Skip to content

Commit 8ee35a3

Browse files
lowlydbalowlydba
authoredDec 16, 2024··
feat: Add server role module (#293)
* feat: add login_role module * feat: add tests * Update login_role.ps1 * typos * Update login_role.py * Update main.yml * Update login_role.ps1 * Update main.yml * Update login_role.ps1 * chore: update version
·
2.5.0
1 parent 837012b commit 8ee35a3

File tree

10 files changed

+309
-1
lines changed

10 files changed

+309
-1
lines changed
 

‎CHANGELOG.rst

+18
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,24 @@ lowlydba.sqlserver Release Notes
44

55
.. contents:: Topics
66

7+
v2.5.0
8+
======
9+
10+
Release Summary
11+
---------------
12+
13+
New login_role module for managing server role members!
14+
15+
Minor Changes
16+
-------------
17+
18+
- Add new `login_role` module to add/remove server roles for logins (https://github.com/lowlydba/lowlydba.sqlserver/pull/293).
19+
20+
New Modules
21+
-----------
22+
23+
- login_role - Configures a login's server roles.
24+
725
v2.4.0
826
======
927

‎changelogs/changelog.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -544,3 +544,15 @@ releases:
544544
name: user_role
545545
namespace: ''
546546
release_date: '2024-12-15'
547+
2.5.0:
548+
changes:
549+
minor_changes:
550+
- Add new `login_role` module to add/remove server roles for logins (https://github.com/lowlydba/lowlydba.sqlserver/pull/293).
551+
release_summary: New login_role module for managing server role members!
552+
fragments:
553+
- 293-login-role-module.yml
554+
modules:
555+
- description: Configures a login's server roles.
556+
name: login_role
557+
namespace: ''
558+
release_date: '2024-12-15'

‎galaxy.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
namespace: lowlydba
44
name: sqlserver
5-
version: 2.4.0
5+
version: 2.5.0
66
readme: README.md
77
authors:
88
- John McCall (github.com/lowlydba)

‎plugins/modules/login_role.ps1

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
#!powershell
2+
# -*- coding: utf-8 -*-
3+
4+
# (c) 2022, John McCall (@lowlydba)
5+
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
6+
7+
#AnsibleRequires -CSharpUtil Ansible.Basic
8+
#AnsibleRequires -PowerShell ansible_collections.lowlydba.sqlserver.plugins.module_utils._SqlServerUtils
9+
#Requires -Modules @{ ModuleName="dbatools"; ModuleVersion="2.0.0" }
10+
11+
$ErrorActionPreference = "Stop"
12+
13+
$spec = @{
14+
supports_check_mode = $true
15+
options = @{
16+
login = @{type = 'str'; required = $true }
17+
server_role = @{type = 'str'; required = $true }
18+
state = @{type = 'str'; required = $false; default = 'present'; choices = @('present', 'absent') }
19+
}
20+
}
21+
22+
$module = [Ansible.Basic.AnsibleModule]::Create($args, $spec, @(Get-LowlyDbaSqlServerAuthSpec))
23+
$sqlInstance, $sqlCredential = Get-SqlCredential -Module $module
24+
$login = $module.Params.login
25+
$serverRole = $module.Params.server_role
26+
$state = $module.Params.state
27+
$checkMode = $module.CheckMode
28+
29+
$module.Result.changed = $false
30+
31+
$getLoginSplat = @{
32+
SqlInstance = $sqlInstance
33+
SqlCredential = $sqlCredential
34+
Login = $login
35+
EnableException = $true
36+
}
37+
$getRoleSplat = @{
38+
SqlInstance = $sqlInstance
39+
SqlCredential = $sqlCredential
40+
ServerRole = $serverRole
41+
EnableException = $true
42+
}
43+
$getRoleMemberSplat = @{
44+
SqlInstance = $sqlInstance
45+
SqlCredential = $sqlCredential
46+
Login = $login
47+
ServerRole = $serverRole
48+
EnableException = $true
49+
}
50+
51+
$existingLogin = Get-DbaLogin @getLoginSplat
52+
if ($null -eq $existingLogin) {
53+
$module.FailJson("Login [$login] does not exist.")
54+
}
55+
$existingRole = Get-DbaServerRole @getRoleSplat
56+
if ($null -eq $existingRole) {
57+
$module.FailJson("Server role [$serverRole] does not exist.")
58+
}
59+
60+
# Get role member
61+
$existingRoleMember = Get-DbaServerRoleMember @getRoleMemberSplat
62+
63+
if ($state -eq "absent") {
64+
if ($null -ne $existingRoleMember) {
65+
try {
66+
$removeRoleMemberSplat = @{
67+
SqlInstance = $sqlInstance
68+
SqlCredential = $sqlCredential
69+
Login = $login
70+
ServerRole = $serverRole
71+
EnableException = $true
72+
WhatIf = $checkMode
73+
Confirm = $false
74+
}
75+
$output = Remove-DbaServerRoleMember @removeRoleMemberSplat
76+
$module.Result.changed = $true
77+
}
78+
catch {
79+
$module.FailJson("Removing login [$login] from server role [$serverRole] failed: $($_.Exception.Message)", $_)
80+
}
81+
}
82+
}
83+
elseif ($state -eq "present") {
84+
# Add user to role
85+
if ($null -eq $existingRoleMember) {
86+
try {
87+
$addRoleMemberSplat = @{
88+
SqlInstance = $sqlInstance
89+
SqlCredential = $sqlCredential
90+
Login = $login
91+
ServerRole = $serverRole
92+
EnableException = $true
93+
WhatIf = $checkMode
94+
Confirm = $false
95+
}
96+
$output = Add-DbaServerRoleMember @addRoleMemberSplat
97+
$module.Result.changed = $true
98+
}
99+
catch {
100+
$module.FailJson("Adding login [$login] to server role [$serverRole] failed: $($_.Exception.Message)", $_)
101+
}
102+
}
103+
}
104+
try {
105+
if ($null -ne $output) {
106+
$resultData = ConvertTo-SerializableObject -InputObject $output
107+
$module.Result.data = $resultData
108+
}
109+
$module.ExitJson()
110+
}
111+
catch {
112+
$module.FailJson("Failure: $($_.Exception.Message)", $_)
113+
}

‎plugins/modules/login_role.py

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#!/usr/bin/python
2+
# -*- coding: utf-8 -*-
3+
4+
# (c) 2022, John McCall (@lowlydba)
5+
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
6+
7+
DOCUMENTATION = r'''
8+
---
9+
module: login_role
10+
short_description: Configures a login's server roles.
11+
description:
12+
- Adds or removes a login's server role.
13+
version_added: 2.5.0
14+
options:
15+
login:
16+
description:
17+
- Name of the login.
18+
type: str
19+
required: true
20+
server_role:
21+
description:
22+
- The server role for the login to be modified.
23+
type: str
24+
required: true
25+
author: "John McCall (@lowlydba)"
26+
requirements:
27+
- L(dbatools,https://www.powershellgallery.com/packages/dbatools/) PowerShell module
28+
extends_documentation_fragment:
29+
- lowlydba.sqlserver.sql_credentials
30+
- lowlydba.sqlserver.attributes.check_mode
31+
- lowlydba.sqlserver.attributes.platform_all
32+
- lowlydba.sqlserver.state
33+
'''
34+
35+
EXAMPLES = r'''
36+
- name: Add a user to a fixed server role
37+
lowlydba.sqlserver.login_role:
38+
sql_instance: sql-01.myco.io
39+
login: TheIntern
40+
server_role: sysadmin
41+
42+
- name: Remove a user from a fixed server role
43+
lowlydba.sqlserver.login_role:
44+
sql_instance: sql-01.myco.io
45+
login: TheIntern
46+
server_role: sysadmin
47+
state: absent
48+
49+
- name: Add a user to a custom server role
50+
lowlydba.sqlserver.login_role:
51+
sql_instance: sql-01.myco.io
52+
login: TheIntern
53+
server_role: demi-admin
54+
'''
55+
56+
RETURN = r'''
57+
data:
58+
description: Output from the C(Remove-DbaServerRoleMember), (Get-DbaServerRoleMember), or C(Add-DbaServerRoleMember) functions.
59+
returned: success, but not in check_mode.
60+
type: dict
61+
'''

‎tests/integration/targets/login_role/aliases

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
context/target
2+
setup/once/setup_sqlserver

‎tests/integration/targets/login_role/meta/main.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
dependencies:
3+
- setup_sqlserver_test_plugins

‎tests/integration/targets/login_role/tasks/main.yml

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
- name: Var block
3+
vars:
4+
login_name: "PhillipJFryDeuce"
5+
plain_password: "P0pS3cret!23$%"
6+
password_expiration_enabled: false
7+
password_policy_enforced: false
8+
password_must_change: false
9+
enabled: false
10+
default_database: "master"
11+
language: "us_english"
12+
default_schema: "dbo"
13+
database: "master"
14+
server_role: "dbcreator"
15+
module_defaults:
16+
lowlydba.sqlserver.login:
17+
sql_instance: "{{ sqlserver_instance }}"
18+
sql_username: "{{ sqlserver_username }}"
19+
sql_password: "{{ sqlserver_password }}"
20+
default_database: "{{ default_database }}"
21+
login: "{{ login_name }}"
22+
password: "{{ plain_password }}"
23+
password_expiration_enabled: "{{ password_expiration_enabled }}"
24+
password_must_change: "{{ password_must_change }}"
25+
enabled: "{{ enabled }}"
26+
language: "{{ language }}"
27+
state: present
28+
lowlydba.sqlserver.login_role:
29+
sql_instance: "{{ sqlserver_instance }}"
30+
sql_username: "{{ sqlserver_username }}"
31+
sql_password: "{{ sqlserver_password }}"
32+
server_role: "{{ server_role }}"
33+
login: "{{ login_name }}"
34+
state: present
35+
tags: ["sqlserver.user"]
36+
block:
37+
- name: Create login
38+
lowlydba.sqlserver.login:
39+
register: result
40+
- assert:
41+
that:
42+
- result.data != None
43+
44+
- name: Add login to server role
45+
lowlydba.sqlserver.login_role:
46+
register: result
47+
- assert:
48+
that:
49+
- result is changed
50+
51+
- name: Add login to non-existent server role
52+
lowlydba.sqlserver.login_role:
53+
server_role: IMadeThisOneUp
54+
register: error_result
55+
failed_when: error_result.failed
56+
ignore_errors: true
57+
- assert:
58+
that:
59+
- error_result.failed == true
60+
- "'Server role [IMadeThisOneUp] does not exist' in error_result.msg"
61+
62+
- name: Add non-existent login to server role
63+
lowlydba.sqlserver.login_role:
64+
login: NewUserWhoThis
65+
register: error_result
66+
failed_when: error_result.failed
67+
ignore_errors: true
68+
- assert:
69+
that:
70+
- error_result.failed == true
71+
- "'Login [NewUserWhoThis] does not exist' in error_result.msg"
72+
73+
- name: Add Login again to database role
74+
lowlydba.sqlserver.login_role:
75+
register: result
76+
- assert:
77+
that:
78+
- result is not changed
79+
80+
- name: Remove login from server role
81+
lowlydba.sqlserver.login_role:
82+
state: "absent"
83+
register: result
84+
- assert:
85+
that:
86+
- result is changed
87+
88+
always:
89+
- name: Drop login
90+
lowlydba.sqlserver.login:
91+
state: "absent"

‎tests/integration/targets/win_login_role/aliases

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
windows/all
2+
windows/group/2
3+
context/target
4+
setup/once/setup_win_sqlserver
5+
needs/target/login_role

‎tests/integration/targets/win_login_role/meta/main.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
dependencies:
3+
- login_role

0 commit comments

Comments
 (0)
Please sign in to comment.