +525,7 @@ def get_create_ldap_requests(self, commands):
  if name == 'global':
  ATTRIBUTES = {
  'vrf': 'vrf-name',
+ 'security_profile': 'security_profile',
  'nss_skipmembers': 'nss-skipmembers'
  }
  attribute = attribute or ATTRIBUTES.get(attr)
@@ -645,6 +645,7 @@ def get_delete_ldap_requests(self, commands, have, is_delete_all):
  if name == 'global':
  ATTRIBUTES = {
  'vrf': 'vrf-name',
+ 'security_profile': 'security_profile',
  'nss_skipmembers': 'nss-skipmembers'
  }
  attribute = attribute or ATTRIBUTES.get(attr)

plugins/module_utils/network/sonic/facts/ldap/ldap.py

@@ -183,6 +183,7 @@ def get_ldap(self):
  def get_ldap_global_config(self, ldap_config, servers):
  ATTRIBUTES = {
  "vrf-name": "vrf",
+ "security_profile": "security_profile",
  "nss-skipmembers": "nss_skipmembers"
  }
  global_config, map_config = {}, {}

plugins/modules/sonic_ldap.py

@@ -297,6 +297,11 @@
  - Applicable only for global.
  - Full name of the Layer 3 interface, i.e. Eth1/1.
  type: str
+ security_profile:
+ description:
+ - Configure security profile for LDAP.
+ - Applicable only for global.
+ type: str
  ssl:
  description:
  - Configure TLS configuration.
@@ -654,6 +659,7 @@
  config:
  - name: "global"
  source_interface: "Eth1/1"
+ security_profile: "default"
  vrf: "Vrf_1"
  servers:
  - address: "client.com"
@@ -682,6 +688,7 @@
 #ldap-server pam ssl off
 #ldap-server pam scope base
 #ldap-server source-interface Eth1/1
+#ldap-server security-profile default
 #ldap-server vrf Vrf_1
 #ldap-server host client.com
 #ldap-server host host.com use-type sudo_pam

tests/regression/roles/sonic_ldap/defaults/main.yml

@@ -109,6 +109,7 @@ tests:
  retry: 3
  scope: one
  - name: global
+ security_profile: "default"
  map:
  map_remote_groups_to_sonic_roles:
  - remote_group: "user1"
@@ -120,6 +121,7 @@ tests:
  state: deleted
  input:
  - name: global
+ security_profile: "default"
  vrf: '{{ vrf2 }}'
  map:
  map_remote_groups_to_sonic_roles:
@@ -196,6 +198,7 @@ tests:
  ssl: 'start_tls'
  binddn: "CN=example.com"
  source_interface: "{{ interface5 }}"
+ security_profile: "default"
  map:
  default_attribute:
  - from: "attr1"
@@ -261,6 +264,7 @@ tests:
  state: overridden
  input:
  - name: global
+ security_profile: "default"
  servers:
  - address: 89.0.142.85
  ssl: 'off'