def create_api_key(identity_client, user_id, key, module):
try:
cakd = CreateApiKeyDetails()
cakd.key = key
result = oci_utils.create_resource(
resource_type=RESOURCE_NAME,
create_fn=identity_client.upload_api_key,
kwargs_create={
"user_id": user_id,
"create_api_key_details": cakd
},
module=module)
resource = result[RESOURCE_NAME]
api_key_id = resource["key_id"]
get_logger().info("Created API signing key %s", to_dict(resource))
# API keys don't have a get<resource> and so we can't use oci_utils.create_and_wait
# The following logic manually checks if the API key in `list_api_keys` has reached the desired ACTIVE state
response = identity_client.list_api_keys(user_id)
# wait until the created API Key reaches Active state
oci.wait_until(identity_client,
response,
evaluate_response=lambda resp: _is_api_key_active(
resp.data, api_key_id))
result[RESOURCE_NAME] = to_dict(
_get_api_key_from_id(identity_client, user_id, api_key_id, module))
return result
except ServiceError as ex:
module.fail_json(msg=ex.message)
except MaximumWaitTimeExceeded as mwte:
module.fail_json(msg=str(mwte))
def create_soc_user():
"""Create a SOC user, upload public key and add the user to the SOC group"""
# Load Public Key
apikeydetails = CreateApiKeyDetails()
with open(fileName, "r") as certfile:
data = certfile.read()
apikeydetails.key = data
# Populate a user request
request = CreateUserDetails()
request.compartment_id = compartment_id
request.name = userName
request.description = "SOC User created For WAF Access"
try:
user = identity.create_user(request)
uid = user.data.id
except oci.exceptions.ServiceError as e:
if e.status == 409:
print("User '" + request.name + "' already exists.")
structured_user_search = oci.resource_search.models.StructuredSearchDetails(
query="query user resources where name = '" + userName + "'",
type='Structured',
matching_context_type=oci.resource_search.models.SearchDetails.
MATCHING_CONTEXT_TYPE_NONE)
results = search_client.search_resources(structured_user_search)
for result in results.data.items:
if debug:
print("User ID : " + result.identifier)
uid = result.identifier
else:
print(e)
# Upload the user's public cert for API Access
try:
identity.upload_api_key(uid, apikeydetails)
print("User's public key is uploaded successfully")
except oci.exceptions.ServiceError as e:
if e.status == 409:
print("User " + userName +
" already has a public key associated, do nothing")
else:
print(e)
# Add the newly created user to the SOC Group
try:
add_soc_member(uid)
except oci.exceptions.ServiceError as e:
if e.status == 409:
print("User" + userName +
" has been already added to the group :" + groupName)
else:
print(e)
def main():
set_logger(oci_utils.get_logger("oci_api_key"))
module_args = oci_utils.get_common_arg_spec(supports_create=True, supports_wait=True)
module_args.update(dict(
user_id=dict(type='str', required=True),
api_key_id=dict(type='str', required=False, aliases=['id']),
api_signing_key=dict(type='str', required=False, aliases=['key']),
state=dict(type='str', required=False, default='present', choices=['present', 'absent'])
))
module = AnsibleModule(
argument_spec=module_args,
supports_check_mode=False,
required_if=[('state', 'absent', ['api_key_id'])],
)
if not HAS_OCI_PY_SDK:
module.fail_json(msg='oci python sdk required for this module.')
identity_client = oci_utils.create_service_client(module, IdentityClient)
state = module.params['state']
result = dict(changed=False)
user_id = module.params.get("user_id", None)
public_key = module.params.get("api_signing_key", None)
api_key_id = module.params.get("api_key_id", None)
if api_key_id is not None:
api_key = _get_api_key_from_id(identity_client, user_id, api_key_id, module)
if state == 'absent':
get_logger().debug("Delete api password %s for user %s requested", api_key_id, user_id)
if api_key is not None:
get_logger().debug("Deleting %s", api_key.key_id)
result = delete_api_key(identity_client, user_id, api_key_id, module)
else:
get_logger().debug("API Signing Key %s already deleted.", api_key_id)
elif state == 'present':
module.fail_json(msg="API signing key cannot be updated.")
else:
result = oci_utils.check_and_create_resource(resource_type=RESOURCE_NAME, create_fn=create_api_key,
kwargs_create={"identity_client": identity_client,
"user_id": user_id, "key": public_key,
"module": module},
list_fn=identity_client.list_api_keys,
kwargs_list={"user_id": user_id},
module=module,
model=CreateApiKeyDetails()
)
module.exit_json(**result)