[PATCH aeolus-configure] BZ 806001 aeolus-configure will always create an admin user, need to key of a uuid not name

Steve Linabery slinaber at redhat.com
Fri May 18 21:56:55 UTC 2012


This patch series moves us away from using admin/password for web
requests, and instead we create/destroy a temporary aeolus user with
administrative privileges for each puppet run.

We also make a separate, optional profile, admin_configure, which
can be used to create an aeolus user with administrative privileges.
Note that this makes the default profile now set up no 'admin' user
by default, addressing the re-creation of un/pw admin/password which
was the root of the bug in BZ806001.
---
 conf/admin_configure                               |    9 +++
 .../lib/puppet/parser/functions/secure_random.rb   |   15 +++++
 recipes/aeolus/manifests/conductor.pp              |   56 +++++++++++++++-----
 recipes/aeolus/manifests/profiles/default.pp       |   25 ++++++---
 recipes/aeolus/manifests/profiles/ec2.pp           |   47 +++++++++++------
 recipes/aeolus/manifests/profiles/mock.pp          |   36 ++++++++----
 recipes/aeolus/manifests/profiles/rhevm.pp         |   29 +++++++----
 7 files changed, 156 insertions(+), 61 deletions(-)
 create mode 100644 conf/admin_configure
 create mode 100644 recipes/aeolus/lib/puppet/parser/functions/secure_random.rb

diff --git a/conf/admin_configure b/conf/admin_configure
new file mode 100644
index 0000000..fbbed09
--- /dev/null
+++ b/conf/admin_configure
@@ -0,0 +1,9 @@
+parameters:
+  admin_login: admin
+  admin_password: password
+  admin_email: root at localhost.localdomain
+  admin_first_name: Administrator
+  admin_last_name: ""
+classes:
+- aeolus::conductor
+- aeolus::conductor::default_admin
diff --git a/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
new file mode 100644
index 0000000..9ea7ce2
--- /dev/null
+++ b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
@@ -0,0 +1,15 @@
+require 'securerandom'
+
+Puppet::Parser::Functions::newfunction(:secure_random,
+                                       :type => :rvalue,
+                                       :doc => <<ENDDOC
+Return SecureRandom.hex using the first parameter as the
+number of bytes desired, or 24 bytes by default.
+ENDDOC
+) do |args|
+  if !args[0].nil? && (args[0].responds_to to_i)
+    SecureRandom.hex(args[0])
+  else
+    SecureRandom.hex(24)
+  end
+end
diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
index 786c658..a7371e4 100644
--- a/recipes/aeolus/manifests/conductor.pp
+++ b/recipes/aeolus/manifests/conductor.pp
@@ -15,6 +15,7 @@
 # Aeolus conductor puppet definitions
 
 class aeolus::conductor inherits aeolus {
+
   ### Install the aeolus components
     # specific versions of these two packages are needed and we need to pull the third in
     package {['aeolus-conductor',
@@ -180,23 +181,50 @@ class aeolus::conductor::disabled {
 }
 
 # Create a new site admin conductor web user
-define aeolus::conductor::site_admin($email="", $password="", $first_name="", $last_name=""){
+class aeolus::conductor::default_admin {
   exec{"create_site_admin_user":
          cwd         => '/usr/share/aeolus-conductor',
          environment => "RAILS_ENV=production",
-         command     => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]",
+         command     => "/usr/bin/rake dc:create_user[${admin_login},${admin_password},${admin_email},${admin_first_name},${admin_last_name}]",
          logoutput   => true,
-         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"",
+         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from roles, permissions, users where roles.id = permissions.role_id and users.id = permissions.user_id and roles.name = 'base.admin'\"` -gt \"0\"",
          require     => Rails::Seed::Db["seed_aeolus_database"]}
   exec{"grant_site_admin_privs":
          cwd         => '/usr/share/aeolus-conductor',
          environment => "RAILS_ENV=production",
-         command     => "/usr/bin/rake dc:site_admin[${name}]",
+         command     => "/usr/bin/rake dc:site_admin[${admin_login}]",
          logoutput   => true,
-         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';\"` = \"1\"",
+         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${admin_name}';\"` = \"1\"",
          require     => Exec[create_site_admin_user]}
 }
 
+define aeolus::conductor::temp_admin($password=""){
+    exec{"create_temp_admin":
+      cwd         => '/usr/share/aeolus-conductor',
+      environment => "RAILS_ENV=production",
+      command     => "/usr/bin/rake dc:create_user[${name},${password},'temp-admin at localhost.localdomain','temp','admin']",
+      logoutput   => true,
+      require     => Rails::Seed::Db["seed_aeolus_database"]}
+    exec{"grant_temp_admin_privs":
+      cwd         => '/usr/share/aeolus-conductor',
+      environment => "RAILS_ENV=production",
+      command     => "/usr/bin/rake dc:site_admin[${name}]",
+      logoutput   => true,
+      require     => Exec[create_temp_admin]}
+  }
+
+
+define aeolus::conductor::destroy_temp_admin{
+  exec{"destroy_temp_admin":
+    cwd         => '/usr/share/aeolus-conductor',
+    environment => "RAILS_ENV=production",
+    command     => "/usr/bin/rake dc:destroy_user[${name}]",
+    logoutput   => true,
+    require     => Rails::Seed::Db["seed_aeolus_database"]
+  }
+}
+
+
 # login to the aeolus conductor
 define aeolus::conductor::login($password){
   web_request{ "$name-conductor-login":
@@ -231,7 +259,7 @@ define aeolus::conductor::logout(){
 }
 
 # Create a new provider via the conductor
-define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider=""){
+define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider="", $admin_login=""){
   web_request{ "provider-$name":
     post         => "https://localhost/conductor/providers",
     parameters  => { 'provider[name]'  => $name, 'provider[url]'   => $url,
@@ -240,17 +268,17 @@ define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_pr
     returns     => '200',
     follow      => true,
     contains    => "//img[@alt='Notices']", # in the case of an error, @alt='Warnings'
-    use_cookies_at => '/tmp/aeolus-admin',
+    use_cookies_at => "/tmp/aeolus-${admin_login}",
     log_to      => '/tmp/configure-provider-request.log',
     only_log_errors => true,
     unless      => { 'get'             => 'https://localhost/conductor/providers',
                      'contains'        => "//html/body//a[text() = '$name']" },
-    require    => [Service['aeolus-conductor'], Exec['grant_site_admin_privs'], Exec['deltacloud-core-startup-wait']]
+    require    => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs'], Exec['deltacloud-core-startup-wait']]
   }
 }
 
 # Create a new provider account via the conductor
-define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public=""){
+define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public="", $admin_login=""){
   if $type != "ec2" {
     web_request{ "provider-account-$name":
       post         => "https://localhost/conductor/providers/0/provider_accounts",
@@ -264,7 +292,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username=""
       returns     => '200',
       #contains    => "//table/thead/tr/th[text() = 'Properties for $name']",
       follow      => true,
-      use_cookies_at => '/tmp/aeolus-admin',
+      use_cookies_at => "/tmp/aeolus-${admin_login}",
       unless      => { 'get'             => 'https://localhost/conductor/provider_accounts',
                        'contains'        => "//html/body//a[text() = '$name']" },
       require    => Service['aeolus-conductor']}
@@ -285,7 +313,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username=""
       returns     => '200',
       #contains    => "//table/thead/tr/th[text() = 'Properties for $name']",
       follow      => true,
-      use_cookies_at => '/tmp/aeolus-admin',
+      use_cookies_at => "/tmp/aeolus-${admin_login}",
       unless      => { 'get'             => 'https://localhost/conductor/provider_accounts',
                        'contains'        => "//html/body//a[text() = '$name']" },
       require    => Service['aeolus-conductor']
@@ -293,7 +321,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username=""
   }
 }
 
-define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''){
+define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='', $admin_login=''){
   web_request{ "hwp-$name":
     post         => "https://localhost/conductor/hardware_profiles",
     parameters  => {'hardware_profile[name]'  => $name,
@@ -313,7 +341,7 @@ define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''
     returns     => '200',
     #verify      => '.*Hardware profile added.*',
     follow      => true,
-    use_cookies_at => '/tmp/aeolus-admin',
-    require    => [Service['aeolus-conductor'], Exec['grant_site_admin_privs']]
+    use_cookies_at => "/tmp/aeolus-${admin_login}",
+    require    => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs']]
   }
 }
diff --git a/recipes/aeolus/manifests/profiles/default.pp b/recipes/aeolus/manifests/profiles/default.pp
index 5bb3119..47e640d 100644
--- a/recipes/aeolus/manifests/profiles/default.pp
+++ b/recipes/aeolus/manifests/profiles/default.pp
@@ -14,25 +14,32 @@
 
 class aeolus::profiles::default {
 
+  #we will use one random hex string to name the temporary admin user
+  $random = secure_random()
+  $temp_admin_login = "temporary-administrative-user-${random}"
+  #and another random hex string for the temp user's password
+  $temp_admin_password = secure_random()
+
   aeolus::create_bucket{"aeolus":}
 
-  aeolus::conductor::site_admin{"admin":
-     email           => 'root at localhost.localdomain',
-     password        => "password",
-     first_name      => 'Administrator',
-     last_name       => ''}
+  aeolus::conductor::temp_admin{$temp_admin_login :
+     password        => $temp_admin_password }
 
-  aeolus::conductor::login{"admin": password => "password",
-     require  => Aeolus::Conductor::Site_admin['admin']}
+  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
+     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
 
   aeolus::conductor::hwp{"small-x86_64":
       memory         => "512",
       cpu            => "1",
       storage        => "",
       architecture   => "x86_64",
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login    => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
-  aeolus::conductor::logout{"admin":
+  aeolus::conductor::logout{$temp_admin_login:
     require    => Aeolus::Conductor::Hwp['small-x86_64']}
 
+  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
+    require => Aeolus::Conductor::Logout[$temp_admin_login]}
+
 }
diff --git a/recipes/aeolus/manifests/profiles/ec2.pp b/recipes/aeolus/manifests/profiles/ec2.pp
index 3f63f70..165a32b 100644
--- a/recipes/aeolus/manifests/profiles/ec2.pp
+++ b/recipes/aeolus/manifests/profiles/ec2.pp
@@ -15,68 +15,83 @@
 class aeolus::profiles::ec2 {
   include aeolus::deltacloud::ec2
 
+  #we will use one random hex string to name the temporary admin user
+  $random = secure_random()
+  $temp_admin_login = "temporary-administrative-user-${random}"
+  #and another random hex string for the temp user's password
+  $temp_admin_password = secure_random()
+
   aeolus::create_bucket{"aeolus":}
 
-  aeolus::conductor::site_admin{"admin":
-     email           => 'root at localhost.localdomain',
-     password        => "password",
-     first_name      => 'Administrator',
-     last_name       => ''}
+  aeolus::conductor::temp_admin{$temp_admin_login :
+     password        => $temp_admin_password }
 
-  aeolus::conductor::login{"admin": password => "password",
-     require  => Aeolus::Conductor::Site_admin['admin']}
+  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
+     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
 
   aeolus::conductor::provider{"ec2-us-east-1":
       deltacloud_driver         => 'ec2',
       deltacloud_provider       => 'us-east-1',
       url                       => 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::provider{"ec2-us-west-1":
       deltacloud_driver         => 'ec2',
       deltacloud_provider       => 'us-west-1',
       url                       => 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::provider{"ec2-us-west-2":
       deltacloud_driver         => 'ec2',
       deltacloud_provider       => 'us-west-2',
       url                       => 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::provider{"ec2-eu-west-1":
       deltacloud_driver         => 'ec2',
       deltacloud_provider       => 'eu-west-1',
       url                       => 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::provider{"ec2-ap-southeast-1":
       deltacloud_driver		=> 'ec2',
       deltacloud_provider	=> 'ap-southeast-1',
       url			=> 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::provider{"ec2-ap-northeast-1":
       deltacloud_driver         => 'ec2',
       deltacloud_provider       => 'ap-northeast-1',
       url                       => 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::provider{"ec2-sa-east-1":
       deltacloud_driver         => 'ec2',
       deltacloud_provider       => 'sa-east-1',
       url                       => 'http://localhost:3002/api',
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login               => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   aeolus::conductor::hwp{"small-x86_64":
       memory         => "512",
       cpu            => "1",
       storage        => "",
       architecture   => "x86_64",
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login    => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
   Aeolus::Conductor::Provider <| |> -> Aeolus::Conductor::Logout <| |>
 
-  aeolus::conductor::logout{"admin":
+  aeolus::conductor::logout{$temp_admin_login:
     require    => Aeolus::Conductor::Hwp['small-x86_64'] }
+
+  aeolus::conductor::destroy_temp_admin{$temp_admin_login:
+    require => Aeolus::Conductor::Logout[$temp_admin_login]}
+
 }
diff --git a/recipes/aeolus/manifests/profiles/mock.pp b/recipes/aeolus/manifests/profiles/mock.pp
index c68829c..bd1c9f1 100644
--- a/recipes/aeolus/manifests/profiles/mock.pp
+++ b/recipes/aeolus/manifests/profiles/mock.pp
@@ -14,38 +14,50 @@
 
 class aeolus::profiles::mock {
 
+  #we will use one random hex string to name the temporary admin user
+  $random = secure_random()
+  $temp_admin_login = "temporary-administrative-user-${random}"
+  #and another random hex string for the temp user's password
+  $temp_admin_password = secure_random()
+  
   aeolus::create_bucket{"aeolus":}
 
-  aeolus::conductor::site_admin{"admin":
-     email           => 'root at localhost.localdomain',
-     password        => "password",
-     first_name      => 'Administrator',
-     last_name       => ''}
+  aeolus::conductor::temp_admin{$temp_admin_login :
+     password        => $temp_admin_password }
 
-  aeolus::conductor::login{"admin": password => "password",
-     require  => Aeolus::Conductor::Site_admin['admin']}
+  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
+     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
 
   aeolus::conductor::provider{"mock":
       deltacloud_driver  => 'mock',
       url                => 'http://localhost:3002/api',
-      require            => Aeolus::Conductor::Login["admin"] }
+      admin_login        => $temp_admin_login,
+      require            => Aeolus::Conductor::Login[$temp_admin_login] }
+
 
   aeolus::conductor::provider::account{"mock":
       provider           => 'mock',
       type               => 'mock',
       username           => 'mockuser',
       password           => 'mockpassword',
-      require        => Aeolus::Conductor::Provider["mock"] }
+      admin_login        => $temp_admin_login,
+      require            => Aeolus::Conductor::Provider["mock"] }
 
   aeolus::conductor::hwp{"small-x86_64":
       memory         => "512",
       cpu            => "1",
       storage        => "",
       architecture   => "x86_64",
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login    => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
-  aeolus::conductor::logout{"admin":
+  aeolus::conductor::logout{$temp_admin_login :
     require    => [Aeolus::Conductor::Provider['mock'],
                    Aeolus::Conductor::Provider::Account['mock'],
-                   Aeolus::Conductor::Hwp['small-x86_64']] }
+                   Aeolus::Conductor::Hwp['small-x86_64']]
+  }
+
+  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
+    require => Aeolus::Conductor::Logout[$temp_admin_login]}
+
 }
diff --git a/recipes/aeolus/manifests/profiles/rhevm.pp b/recipes/aeolus/manifests/profiles/rhevm.pp
index 547d7a9..6d2f51a 100644
--- a/recipes/aeolus/manifests/profiles/rhevm.pp
+++ b/recipes/aeolus/manifests/profiles/rhevm.pp
@@ -13,6 +13,13 @@
 #   limitations under the License.
 
 class aeolus::profiles::rhevm ($instances) {
+
+  #we will use one random hex string to name the temporary admin user
+  $random = secure_random()
+  $temp_admin_login = "temporary-administrative-user-${random}"
+  #and another random hex string for the temp user's password
+  $temp_admin_password = secure_random()
+  
   create_resources2('aeolus::profiles::rhevm::instance', $instances)
 
   file {"/etc/imagefactory/rhevm.json":
@@ -24,26 +31,28 @@ class aeolus::profiles::rhevm ($instances) {
 
   aeolus::create_bucket{"aeolus":}
 
-  aeolus::conductor::site_admin{"admin":
-     email           => 'root at localhost.localdomain',
-     password        => "password",
-     first_name      => 'Administrator',
-     last_name       => ''}
+  aeolus::conductor::temp_admin{$temp_admin_login :
+     password        => $temp_admin_password }
 
-  aeolus::conductor::login{"admin": password => "password",
-     require  => Aeolus::Conductor::Site_admin['admin']}
+  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
+     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
 
   aeolus::conductor::hwp{"small-x86_64":
       memory         => "512",
       cpu            => "1",
       storage        => "",
       architecture   => "x86_64",
-      require        => Aeolus::Conductor::Login["admin"] }
+      admin_login    => $temp_admin_login,
+      require        => Aeolus::Conductor::Login[$temp_admin_login] }
 
-  aeolus::conductor::logout{"admin":
+  aeolus::conductor::logout{$temp_admin_login:
     require    => Aeolus::Conductor::Hwp['small-x86_64']}
 
-  Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"]
+  Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login]
+
+  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
+    require => Aeolus::Conductor::Logout[$temp_admin_login]}
+
   # TODO: create a realm and mappings
 }
 
-- 
1.7.6.5




More information about the aeolus-devel mailing list