From 01df5e3995c54cb7283e60aa6f1a724d1c8d989c Mon Sep 17 00:00:00 2001 From: Laszlo Nagy Date: Tue, 15 Feb 2022 20:34:48 +0100 Subject: [PATCH] Add new role: logon policy for ad user Lists hosts where Active Directory users have been granted log on permission. --- README.md | 2 + examples/README.md | 4 + examples/run_logon_policy_for_ad_user.yml | 21 ++ .../logon_policy_for_ad_user_filters.py | 104 ++++++++ .../modules/get_logon_policy_for_unix_host.py | 16 ++ roles/logon_policy_for_ad_user/README.md | 97 +++++++ .../defaults/main.yml | 38 +++ roles/logon_policy_for_ad_user/meta/main.yml | 66 +++++ .../tasks/gather_facts.yml | 24 ++ .../tasks/generate_reports.yml | 11 + .../tasks/get_logon_policy_for_ad_user.yml | 25 ++ roles/logon_policy_for_ad_user/tasks/main.yml | 33 +++ .../tasks/utils/set_fact_failed.yml | 14 + .../tasks/utils/set_fact_success.yml | 10 + .../tasks/utils/set_fact_unreachable.yml | 14 + ..._2020-OneIdentity_FullColor_Horizontal.png | Bin 0 -> 14172 bytes ..._2020-OneIdentity_FullColor_Horizontal.txt | 249 ++++++++++++++++++ .../logon_policy_for_ad_user_report.csv.j2 | 21 ++ .../logon_policy_for_ad_user_report.html.j2 | 45 ++++ ...n_policy_for_ad_user_report_common.html.j2 | 242 +++++++++++++++++ roles/logon_policy_for_ad_user/vars/main.yml | 1 + 21 files changed, 1037 insertions(+) create mode 100644 examples/run_logon_policy_for_ad_user.yml create mode 100644 plugins/filter/logon_policy_for_ad_user_filters.py create mode 100644 roles/logon_policy_for_ad_user/README.md create mode 100644 roles/logon_policy_for_ad_user/defaults/main.yml create mode 100644 roles/logon_policy_for_ad_user/meta/main.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/gather_facts.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/generate_reports.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/get_logon_policy_for_ad_user.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/main.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/utils/set_fact_failed.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/utils/set_fact_success.yml create mode 100644 roles/logon_policy_for_ad_user/tasks/utils/set_fact_unreachable.yml create mode 100644 roles/logon_policy_for_ad_user/templates/Logo_2020-OneIdentity_FullColor_Horizontal.png create mode 100644 roles/logon_policy_for_ad_user/templates/Logo_2020-OneIdentity_FullColor_Horizontal.txt create mode 100644 roles/logon_policy_for_ad_user/templates/logon_policy_for_ad_user_report.csv.j2 create mode 100644 roles/logon_policy_for_ad_user/templates/logon_policy_for_ad_user_report.html.j2 create mode 100644 roles/logon_policy_for_ad_user/templates/logon_policy_for_ad_user_report_common.html.j2 create mode 100644 roles/logon_policy_for_ad_user/vars/main.yml diff --git a/README.md b/README.md index 63c9173..19fef53 100644 --- a/README.md +++ b/README.md @@ -51,6 +51,8 @@ The One Identity Safeguard Authentication Services Ansible Collection, referred * [`logon_policy_for_unix_host role`](roles/logon_policy_for_unix_host/README.md): Identifies the Active Directory users that have been explicitly granted log on permissions for the Unix hosts. +* [`logon_policy_for_ad_user role`](roles/logon_policy_for_ad_user/README.md): Identifies the hosts where Active Directory users have been granted log on permission. + ## Installation ### Prerequisites diff --git a/examples/README.md b/examples/README.md index 77a5699..5e551e7 100644 --- a/examples/README.md +++ b/examples/README.md @@ -70,3 +70,7 @@ The [`ad_group_conflicts`](run_ad_group_conflicts.yml) role example shows use of The [`logon_policy_for_unix_host`](run_logon_policy_for_unix_host.yml) role example shows use of the `logon_policy_for_unix_host` role in an Ansbile playbook. The variables most likely to be overriden have been included in this playbook for your convenience even though many are still set to their default values. +## `logon_policy_for_ad_user` Role Example + +The [`logon_policy_for_ad_user`](run_logon_policy_for_ad_user.yml) role example shows use of the `logon_policy_for_ad_user` role in an Ansbile playbook. The variables most likely to be overriden have been included in this playbook for your convenience even though many are still set to their default values. + diff --git a/examples/run_logon_policy_for_ad_user.yml b/examples/run_logon_policy_for_ad_user.yml new file mode 100644 index 0000000..9a9d7a1 --- /dev/null +++ b/examples/run_logon_policy_for_ad_user.yml @@ -0,0 +1,21 @@ +--- + +- hosts: all + gather_facts: false + + # The variables you would most likely want/need to override have been included + vars: + + # Report parameters + logon_policy_for_ad_user_user_name: '' + + # Facts + logon_policy_for_ad_user_facts_generate: true + + # Reports + logon_policy_for_ad_user_reports_generate: true + logon_policy_for_ad_user_reports_backup: false + + roles: + - name: oneidentity.authentication_services.logon_policy_for_ad_user + diff --git a/plugins/filter/logon_policy_for_ad_user_filters.py b/plugins/filter/logon_policy_for_ad_user_filters.py new file mode 100644 index 0000000..6612999 --- /dev/null +++ b/plugins/filter/logon_policy_for_ad_user_filters.py @@ -0,0 +1,104 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- + +# ------------------------------------------------------------------------------ +# Copyright (c) 2022, One Identity LLC +# File: logon_policy_for_ad_user_filters.py +# Desc: Ansible filters for logon_policy_for_ad_user role +# Auth: Laszlo Nagy +# Note: +# ------------------------------------------------------------------------------ + + +# ------------------------------------------------------------------------------ +# Imports +# ------------------------------------------------------------------------------ + +# Future module imports for consistency across Python versions +from __future__ import absolute_import, division, print_function + +# Want classes to be new type for consistency across Python versions +__metaclass__ = type + +from ansible.errors import AnsibleFilterError + + +# ------------------------------------------------------------------------------ +# Helper functions +# ------------------------------------------------------------------------------ + +# ------------------------------------------------------------------------------ +def get_logon_policy_for_ad_user(logon_policy_for_unix_hosts): + """ + Example of logon_policy_for_unix_hosts: + { + "192.168.56.101": [ + [ + "QASDEV\\eripley", + "VAS", + "1003", + "10001", + "Ellen Ripley", + "/home/eripley", + "/bin/bash" + ], + [ + "QASDEV\\smartbela", + "VAS", + "1371126438", + "1000", + "Bela Smart", + "/home/smartbela", + "/bin/bash" + ] + ], + "192.168.56.103": [ + [ + "QASDEV\\eripley", + "VAS", + "1003", + "10001", + "Ellen Ripley", + "/home/eripley", + "/bin/bash" + ], + [ + "QASDEV\\senior", + "VAS", + "1234567", + "1000", + "Senior", + "/home/Senior", + "/bin/bash" + ] + ] + } + """ + + users = {} + for host in logon_policy_for_unix_hosts: + users_allowed = logon_policy_for_unix_hosts[host] + for user in users_allowed: + if user[0] not in users: + users.update({user[0]: {'user': user, 'hosts': [host]} }) + else: + users[user[0]]['hosts'].append(host) + + return users + + +# ------------------------------------------------------------------------------ +# Classes +# ------------------------------------------------------------------------------ + +# ------------------------------------------------------------------------------ +class FilterModule(object): + """ + logon_policy_for_ad_user role jinja2 filters + """ + + def filters(self): + filters = { + 'logonpolicyforaduser': get_logon_policy_for_ad_user + } + return filters diff --git a/plugins/modules/get_logon_policy_for_unix_host.py b/plugins/modules/get_logon_policy_for_unix_host.py index 7041524..9c1abc5 100644 --- a/plugins/modules/get_logon_policy_for_unix_host.py +++ b/plugins/modules/get_logon_policy_for_unix_host.py @@ -34,6 +34,12 @@ vastool list users-allowed command. options: + user_name: + description: + - Return only the specified user or all users? + type: str + required: false + default: '' facts: description: - Generate Ansible facts? @@ -110,6 +116,7 @@ # ------------------------------------------------------------------------------ # Arg choices and defaults +USER_NAME_DEFAULT = '' FACTS_DEFAULT = True FACTS_VERBOSE_DEFAULT = True FACTS_KEY_DEFAULT = 'get_logon_policy_for_unix_host_facts_key' @@ -127,6 +134,11 @@ def run_module(): # Module argument info module_args = { + 'user_name': { + 'type': 'str', + 'required': False, + 'default': USER_NAME_DEFAULT + }, 'facts': { 'type': 'bool', 'required': False, @@ -178,6 +190,7 @@ def run_normal(params, result): users_allowed = [] # Parameters + user_name = params['user_name'] if params['user_name'] else USER_NAME_DEFAULT facts = params['facts'] facts_key = params['facts_key'] if params['facts_key'] else FACTS_KEY_DEFAULT @@ -190,6 +203,9 @@ def run_normal(params, result): if err is None: err, users_allowed = run_vastool_list_users_allowed() + if user_name: + users_allowed = [user for user in users_allowed if user[0] == user_name] + except Exception: tb = traceback.format_exc() err = str(tb) diff --git a/roles/logon_policy_for_ad_user/README.md b/roles/logon_policy_for_ad_user/README.md new file mode 100644 index 0000000..6c2214d --- /dev/null +++ b/roles/logon_policy_for_ad_user/README.md @@ -0,0 +1,97 @@ +# `logon_policy_for_ad_user` Role + +The `logon_policy_for_ad_user` role creates CSV and HTML reports that list the hosts where Active Directory users have been granted log on permission. + +## Variables + +All of the variables shown below have a default value but can be overridden to suit your environment. Variable overriding can be done in playbooks, inventories, from the command line using the `-e` switch with the `ansible-playbook` command, or from Ansible Tower and AWX. See [Ansbile documentation](https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html) for further information. + +### Report parameters + +* `logon_policy_for_ad_user_user_name`: An Active Directory user can be specified in the following format: DOMAIN\SamAccountName. For example: EXAMPLE\jason. Reports will be generated for the specified user. If no user is specified then the reports will be generated for all Active Directory users who have been granted log on permission. + + Default value is: + ```yaml + logon_policy_for_ad_user_user_name: '' + ``` + +### Facts generation + +Facts generation variable defaults for all roles are set by variables in the [`common`](../common/README.md) role and can be overriden for all roles by setting the appropriate [`common`](../common/README.md) role variable. See [common role facts generation variables](../common/README.md#facts-generation) in the [`common`](../common/README.md) role. + +* `logon_policy_for_ad_user_facts_generate` enables facts generation. Implicitely enabled if `logon_policy_for_ad_user_reports_generate` is set. + + Default value is: + ```yaml + logon_policy_for_ad_user_facts_generate: "{{ facts_generate }}" + ``` + +### Report generation + +Report generation variable defaults for all roles are set by variables in the [`common`](../common/README.md) role and can be overriden for all roles by setting the appropriate [`common`](../common/README.md) role variable. See [common role report generation variables](../common/README.md#report-generation) in the [`common`](../common/README.md) role. + +* `logon_policy_for_ad_user_reports_generate` enables report generation. Reports are generated at the end of a `logon_policy_for_ad_user` run for all hosts. + + Default value is: + ```yaml + logon_policy_for_ad_user_reports_generate: "{{ reports_generate }}" + ``` + +* `logon_policy_for_ad_user_reports_backup` enables backup of prior reports by renaming them with the date and time they were generated so that the latest reports do not override the previous reports. + + Default value is: + ```yaml + logon_policy_for_ad_user_reports_backup: "{{ reports_backup }}" + + ``` + +* `logon_policy_for_ad_user_reports_host` sets the host on which the reports should be generated. + + Default value is: + ```yaml + logon_policy_for_ad_user_reports_host: "{{ reports_host }}" + ``` + +* `logon_policy_for_ad_user_reports` is a list of dictionaries that define the reports to be generated. The default value creates a CSV and HTML report using the templates included with the `logon_policy_for_ad_user` role. + + Default value is: + ```yaml + logon_policy_for_ad_user_reports: + - src: logon_policy_for_ad_user_report.csv.j2 + dest: logon_policy_for_ad_user_report.csv + - src: logon_policy_for_ad_user_report.html.j2 + dest: logon_policy_for_ad_user_report.html + ``` + + The `src` key for each list entry is the report template file on the Ansible control node. With a relative path Ansible will look in the `logon_policy_for_ad_user` role `template` directory. Use a absolute path to speciy templates located elsewhere on the Ansible control node. + + The `dest` key for each list entry is the report file on the machine specified in `logon_policy_for_ad_user_reports_host`. If `logon_policy_for_ad_user_reports_host` is set to the Ansible control node a relative path can be used and it will be relative to the directory from which the playbook is run. For other hosts, an absolute path must be used. In either case the containing directory must exist. + +## Usage + +Below is a sample playbook using the `logon_policy_for_ad_user` role. + +```yaml +--- + +- hosts: all + gather_facts: false + + # The variables you would most likely want/need to override have been included + vars: + + # Report parameters + logon_policy_for_ad_user_user_name: '' + + # Facts + logon_policy_for_ad_user_facts_generate: true + + # Reports + logon_policy_for_ad_user_reports_generate: true + logon_policy_for_ad_user_reports_backup: false + + roles: + - name: oneidentity.authentication_services.logon_policy_for_ad_user +``` + +For a copy of this and other sample playbooks see [examples](../../examples/README.md) diff --git a/roles/logon_policy_for_ad_user/defaults/main.yml b/roles/logon_policy_for_ad_user/defaults/main.yml new file mode 100644 index 0000000..b4a3013 --- /dev/null +++ b/roles/logon_policy_for_ad_user/defaults/main.yml @@ -0,0 +1,38 @@ +--- + +# Report parameters +# ------------------------------------------------------------------------------ + +logon_policy_for_ad_user_user_name: '' + + +# Facts settings +# ------------------------------------------------------------------------------ + +logon_policy_for_ad_user_facts_generate: "{{ facts_generate }}" + + +# Reports settings +# ------------------------------------------------------------------------------ + +logon_policy_for_ad_user_reports_generate: "{{ reports_generate }}" +logon_policy_for_ad_user_reports_backup: "{{ reports_backup }}" + +# On which host should the reports be generated. +# TODO: This has only been tested on the Ansible control node (127.0.0.1) +logon_policy_for_ad_user_reports_host: "{{ reports_host }}" + +# List of reports to generate +# src: Is the report template file on the Ansible control node. +# With no or relative path Ansible will look in the logon_policy_for_ad_user role template directory. +# Full path to find the template files elsewhere on the Ansible control node. +# dest: Is the destination file on the host (logon_policy_for_ad_user_reports_host.) +# With no or relative path when the destination is the Ansible control node. +# (logon_policy_for_ad_user_reports_host = 127.0.0.1) relative to the playbook directory. +# Full path for other locations or on other hosts. +# In either case the directory must already exist. +logon_policy_for_ad_user_reports: + - src: logon_policy_for_ad_user_report.csv.j2 + dest: logon_policy_for_ad_user_report.csv + - src: logon_policy_for_ad_user_report.html.j2 + dest: logon_policy_for_ad_user_report.html diff --git a/roles/logon_policy_for_ad_user/meta/main.yml b/roles/logon_policy_for_ad_user/meta/main.yml new file mode 100644 index 0000000..cd76742 --- /dev/null +++ b/roles/logon_policy_for_ad_user/meta/main.yml @@ -0,0 +1,66 @@ +--- + +galaxy_info: + + author: Laszlo Nagy + + company: One Identity + + description: > + Identifies the hosts where Active Directory users have been granted log on permission. + + issue_tracker_url: https://github.com/OneIdentity/ansible-authentication-services/issues + + license: Apache-2.0 + + min_ansible_version: 2.9 + + # + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + platforms: + - name: Amazon + versions: + - all + - name: MacOSX + versions: + - 10.12 + - 10.13 + - 10.14 + - 10.15 + - name: EL + versions: + - all + - name: Debian + versions: + - all + - name: Fedora + versions: + - all + - name: FreeBSD + versions: + - all + - name: AIX + versions: + - 7.1 + - 7.2 + - name: opensuse + versions: + - all + - name: Solaris + versions: + - all + - name: SLES + versions: + - 11 + - 12 + - 15 + - name: Ubuntu + versions: + - all + + # galaxy_tags: [] + +dependencies: + - role: common diff --git a/roles/logon_policy_for_ad_user/tasks/gather_facts.yml b/roles/logon_policy_for_ad_user/tasks/gather_facts.yml new file mode 100644 index 0000000..70522e3 --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/gather_facts.yml @@ -0,0 +1,24 @@ +--- + +# Gather facts +- name: gather host information + setup: + register: result + ignore_errors: true + ignore_unreachable: true + +- name: fail when unreachable + fail: + msg: "{{ result.msg }}" + when: result.unreachable is defined and result.unreachable == true + +# MODULE FAILURE\nSee stdout/stderr for the exact error +- name: fail when module failure + fail: + msg: "{{ result.module_stderr + result.module_stdout }}" + register: result + when: result.msg is defined and "'See stdout/stderr for the exact error' in result.msg" + +- fail: + msg: "{{ result.msg }}" + when: result.msg is defined diff --git a/roles/logon_policy_for_ad_user/tasks/generate_reports.yml b/roles/logon_policy_for_ad_user/tasks/generate_reports.yml new file mode 100644 index 0000000..f5af2c4 --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/generate_reports.yml @@ -0,0 +1,11 @@ +--- + +- name: generate reports + template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + backup: "{{ logon_policy_for_ad_user_reports_backup }}" + with_items: "{{ logon_policy_for_ad_user_reports }}" + delegate_to: "{{ logon_policy_for_ad_user_reports_host }}" + run_once: true + changed_when: false diff --git a/roles/logon_policy_for_ad_user/tasks/get_logon_policy_for_ad_user.yml b/roles/logon_policy_for_ad_user/tasks/get_logon_policy_for_ad_user.yml new file mode 100644 index 0000000..92abf93 --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/get_logon_policy_for_ad_user.yml @@ -0,0 +1,25 @@ +--- + +- name: Get logon policy for ad user + get_logon_policy_for_unix_host: + user_name: "{{ logon_policy_for_ad_user_user_name }}" + facts: "{{ logon_policy_for_ad_user_facts_generate or logon_policy_for_ad_user_reports_generate }}" + facts_key: sas_logon_policy_for_ad_user_key + register: result + failed_when: false + +# Fail if there was a message returned +- fail: + msg: "{{ result.msg }}" + when: result.msg + +- set_fact: + logon_policy_for_ad_user: | + {%- set logon_policy_for_unix_hosts = {} %} + {%- for host in play_hosts %} + {%- if logon_policy_for_unix_hosts.update({host: (hostvars[host].ansible_facts.sas_logon_policy_for_ad_user_key.users_allowed | default([])) }) %} + {%- endif %} + {%- endfor %} + {{ logon_policy_for_unix_hosts | oneidentity.authentication_services.logonpolicyforaduser() }} + run_once: true + diff --git a/roles/logon_policy_for_ad_user/tasks/main.yml b/roles/logon_policy_for_ad_user/tasks/main.yml new file mode 100644 index 0000000..4c202f9 --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/main.yml @@ -0,0 +1,33 @@ +--- + +# ------------------------------------------------------------------------------ +# Main +# ------------------------------------------------------------------------------ + +- block: + + # Gather facts + - include_tasks: gather_facts.yml + + # Gather hosts where AD users have been granted log on permission + - include_tasks: get_logon_policy_for_ad_user.yml + + # We get here on success + - include_tasks: utils/set_fact_success.yml + + ignore_unreachable: true + + rescue: + + # Set unreachable status and fail + - include_tasks: utils/set_fact_unreachable.yml + when: result.unreachable is defined and result.unreachable == true + + # Set fail status and fail + - include_tasks: utils/set_fact_failed.yml + + always: + + # Generate reports + - include_tasks: generate_reports.yml + when: logon_policy_for_ad_user_reports_generate diff --git a/roles/logon_policy_for_ad_user/tasks/utils/set_fact_failed.yml b/roles/logon_policy_for_ad_user/tasks/utils/set_fact_failed.yml new file mode 100644 index 0000000..aeb6e8d --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/utils/set_fact_failed.yml @@ -0,0 +1,14 @@ +--- + +# Set failed +- set_fact: + cacheable: true + sas_logon_policy_for_ad_user: + unreachable: false + failed: true + changed: false + when: logon_policy_for_ad_user_reports_generate or logon_policy_for_ad_user_facts_generate + +# Propogate fail +- fail: + msg: "{{ result.msg | default('Unexpected error') }}" diff --git a/roles/logon_policy_for_ad_user/tasks/utils/set_fact_success.yml b/roles/logon_policy_for_ad_user/tasks/utils/set_fact_success.yml new file mode 100644 index 0000000..32746f3 --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/utils/set_fact_success.yml @@ -0,0 +1,10 @@ +--- + +# Set success +- set_fact: + cacheable: true + sas_logon_policy_for_ad_user: + unreachable: false + failed: false + changed: false + when: logon_policy_for_ad_user_reports_generate or logon_policy_for_ad_user_facts_generate diff --git a/roles/logon_policy_for_ad_user/tasks/utils/set_fact_unreachable.yml b/roles/logon_policy_for_ad_user/tasks/utils/set_fact_unreachable.yml new file mode 100644 index 0000000..75ebd86 --- /dev/null +++ b/roles/logon_policy_for_ad_user/tasks/utils/set_fact_unreachable.yml @@ -0,0 +1,14 @@ +--- + +# Set unreachable +- set_fact: + cacheable: true + sas_logon_policy_for_ad_user: + unreachable: true + failed: true + changed: false + when: logon_policy_for_ad_user_reports_generate or logon_policy_for_ad_user_facts_generate + +# Propogate fail +- fail: + msg: "{{ result.msg | default('Unexpected error') }}" diff --git a/roles/logon_policy_for_ad_user/templates/Logo_2020-OneIdentity_FullColor_Horizontal.png b/roles/logon_policy_for_ad_user/templates/Logo_2020-OneIdentity_FullColor_Horizontal.png new file mode 100644 index 0000000000000000000000000000000000000000..d95f3f326a54bb582576b5a5f21fbaf3d25b4f6a GIT binary patch literal 14172 zcmeIZ^Gq;K}nSoMo2d!N4JPFX&A5( z3erxLlp3FFzJB`NZr?xQy2Os&^VOVgAAdSPtP?!ie=P`NN5!~gyMPXqrS4LEgm zN}m%$WLf=8WhSyaSXz*_#Ok>yB#Sw4gBDvB2`#MobMMR(^7;+ze{B4&5WPqUgEE&z00mOW+xuA95I&%`2T z09Ir9eTi=ycRY@+B$^&8rr{}m+0{hvx*jj>;bW$o7)$=IPQ{aTo{an_HxA&L_07nJ7k0pUX37sG zi>WHzF?2}B<=tN{p^mxolu1zDfQ5Sy+NEL^ z`eni2!1~7n@t*-&(6&%Tp*zJMBVhg3FFetGPBZ@Ur`fI#%yYAlJ;eTX_uAaFj1+{I z6OI}n|BS9q{ZwF9g^C@F=ZX*850=le1dLBJ9Wsg>#yMl0B%0#iHgt;oN8$ZO#YWtf z==LQ-qlVGRQJv8#bfk!7wnI3zo1`F^ypT-VCzwzS@{dj{-&rqarL#vxwD=%c+}+`V)c9J4wsVwpi#)zRIF}URAwP_$p-`V*uPA)S#t23b+G(kAA`UxL zI900HdBWH11N6?C58DS-53)yO2cGZ}T+UGz(17Cf3P%fBCVo{N8p+8xCjxem2;80z z<-n6a`)82FQtj!7|4QBy093I9*UL!G53`*%JDJKjc%Usx6Hki!RWf>imvkrkZhuakSY|{j@6a4l_qs( z=&^b`!w%Z`WC1ob)MBARg7=OO$ju&MsBD2#nt4?=d5% zz9i5IO*OxTZfTCsJ10r>5O`Q7vI}J`ryo)F7exw{K9?K*LH1>zraFU*)aA_|A2P`? zwQS4v_qO_sftZJmT%n;Hhu7If6*gv9zvP39-7SLBtn_$Lh_hMo z2}V?Eh`1u9sdooh*ZTGP%nB%2s}%fn`LwnXvHO zsc!(GbVp!+VBIEQHrZdE&rFU&dU~^hFSo?kObi7zHl=RZ7_V9&vrH>Xq;@05^O1IQ zZFip(*EnrRpW#_nZQ=q}RlkdOY~}Mz^oc)@9te}^k!ZGCEKHS>09hFMGCtu6 z1C5@^-|-n>zquT0%ts(1yE(jaF)k)3R$Pb9Y} z2n!?(IFF4Of}clDnNgC}HB=9QWm=*A)!U3v_B~BFgG;L=idMrjx3ZQF7zU*u3qbBN zdG# zVo|euKM$U!L5pk1!Y_?x=y|8(NzLsP*{(_U5Y7>SWk-{9T*yF*<7bp9f#f<;*N%G} z6+%k%jo>f~7Fh_xEp#pOx9B=ilr}Z>OY>YXUul@Ta*}v-%afhY{WJ zEjpyjxqH2~SI2bC{APBfgYOjAL8uo>vq{9f5dT=>jq0qKf6l&rt%9!vh=~$I#mYm+ zL|LW#^@RugTgUD-jLt$=#hy_&ZpGTWwL1L{22xuo6qQ`r^-oc(fW!nqVnPwhl{`}p zl$Ry`&Q&g%k*aQP|`ivizuaiU*BvC5@DwzoDbh`y5 z!bnIP{f=V)g39>P9^_vC!`ge5xM}h}O+au>%rw7kr~l+ftO529tS?c;x>E-u!?V8M z_}We@f71=r-z9aHp|vVrRD%bZRZE3v(m@~u06 z6-A=%y~93@J{nY5X2F-(5ussb?#TzjR77@M%0x?(C~;S<7spE+*VZHkDm_0?Prav| zg@ycLp4u!~AJT1}Ef2YyT8{p;nm*q3JCic|a zRF3l>>0Rc}Sn^P6BXkA4+F3>Bq_*}%%Sn4(GQ{p#ZK$JMc$yDYokr`HkQSbw?!gTO zxGLD{({OvCGMMO2g6x>Pe3c`=(czn4co{#j%^FK_$+LWVnkB>_-*E-A8e+m0lDqKb zmF|Xn*eS2z3qv}XdCT)z5${(RJ&W>=Uon^i`N`RaPFY8}3;PgKbj=pMOXt>O){4S- zly=*6mnV~W!L;sb&e}w9f?H*#a>_W)>z>M2)?eH05K`0vDo=X5yEx&dceODq+TPP zv7eaDw<|ZJc4UO@FE$3ZRGU_w6G>g(&%W~>ZR58Q%)fj8&J)L| zm0;mGH&?SIy&;dP$|i8-WNvH{jJiZ`17928g*|D_D>*YJr7bT6JNpN|zQU*hbGbtm zSHHtK#eZ)=c1RQT$!HUxJF0x52qA#VkOtKkM|h+^!eTX zdT10jCt1^)bxLWSX$mwkzOP!@&WpS5rBD74iw*S~?hMBGkbacXgizd7(l1OX=zdXhN;!t?H~vrOwLx8I9-8n}>zGW+DiHAJx9zhC%;Xome%9n!cM+P_#qpuYXw~cM@@3r^ zpPi_koQYI~1w(<*!e;-%;c4GN_NV!GoHmHi$*abSm_Wlah_)JnNIP^rCSrS){pCb2 zyDq^p%WDBVLtD=M!L&+6UwR-liXMJ$gU4PzvYs)J3bl!Lts){5i?Zi~{IbC_zd{^4 z9^EN#qjL>(`p=*t`l>|dMbgUbtY3wPHQI%<-^ZXh>JKtH--4MM3u^aDMyjs#KId+| zeR=x4(UgsRq?YNHyrpk_aMfDgNw>Gk>CjP#rLq|EbbQc>K%^qC^ffNC2<@i^0sIMn zO7Cs`1kM+4aW5~r$T_5R$?D$p#@X>sRwfZ&tm;@_9MJ~qs`hj0jJDfPgH$gF zibdc3yG`48;t?o6wsfqx`ZZ#4^BL_HZrO6yvmJaJ&~%-5088&*AsO-yNc?Ix+;67% zzYjj+LLbfK__XDC70VB~QLR5S0VMikc=i4Fb4R!GOr&kccR@U9ONV4 zrl|ZqMl2j14%b)Zhn}^oJ>No}wl(eTe6)JUY=cNFc#9cVppB0i=Ao^p3&(7Ivk+4! zM$n`kE2xUi>QoFSXfLxGmBEgG2-WqeooLB#P;0LI8hfnb9~*Iq-aZQzFRuGKZ%2&{^@6H%hRGy+KX1-`6IcuR zX8H1%tB!dP%rZ@d4#*9X$dD&8&W^t1&{XhTh*YSHdN_h&sLkn#_Xoi#>0?fFTXWT7 zOkOP0*%jQc3cE&_7UI)NKe=Zm?USf{d8Y*ng0lkuImGZLcepqN#tLjN1pW$G$5Wu; zBzu0=GpPy-*{UEOW}S7SFSfVt94}^j-nn`izyDZ7TYqnH=V5$uh1W>MSh`4Y=YYN6 zbI)`^VWYGvb0K3CZ`#21k6Mb@EZXI*==FtwQF&G%fjpzeVq~ZwR;=~U1z0{LDu_f^ ze+itWmvR6w(1sr^Pmjin&SBG`r&M)WvEbQieQ%uPBXBA4^-A)U) zqZ)#KDaWNY>j;%fuHOrR&6+;CF?SQ8$k!F3&G*uIWoyep>0#M@&%=(TNYB~c)1}+h z!4pYgSHnU-I-!Zax1+o<^km`2Qcb>v-xsd={uvxlAv{#>r>(yujQkpg6ZpE-wi0an z<0oWpW-Dt42{!0F?)JIcyehN)rW(sE>U=fGoQ@GgFowaIviq@I$2L}hgv3T@|=hGXY-6UUynN$g92rk zT-;xlc&QFlpQvT}?0#p4`_`ct zSSbzXBm0i&45CHN83}&|hhe0t&>K^-emXz3q3nE3jrP&x6z`d4NyrrY&+QCVt;i_3 zH4g!C;%?`1BC}lEFTw+#x!Fcr!};TkKc=OQdV z^nJ!V_s6nvf*l2Ce5tXgWBnsLW7xhZMZLs~kfDj@*E@T?Ub+MKJ_bLRSlv=TD%-n_ zzqN;__RUOCAi!r6@b*XT|(LDH3ihSI_4? z*U_xp6t`qIIz)R@&g4iI!mvbab1)!>;Y**RJDvLuhg>J@Dy7UCpT%ba=PKt>Qpu=) zO`HGp!_}1ZM`N@ajScWbun$!gy33?pAuLeAk;Nj#FcY0OeLxJqqbW}(j{BTj8ebXL>9KHhEv<0@ zOZMpXUoHiX6=!LJ#4Mnas%#aA53H};PM1&q>c9R;AO5O~<6DRUlg;S1Yjy$Z$S9+c zgcDq5UVB+Bivp^_+n60C%%4nemv6d?F8ND9A2A<%>-q(p!BR~(KwpF! zK69TRF5`Wqxy;NoIaDm#LuiAP^Xrv=O@4aK$lK(Pyx_^k;tgNfNc0PD-sujmKOI0x zEWz8f>iD+)+Rk+K66a~BbP+*gME#i4Oz3wdB%Y+aJg2K(iIlkHFikE`R2>?qveZ z0?RsB)#wMx%rJuavLQKah~9N)&%E#O2GsHdUIe&}mci+GN!hK-KCw*7-=B7`d@BfR zBV9A&Qw5sCtOR1kTG7p(ADRt6KTvdp@it)kZkVk6WSN-o|>}YS-zwdA( z(xcNf6GJjcN4doPB^7R;Y6vwACiVIZntf7d53kI41u~X+n0kw)W$km@$Wgtj^~K-A z@}05oKyueBw`t>2t7X;Ki!6@ANX>x4mZ}ht#_l(Z4bxtKqDqOs4xbUrPT`Fw9IkkAu_2v4wV~*k6 zxW*e$u(_7&Wlgmbkxtt`+~b1>v1+Yece*<56pwftqif z=Fa`%0R+$Son3smSGAlb(~>GtH3(F?xrvH}o6F3f-&M=%CB^K>1bfy%;wCJoTHm5B zBHGVN=YCnSOou!b&SznBs?;5x+9IA?qZ1B%8%0wBsca(9aKo%BPAcY?Am?#yLB6ij1Kp}IW88*U1_%2py8ie6P=A13P2gjvxli#`w=-JC z$TzF!tcec3?;f_l+BxWdAhve*#MN5Wbh2Mb~dU z;R>Iqh6G~URyFv)cL0SYhsnSkSk8PtWn3)D^`#zgL&j8b#aidSMD&M~bM1l^w=|Iw zJ}QCFuy<^Tx+pt=Z8EYi!#g8rlI*9a_piv&{lJS+a4pd4fKLcxDiTpzU{ z))zsupT(+`0M3GAKJt-r%lFPK>c)M02;?ImX8~cSRPkVe6SB|&qR5a- zH*&4K3!6D_CfY@p(B3cJKCxwn&b^F(XW#F%x%=qBVZ+?@$^}__u4(Wp+$D(yipI!4 zGj|BD+_VIJQm(&KQQt9D!{tE*95>Bs<`!MWrRB=6094Ia@GHf2*GiwRhjVCJ=^_|HF=<)` z?cf^St;9wcke1zs7S2XzD*z*aemsE^?e2U$&IMWw|M=oeqfAWv2iH6#X<^?iAj^RI zJ&?)bk1G47%$$&`XWoEUhRp&87d1J-Ml>G>NJd7ROeD#C;# z+2>yU);~7bXIB1P@$9cn)#TKb{sv8ZMJpG|ee|0|ambrOy2LVSFJr~WfcchXYh|Ba z{|UUE%Z&Fkf8et2En!}vnHf(9$05Yd6Nfbda~~|I=(Z2LH4lAiLUqLuPQW^tecWL` z^I5I`uB{TEZjN%S0CPPJXoOPI$`aiCpg>9&v=QW;BhReOmqeHkO_`Xt2^SkgHPlGN z?1MRn`&;Vh;dM2_Q+=+3pmzL`6L^eU^^-ictS?sgXdSKBJ%I7m|9!U#+;4E0WkV=&WO*6yP_pu5+Iezw zFlL8j!duCcRUk`M*=U^VO80CgT2`^$alZwFMNqE6B+WzGn{O94#3Qaw6IMWBcpxN< zWrU9^7lT6aek7oc2tm~--R|=nxZZ|1+?yxPb=(FzHoxxQyU#Ooh!Wx7+BAsSO}9ZH z!i|bS)5(iHl+GhAyTXjY2JeAx;|-9H1Ue%9R^p=DUeo{!s z!dm9JSvw%b*Kf$EMNFyE?%sF7Cl<}h!g>ZBC{49SWgP7Q!I-8Dzy0cvnnKt)Vi$&wPH=-U;8 zCjkJ5aS^FPP?L+0BL>Vx=o3z(dl0D7gYEr*E#JeN18VRZ{j)m*bfM--L*|TI=PiMd zg}(vL2td2cX@9ZICu7Apr>?{*8i_YJ{5y;}LK+{FL+^a?_ z$tTBQh)IQ0;t|4vcL?Ew+RgU^y_b~8vIcNRW4i9h*Dwmviqy(6fiq0CGPrCaX@lC^ zH#5)WC%+^lC0LQ;WmJ7QHvlbKQ$;phEjPznQw=wp+kHf)WtGsu&q``4vP9B$>_-v$ zf!QvX>W(@}J!#?wcGv5g=p9UfmzQPU^Eb39MsV&S@LN!s01n?_0@KLiiC4nhH{`Y? z+FSE8Hw)b~zQ!qo=C+ymT1dY0nMm2xxp`>lqe{XG9X$LxS~(b- z*4^xiG!hR6dSg%q;FGh!4a%%ez6;2#fvqPmsKhfVAs@Jr!=?AGrJ)tDLY7mt@gom< zmTcuSWTSaG67%AJ+;)WdGiSSG_XxIhHBFO1wHCCXErrdxbcVjJ0q42Uu zVpTg~L4IiM{2uUrc;iMrY-VXXJ4nUBu;2DE& z0FvQvRgj_q4*aI+cjBilC;aB~xp(*-@FBE)_v_T zi=Y2`k1LY{r}+E~HoGQzq1-h-03zrFD}F{h`X%0jHi>cJ*oJ|1=4S`6=NAYdsE`wR z;>C^2Y^zmg+N+i^?+S`{z-Sb_e?1rS0^Jvsb2g% z(POR^$Tu#)%LL7d_ev!Xws!I!K?67a%Tph`GAIaiEy)Sy;1%2FMBe zY4_=r-hxr$B18NQhRh;EJaW|KQZd_z$@>@Yw7G>ZWI-`0IDvw9m+y%v;WA(Zea1625gA$Y^Rr}BiyWYPwPKmzccB4$*8n916ru_xN|n;Aw|&Z)xN2$MSjV<}dEZ6s z_=e?s2DqFcHeSe^eC;U@+n&p)_(mLI86B(&|8h1Zj7>KP{pCJpSd z3c764H1sdKW;t&U>T^(Yg=_Gx0&mbCO!YET>cq7QQVk$XM@2wg&CQ;!mUClYM8Xja z{K13d)hfwF+@4XVTr_3#XK{0V+;eUZ^P6T|;iCFHWQ+65rl1NIB`j;J4K zur~~=e;Q_{SPj8&7IN~l?IGP{%Qg=@j=WRQL6uw+R-yLBhY>zNf(~!4!tw1n8~&v> zYX1gUq^pG9HBjP$Zyk4Nt$8sP&fP6He1z#;X|K&0kS&3Y zU-NGLbW%=JEP4UE9y}PkEKIzI*J;0__FK4efx>3^8C2KzxW0>HE$M-tMsq|7L~)9D zgcq<=9PsM;TGhU<73W^h1lRLGqoqTP>o9xyf0{zxPbFuA=XU2q#7#u|N90C3Sai=? zHa_F&zT?&nYs~a{_`=l#jW{T5KU-S(K7PV;i`gNAN|w^mFWso%OKrJM!~y4;_A;pj zhC~zhWN<*$O>kO~2jicko$#v8wKedQ0Q1ykdQ2?RwM1)7b5$hZmkTu~K?+v!%PsZ$N4sKsuXzLfgq%VdOWXz553%p7C zuAt^zrhZ~t!z$ zHmFP1HxB_5OoiJX28?^pzo3RX7mzTbZL7Sqk@Iqb&QoUOS|wO2b7;X{^HbUr1BMG< z-gKpgn>)R%n1W>PEJfLznd@Q(oSjw~`X|5Fj|$@pyYSeh6X(`*Q2^HHuJel*bJt|f zPc+KF98D_tr>#PbLnjrmzNvO^dxq!`IR(1*RYF5eA6ocRj3iJxb>5n_^JRL+K7Ga0 zFZ79@F8nxrwNH`&j<)AWby{12N8CH%NSq_koTLZ68Q^`~98s5x47wA<5peqLAyHrT z>^LfI=RTq}|88oR>|FKlHX))P=a5;GMCM*Sg0RNgA^N#;;kK&dT>wW?Zz~@eA+1n1 zwE0oXEembHS6EAz6g7YFT;$g8&OViH(v66uF^DQpz7tG_J+3IA*I?fo1<1AbiclZ? zRdyDO0%K9WSEh^JE?{^qJGF@w3s+TUM|^@UT^!V5Gl@H2+oB;M>8ZynX5S$SRVOG0 zM>{ssACTq|+dvvV z3W!fippE8%qaWyX_+*q6#xs)~GSYMZrrqW$GMCFJGw;-T&Xz4Ak{!5kg^q z3s`tL2GeT#+gQ_K?*461bs5mSs1Hyj=Re-#9`Fg5yT)YRf~$LLtc0lXm;Iw!NLuSbNpL znP}8osHwzYG22|>9uG9kZK5UyU-`I*sC~IbMGA@6>NPTq;$Q4 zuZdl=y^4Ff>I&0>qlqpm@-?i1R3G#p#`TX(&c?$^b50TkZw7!D61wo~8j%gOGH39~ zE}zNmiwEr?YzP&8&+7LZhy0b*%D0>s#t!OsYB0>+#m@ZEc!QTwEG5!yw z8&>V}!ldmx6j~aE2pGJLyD^IuET$^FB0lId(q$-2|nnPrB65YcqtPP$M`g5=|(0$_`kSEs?1 z)4ejVGy6j~qk2}CdG>R^>;q1=vOjQ5>}r(k;Dcxp&95{aQ0~9?7Baeu3pQ zH$|3D>i+}5G7Us0$>ca#=|)4M5*oooW!*&e%jXbr*{5^D|AhJj2xSTMC9TW7tG1^t zHSrU*?T&{>yt52W6h41rs#663AmRID=9~d%-@#(DET=(V4_uVu>-(VUpv`xJjoDqms&c9 z;qhI^huGZ^yVKd(IPvq}HL+H}Tnc9N*>fs6{#JwuP({SdLYR|muR4HV@m$}PTtB#R zYGqIT=LA2@(nD^9Ch#WQc{zhiT^I*=*N-cn?LB@?@sWQ_w9D*x>{)JKQd+K9yH?Nl zx#c~_L3F)b9z>v?kDuZW)!a7X4M1`g(x{W$%K*TRz-?DE2if^pAenhM*2SJr*2D83 zFg8P|!rmUx5(^&e)H?TV900C6DUSER8ocZOsL8hrZ^XMK7&I`)Sx~UCp8+#9z@3s2 z(B$!BkBoSEC!Ip3?Bab(88#JB;_ug$>;Mq}Wi{ij$u+>rt@Pb*QsPlRo%CX@kDwqz zxdRBAPjvtq&<_Yy+ipyl*z|o8cd6s+bNN#%MzJP{91_ie3-j@%l61GiPEq|2BHj_% zAT4nr5f$qq*Jal4U&Dx84d#)_cu8`~iSDcY*!`kcQeL#!)Q&6tpGTYan91Hw0lymY z85`3c!mVouJRH9BUZ?QVjgJX#K4x%--Jb`9A0wAOQRD!?^7cyrq?#$l-ak?cC)qBX znvXiuNlZiYhoiw?e-#~YkN55#`{1^e=2v;V|AzqwK<2IrjEF5My+oEpvfOD^v)Cy3wQ$6-n@Si5p8Ql_rC|grX8O-9k)%N#D9*01K9~^hK6MR zA-g+)4@8Y>|>*D#`dV?*NFvN&;J``Rb)T`|hA z8Wi^pz(?x + + {# Create overall page container #} +
+ + {# Title #} + {{ report.title(report_name) }} + + {# Data table #} + {{ report.table() }} + + {# Footer #} + {{ report.footer(collection_version, now(fmt='%Y-%m-%d %H:%M:%S')) }} + + {# JS libraries #} + {{ report.libraries() }} + + {# Table data #} + {{ report.table_data() }} + + {# Table detail formatter #} + {{ report.table_detail_formatter() }} + + {# Table detail copy tooltip #} + {{ report.table_detail_tooltip() }} + + {# Table cell style #} + {{ report.table_cell_style() }} + +
+ + + +{# HTML end #} +{{ report.end() }} diff --git a/roles/logon_policy_for_ad_user/templates/logon_policy_for_ad_user_report_common.html.j2 b/roles/logon_policy_for_ad_user/templates/logon_policy_for_ad_user_report_common.html.j2 new file mode 100644 index 0000000..9ccc8ec --- /dev/null +++ b/roles/logon_policy_for_ad_user/templates/logon_policy_for_ad_user_report_common.html.j2 @@ -0,0 +1,242 @@ +{# Header #} +{% macro head(report_name) %} + + + + + {# Required meta tags for Bootstrap #} + + + + {# CSS libraries include at end of head per best practices #} + + + + + {# Ionicons preferred method of inclusion #} + + + + Safeguard Authentication Services: {{ report_name }} + +{% endmacro %} + +{# Title #} +{% macro title(report_name) %} +
+ + + {# Import base-64-encoded logo and embed in doc #} + {% import 'Logo_2020-OneIdentity_FullColor_Horizontal.txt' as logo %} + One Identity + + Safeguard Authentication Services {{ report_name }} + +
+The Logon Policy for AD User report is used to identify the hosts where one or more AD Users have been granted logon permission. +
+{% if logon_policy_for_ad_user_user_name %} +Selected AD User: {{logon_policy_for_ad_user_user_name}}
+{% else %} +Selected AD User: All
+{% endif %} +
+{% endmacro %} + + +{# Table #} +{% macro table() %} + + + + + + + + + + + + + +
IdNumber of HostsUsernameUser IDGroup IDCommentHome DirectoryLogin Shell
+ +{% for policy in logon_policy_for_ad_user | sort %} + + + + + + + + + + + +
HostnameGroupIP AddressOS DistroOS VersionHW Arch
+{% endfor %} +{% endmacro %} + +{# Footer #} +{% macro footer(report_version, report_time) %} + +

Generated: {{ report_time }}

+

Version: {{ report_version }}

+ +{% endmacro %} + +{# JS libraries #} +{% macro libraries() %} + + + + + +{% endmacro %} + +{# Table data #} +{% macro table_data() %} + +{% endmacro %} + +{# Table detail formatter #} +{% macro table_detail_formatter() %} + +{% endmacro %} + +{# Table detail copy tooltip #} +{% macro table_detail_tooltip() %} + +{% endmacro %} + +{# Table cell style #} +{% macro table_cell_style() %} + +{% endmacro %} + +{# HTML end #} +{% macro end() %} + +{% endmacro %} diff --git a/roles/logon_policy_for_ad_user/vars/main.yml b/roles/logon_policy_for_ad_user/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/logon_policy_for_ad_user/vars/main.yml @@ -0,0 +1 @@ +---