netapp.ontap.na_ontap_user_role_config module – NetApp ONTAP local user account restrictions

Note

This module is part of the netapp.ontap collection (version 23.6.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install netapp.ontap. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: netapp.ontap.na_ontap_user_role_config.

New in netapp.ontap 23.6.0

Synopsis

  • Modify local user account and password restrictions.

Requirements

The below requirements are needed on the host that executes this module.

  • Ansible 2.9 or later - 2.12 or later is recommended.

  • Python3 - 3.9 or later is recommended.

  • netapp-lib only when using ZAPI (install using ‘pip install netapp-lib’), Please note that netapp-lib is deprecated and no longer maintained. Proceed at your own risk.

  • A physical or virtual clustered Data ONTAP system, the modules support Data ONTAP 9.1 and onward, REST support requires ONTAP 9.6 or later.

Parameters

Parameter

Comments

account_expiry_time

integer

Specifies account expiration in days.

The default setting is -1 (unlimited), which means the accounts never expire.

The account expiry time must be greater than account inactive limit.

Default: -1

account_inactive_limit

integer

Specifies inactive account expiry limit in days.

The default setting is -1 (unlimited), which means the inactive accounts never expire.

Default: -1

account_lockout_duration

string

Specifies the duration in ISO 8601 format (P[<int>D]T[<int>H][<int>M][<int>S]) for which an account is locked if the failed login attempts reach the allowed maximum.

The default is 1 hour.

Default: "PT1H"

cert_filepath

string

added in netapp.ontap 20.6.0

path to SSL client cert file (.pem).

not supported with python 2.6.

change_delay

integer

Specifies the number of days that must pass between password changes. The default setting is 0.

Default: 0

delay_after_failed_login

integer

Specifies the amount of delay observed by the system in seconds upon invalid login attempts.

The default setting is 4 seconds.

Default: 4

disallowed_reuse

integer

Specifies the number of previous passwords that are disallowed for reuse.

The default setting is 6. The minimum allowed value is 6.

Default: 6

feature_flags

dictionary

added in netapp.ontap 20.5.0

Enable or disable a new feature.

This can be used to enable an experimental feature or disable a new feature that breaks backward compatibility.

Supported keys and values are subject to change without notice. Unknown keys are ignored.

force_ontap_version

string

added in netapp.ontap 21.23.0

Override the cluster ONTAP version when using REST.

The behavior is undefined if the version does not match the target cluster.

This is provided as a work-around when the cluster version cannot be read because of permission issues. See https://github.com/ansible-collections/netapp.ontap/wiki/Known-issues.

This should be in the form 9.10 or 9.10.1 with each element being an integer number.

hostname

string / required

The hostname or IP address of the ONTAP instance.

http_port

integer

Override the default port (80 or 443) with this port

https

boolean

Enable and disable https.

Ignored when using REST as only https is supported.

Ignored when using SSL certificate authentication as it requires SSL.

Choices:

  • false ← (default)

  • true

key_filepath

string

added in netapp.ontap 20.6.0

path to SSL client key file.

max_failed_login_attempts

integer

Specifies the allowed maximum number of consecutive invalid login attempts.

When the failed login attempts reach the specified maximum, the account is automatically locked. The default is 5.

Default: 5

passwd_alphanum

boolean

If this parameter is enabled, a password must contain at least one letter and one number.

The default setting is enabled.

Choices:

  • false

  • true ← (default)

passwd_expiry_time

integer

Specifies password expiration in days.

A value of 0 means all passwords associated with the accounts in the role expire now. The default setting is -1 (unlimited), which means the passwords never expire.

Default: -1

passwd_expiry_warn_time

integer

Specifies the warning period for password expiry in days.

A value of 0 means warn user about password expiry upon every successful login.

The default setting is -1 (unlimited), which means never warn about password expiry.

Default: -1

passwd_min_digits

integer

Specifies the minimum number of digits required in a password.

The default setting is 0.

Default: 0

passwd_min_lowercase_chars

integer

Specifies the minimum number of lowercase characters required in a password.

The default setting is 0.

Default: 0

passwd_min_special_chars

integer

Specifies the minimum number of special characters required in a password.

Supported values are from 0 to 127 special characters. The default setting is 0.

Default: 0

passwd_min_uppercase_chars

integer

Specifies the minimum number of uppercase characters required in a password.

The default setting is 0.

Default: 0

passwd_minlength

integer

Specifies the required minimum length of a password.

Supported values are 3 to 127 characters. The default setting is 8 characters.

Default: 8

password

aliases: pass

string

Password for the specified user.

require_initial_passwd_update

boolean

Specifies whether users must change their passwords when logging in for the first time.

The default setting is disabled.

Choices:

  • false ← (default)

  • true

role

string / required

Specifies the role whose account restrictions are to be modified.

state

string

Configure local user account restrictions, only present is supported.

Choices:

  • "present" ← (default)

use_lambda

boolean

added in netapp.ontap 23.4.0

Specifies if AWS Lambda proxy functionality should be used to connect to the ONTAP system.

Supported only with REST.

Choices:

  • false ← (default)

  • true

use_rest

string

This module only supports REST.

always -- will always use the REST API. A warning is issued if the module does not support REST.

Default: "always"

username

aliases: user

string

This can be a Cluster-scoped or SVM-scoped account, depending on whether a Cluster-level or SVM-level API is required.

For more information, please read the documentation https://docs.netapp.com/us-en/ontap/authentication/create-svm-user-accounts-task.html.

Two authentication methods are supported

  1. Basic authentication, using username and password.

  2. SSL certificate authentication, using a ssl client cert file, and optionally a private key file.

To use a certificate, the certificate must have been installed in the ONTAP cluster, and cert authentication must have been enabled.

username_alphanum

boolean

If this parameter is enabled, a user name must contain at least one letter and one number.

The default setting is disabled.

Choices:

  • false ← (default)

  • true

username_minlength

integer

Specifies the required minimum length of the user name.

Supported values are 3 to 32 characters. The default setting is 3 characters.

Default: 3

validate_certs

boolean

If set to no, the SSL certificates will not be validated.

This should only set to False used on personally controlled sites using self-signed certificates.

Choices:

  • false

  • true ← (default)

vserver

string

Specifies the SVM name associated with the profile configuration.

Notes

Note

  • Only supported with REST and requires ONTAP 9.6 or later.

  • The modules prefixed with na_ontap are built to support the ONTAP storage platform.

  • https is enabled by default and recommended. To enable http on the cluster you must run the following commands ‘set -privilege advanced;’ ‘system services web modify -http-enabled true;’

Examples

- name: Modify user account restrictions - minimum size of the password
  netapp.ontap.na_ontap_user_role_config:
    state: present
    role: csahu_role1
    vserver: svm1
    passwd_minlength: 10
    hostname: "{{ netapp_hostname }}"
    username: "{{ netapp_username }}"
    password: "{{ netapp_password }}"
    https: true
    validate_certs: "{{ validate_certs }}"
    use_rest: always

- name: Modify user account restrictions - maximum allowed invalid login attempts
  netapp.ontap.na_ontap_user_role_config:
    state: present
    role: csahu_role1
    vserver: svm1
    max_failed_login_attempts: 3
    hostname: "{{ netapp_hostname }}"
    username: "{{ netapp_username }}"
    password: "{{ netapp_password }}"
    https: true
    validate_certs: "{{ validate_certs }}"
    use_rest: always

Authors

  • NetApp Ansible Team (@carchi8py)