[PATCH aeolus-configure] BZ#806001 - Remove admin profile
John Eckersberg
jeckersb at redhat.com
Thu Jun 21 22:50:03 UTC 2012
On Thu, 21 Jun 2012 17:41:08 -0500, Steve Linabery <slinaber at redhat.com> wrote:
> The default admin user will be created as part of the conductor
> manifest, and this will be indicated by creation of a file in
> /var/lib/aeolus-configure. This will ensure the admin user does not
> get created by configure after multiple configure invocations. The
> expectation is for administrative users to be managed via the web UI
> (or API), not via configure.
> ---
> recipes/aeolus/manifests/conductor.pp | 9 ++++++++-
> recipes/aeolus/manifests/conductor/site_admin.pp | 8 ++++++--
> 2 files changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
> index 5733f2d..96405c1 100644
> --- a/recipes/aeolus/manifests/conductor.pp
> +++ b/recipes/aeolus/manifests/conductor.pp
> @@ -131,7 +131,14 @@ class aeolus::conductor inherits aeolus {
> rails_env => "production",
> require => Aeolus::Rails::Migrate::Db[migrate_aeolus_database]}
>
> - ### Setup sshd for deltacloud
> + # Create default admin user
> + aeolus::conductor::site_admin{"admin":
> + email => 'root at localhost.localdomain',
> + password => "password",
> + first_name => 'Administrator',
> + last_name => ''}
> +
> + ### Setup sshd for deltacloud
> package { "openssh-server": ensure => installed }
> service{"sshd":
> require => Package["openssh-server"],
> diff --git a/recipes/aeolus/manifests/conductor/site_admin.pp b/recipes/aeolus/manifests/conductor/site_admin.pp
> index b9feb7c..4c3a91d 100644
> --- a/recipes/aeolus/manifests/conductor/site_admin.pp
> +++ b/recipes/aeolus/manifests/conductor/site_admin.pp
> @@ -5,13 +5,17 @@ define aeolus::conductor::site_admin($email="", $password="", $first_name="", $l
> environment => "RAILS_ENV=production",
> command => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]",
> logoutput => true,
> - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"",
> + creates => "/var/lib/aeolus-conductor/production.admin",
> require => Aeolus::Rails::Seed::Db["seed_aeolus_database"]}
> exec{"grant_site_admin_privs":
> cwd => '/usr/share/aeolus-conductor',
> environment => "RAILS_ENV=production",
> command => "/usr/bin/rake dc:site_admin[${name}]",
> logoutput => true,
> - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';\"` = \"1\"",
> + creates => "/var/lib/aeolus-conductor/production.admin",
> require => Exec[create_site_admin_user]}
> + file{"/var/lib/aeolus-conductor/production.admin":
> + ensure => present,
> + recurse => true,
> + require => Exec['grant_site_admin_privs']}
> }
> --
> 1.7.6.5
>
ACK/pushed. Tested by:
- run aeolus-configure
- log in
- change admin password
- logout
- run aeolus-configure
- log in (with modified password)
- change admin login to 'notadmin'
- log out
- run aeolus-configure
- log in (with modified username + password)
More information about the aeolus-devel
mailing list