1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
# cyberark_user
This module allows admins to Add, Delete, and Modify CyberArk Vault Users. The ability to modify consists of the following:
* Enable User<br>
* Disable User<br>
* Add/Remove Group<br>
* Set New Password<br>
* Force "change password at next login"<br>
* Modify User Information Fields<br>
* Email<br>
* First Name<br>
* Last Name<br>
* Expiry Date<br>
* User Type<br>
* Location<br>
#### Limitations
**Idempotency** - All actions taken in the playbook adhere to the Ansible idempotency guidelines _except_ for password change. If you have the playbook set to modify a password it will "modify" the password every time the playbook is run, even if it is the same password.<br>
**Group Creation** - If the value for `group_name` does not exist in the Vault it will not create that group, the user action that was expected will fail.
#### Available Fields
```
options:
username:
description:
- The name of the user who will be queried (for details), added, updated or deleted.
type: str
required: true
state:
description:
- Specifies the state needed for the user present for create user, absent for delete user.
type: str
choices: [ absent, present ]
default: present
cyberark_session:
description:
- Dictionary set by a CyberArk authentication containing the different values to perform actions on a logged-on CyberArk session,
please see M(cyberark_authentication) module for an example of cyberark_session.
type: dict
required: true
initial_password:
description:
- The password that the new user will use to log on the first time.
- This password must meet the password policy requirements.
- This parameter is required when state is present -- Add User.
type: str
new_password:
description:
- The user updated password. Make sure that this password meets the password policy requirements.
type: str
email:
description:
- The user email address.
type: str
first_name:
description:
- The user first name.
type: str
last_name:
description:
- The user last name.
type: str
change_password_on_the_next_logon:
description:
- Whether or not the user must change their password in their next logon.
type: bool
default: false
expiry_date:
description:
- The date and time when the user account will expire and become disabled.
type: str
user_type_name:
description:
- The type of user.
- The parameter defaults to C(EPVUser).
type: str
disabled:
description:
- Whether or not the user will be disabled.
type: bool
default: false
location:
description:
- The Vault Location for the user.
type: str
group_name:
description:
- The name of the group the user will be added to.
type: str
```
## Example Playbooks
This playbook will check if username `admin` exists, if it does not, it will provision the user in the Vault, add it to the `Auditors` group and set the account to be changed at first logon.
```yaml
- name: Logon to CyberArk Vault using PAS Web Services SDK
cyberark_authentication:
api_base_url: https://components.cyberark.local
use_shared_logon_authentication: true
- name: Create user, add to Group
cyberark_user:
username: admin
first_name: "Cyber"
last_name: "Admin"
email: "cyber.admin@ansibledev.com"
initial_password: PA$$Word123
user_type_name: EPVUser
change_password_on_the_next_logon: true
group_name: Auditors
state: present
cyberark_session: '{{ cyberark_session }}'
register: cyberarkaction
- name: Logoff from CyberArk Vault
cyberark_authentication:
state: absent
cyberark_session: '{{ cyberark_session }}'
```
This playbook will identify the user and delete it from the CyberArk Vault based on the `state: absent` parameter.
```yaml
- name: Logon to CyberArk Vault using PAS Web Services SDK - use_shared_logon_authentication
cyberark_authentication:
api_base_url: "{{ web_services_base_url }}"
use_shared_logon_authentication: true
- name: Removing a CyberArk User
cyberark_user:
username: "ansibleuser"
state: absent
cyberark_session: "{{ cyberark_session }}"
register: cyberarkaction
- name: Logoff from CyberArk Vault
cyberark_authentication:
state: absent
cyberark_session: "{{ cyberark_session }}"
```
This playbook is an example of disabling a user based on the `disabled: true` value with that authentication using the credential set in Tower.
```yaml
- name: Logon to CyberArk Vault using PAS Web Services SDK - Not use_shared_logon_authentication
cyberark_authentication:
api_base_url: "{{ web_services_base_url }}"
username: "{{ password_object.password }}"
password: "{{ password_object.passprops.username }}"
use_shared_logon_authentication: false
- name: Disabling a CyberArk User
cyberark_user:
username: "ansibleuser"
disabled: true
cyberark_session: "{{ cyberark_session }}"
register: cyberarkaction
- name: Logoff from CyberArk Vault
cyberark_authentication:
state: absent
cyberark_session: "{{ cyberark_session }}"
```
|
