The default admin user will be created as part of the conductor manifest, and this will be indicated by creation of a file in /var/lib/aeolus-configure. This will ensure the admin user does not get created by configure after multiple configure invocations. The expectation is for administrative users to be managed via the web UI (or API), not via configure. --- recipes/aeolus/manifests/conductor.pp | 9 ++++++++- recipes/aeolus/manifests/conductor/site_admin.pp | 8 ++++++-- 2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp index 5733f2d..96405c1 100644 --- a/recipes/aeolus/manifests/conductor.pp +++ b/recipes/aeolus/manifests/conductor.pp @@ -131,7 +131,14 @@ class aeolus::conductor inherits aeolus { rails_env => "production", require => Aeolus::Rails::Migrate::Db[migrate_aeolus_database]}
- ### Setup sshd for deltacloud + # Create default admin user + aeolus::conductor::site_admin{"admin": + email => 'root@localhost.localdomain', + password => "password", + first_name => 'Administrator', + last_name => ''} + + ### Setup sshd for deltacloud package { "openssh-server": ensure => installed } service{"sshd": require => Package["openssh-server"], diff --git a/recipes/aeolus/manifests/conductor/site_admin.pp b/recipes/aeolus/manifests/conductor/site_admin.pp index b9feb7c..4c3a91d 100644 --- a/recipes/aeolus/manifests/conductor/site_admin.pp +++ b/recipes/aeolus/manifests/conductor/site_admin.pp @@ -5,13 +5,17 @@ define aeolus::conductor::site_admin($email="", $password="", $first_name="", $l environment => "RAILS_ENV=production", command => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]", logoutput => true, - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c "select count(*) from users where login = '${name}';"` = "1"", + creates => "/var/lib/aeolus-conductor/production.admin", require => Aeolus::Rails::Seed::Db["seed_aeolus_database"]} exec{"grant_site_admin_privs": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production", command => "/usr/bin/rake dc:site_admin[${name}]", logoutput => true, - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c "select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';"` = "1"", + creates => "/var/lib/aeolus-conductor/production.admin", require => Exec[create_site_admin_user]} + file{"/var/lib/aeolus-conductor/production.admin": + ensure => present, + recurse => true, + require => Exec['grant_site_admin_privs']} }
On Thu, 21 Jun 2012 17:41:08 -0500, Steve Linabery slinaber@redhat.com wrote:
The default admin user will be created as part of the conductor manifest, and this will be indicated by creation of a file in /var/lib/aeolus-configure. This will ensure the admin user does not get created by configure after multiple configure invocations. The expectation is for administrative users to be managed via the web UI (or API), not via configure.
recipes/aeolus/manifests/conductor.pp | 9 ++++++++- recipes/aeolus/manifests/conductor/site_admin.pp | 8 ++++++-- 2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp index 5733f2d..96405c1 100644 --- a/recipes/aeolus/manifests/conductor.pp +++ b/recipes/aeolus/manifests/conductor.pp @@ -131,7 +131,14 @@ class aeolus::conductor inherits aeolus { rails_env => "production", require => Aeolus::Rails::Migrate::Db[migrate_aeolus_database]}
- ### Setup sshd for deltacloud
- # Create default admin user
- aeolus::conductor::site_admin{"admin":
email => 'root@localhost.localdomain',
password => "password",
first_name => 'Administrator',
last_name => ''}
- ### Setup sshd for deltacloud package { "openssh-server": ensure => installed } service{"sshd": require => Package["openssh-server"],
diff --git a/recipes/aeolus/manifests/conductor/site_admin.pp b/recipes/aeolus/manifests/conductor/site_admin.pp index b9feb7c..4c3a91d 100644 --- a/recipes/aeolus/manifests/conductor/site_admin.pp +++ b/recipes/aeolus/manifests/conductor/site_admin.pp @@ -5,13 +5,17 @@ define aeolus::conductor::site_admin($email="", $password="", $first_name="", $l environment => "RAILS_ENV=production", command => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]", logoutput => true,
unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"",
exec{"grant_site_admin_privs": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production", command => "/usr/bin/rake dc:site_admin[${name}]", logoutput => true,creates => "/var/lib/aeolus-conductor/production.admin", require => Aeolus::Rails::Seed::Db["seed_aeolus_database"]}
unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';\"` = \"1\"",
creates => "/var/lib/aeolus-conductor/production.admin", require => Exec[create_site_admin_user]}
- file{"/var/lib/aeolus-conductor/production.admin":
ensure => present,
recurse => true,
require => Exec['grant_site_admin_privs']}
}
1.7.6.5
ACK/pushed. Tested by:
- run aeolus-configure - log in - change admin password - logout - run aeolus-configure - log in (with modified password) - change admin login to 'notadmin' - log out - run aeolus-configure - log in (with modified username + password)
aeolus-devel@lists.fedorahosted.org