Hi,
sure. As it’s always been for 3 years:
[remote "origin"]
url = ssh://git@git.xxxx.net/xxxxx/xxx-xxx.git
fetch = +refs/heads/*:refs/remotes/origin/*
These users that are used in our ansible projects are created like this via a customer lib (and have always worked, but only use ssh):
#!/usr/bin/python
# Only works with the root user currently
import string
import random
from socket import getfqdn
from gitlab import Gitlab
from gitlab import DEVELOPER_ACCESS
from gitlab.exceptions import GitlabCreateError
def get_user_id():
for user in gl.users.list(search=getfqdn()):
if getfqdn().split('.')[0] == user.username:
return user.id
if not found:
module.fail_json(msg='User cannot be found' + user_id)
def deploy_key():
user_id = get_user_id()
try:
with open(module.params['deploy_key'], 'rb') as keyfile:
keycontents = keyfile.read()
for key in gl.users.get(user_id).keys.list():
if key.key.rstrip() == keycontents.rstrip():
module.exit_json(changed=False, msg='Key exists')
gl.users.get(user_id).keys.create({
'title': getfqdn() + ' root key',
'key': keycontents
},
user_id=user_id)
module.exit_json(changed=True, msg='Key added')
except EnvironmentError:
module.fail_json(msg='Could not open key file')
except GitlabCreateError as e:
if 'has already been taken' in e.response_body:
module.exit_json(changed=False, msg='Key Exists')
else:
raise e
def create_user():
if len(gl.users.list(search=getfqdn() + ' root')) == 0:
user = gl.users.create({
'email': 'root@' + getfqdn(),
'password': ''.join(random.choice(string.ascii_uppercase) for i in range(60)),
'username': getfqdn().split('.')[0],
'name': getfqdn() + ' root'
})
user.save()
module.exit_json(changed=True, msg='User successfully created')
else:
module.exit_json(changed=False, msg='User already exists')
def add_to_project():
user_id = get_user_id()
# check project exists
try:
project = gl.projects.get(module.params['project'])
except:
module.fail_json(msg='Could not find project')
# check if already a member of the project
for user in project.members.list():
if user.id == user_id:
module.exit_json(changed=False, msg='already member of the project')
# add to project
if project.members.create({ 'user_id': user_id, 'access_level': DEVELOPER_ACCESS }, project_id=project.id):
module.exit_json(changed=True, msg='Successfully added to the project')
else:
module.fail_json(msg='Unable to add to project')
def main():
global module, gl
module = AnsibleModule(
argument_spec = dict(
operation = dict(required=True, choices=['deploy_key', 'create_user', 'add_to_project']), # Operation
project = dict(required=False), # Project name, only relevant if add_to_project is selected
deploy_key = dict(required=False, default='/root/.ssh/id_rsa.pub'), # path to deploy key, example /root/.ssh/id_rsa.pub, only relevant if 'deploy_user' is selected
token = dict(required=True), # API Key
host = dict(required=True), # GitLab hostname
verify_ssl = dict(required=False, default=False, choices=[True, False]),
)
)
gl = Gitlab(module.params['host'], module.params['token'], api_version=4)
if module.params['operation'] == 'deploy_key':
deploy_key()
elif module.params['operation'] == 'create_user':
create_user()
elif module.params['operation'] == 'add_to_project':
add_to_project()
from ansible.module_utils.basic import *
main()
So nothing to do with LDAP and this user has worked for for the past few users. It is every user created this way that has recently broken and gets this “Your account has been blocked” message. No expired keys as if you see further up as ssh is authing correctly. I note a password is created, so I could test via HTTPS.
Thanks,
Gavin.
