nomis: D1568: add support for user creation (#437)

* Add regular user functionality to users-and-groups role

* Add regular users to nomis-dev servers

* whitespace

* Commit changes made by code formatters

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

ansible/group_vars/environment_name_nomis_development.yml

@@ -9,6 +9,10 @@ dns_search_domains:
   - azure.noms.root
 PROD_SYSCON_WEB_RELEASE: DB_V11.2.1.1.219
 
+users_and_groups_regular:
+  - group: studio-webops
+  - group: syscon-nomis
+
 weblogic_additional_form_servers: []
 db_configs:
   qa11r:

ansible/roles/users-and-groups/README.md

@@ -10,12 +10,8 @@ Define mapping between user to uid, and group to gid, in `vars/`. For example:
 - [default-system-gids.yml](/ansible/roles/users-and-groups/vars/default-system-gids.yml)
 - [default-system-uids.yml](/ansible/roles/users-and-groups/vars/default-system-uids.yml)
 
-A custom mapping can be created if necessary.  For example, create
-`vars/myapp-system-gids.yml` and `vars/myapp-system-uids.yml` and set
-
-```
-users_and_groups_system_vars_prefix: myapp
-```
+A custom mapping can be created if necessary for a given business unit or application.  For example, create
+`vars/hmpps-system-gids.yml` and `vars/hmpps-system-uids.yml` and set
 
 ### Adding users and groups
 
@@ -55,6 +51,25 @@ Option 2. Import from another role
           - wheel
 ```
 
-## Non-System Users
+## Regular Users
+
+Users should add their ssh public keys to the relevant business unit vars file, e.g.
+Also assign a unique UID for consistency across servers. Suggest the username is set
+to the user's GitHub id.
+
+- [hmpps-regular-users.yml](/ansible/roles/users-and-groups/vars/hmpps-regular-users.yml)
+
+Define group details such as group membership in relevant business unit vars file, e.g.
 
-Not implemented yet.
+- [hmpps-regular-groups.yml](/ansible/roles/users-and-groups/vars/hmpps-regular-groups.yml)
+
+Suggest the group names follow GitHub group ids.
+
+Finally, define which users and groups to add by defining a variable in the relevant
+server-type or environment_name group vars, e.g.
+
+```
+users_and_groups_regular:
+  - group: studio-webops
+  - group: syscon-nomis
+```

ansible/roles/users-and-groups/defaults/main.yml

@@ -1,10 +1,31 @@
 ---
-# Define which users to create using this variable.  Groups are automatically
-# created if they are referenced by a user. For example:
+# Define which system users to create using this variable.  Groups are
+# automatically created if they are referenced by a user. For example:
 # users_and_groups_system:
 # - { name: oracle, group: oinstall }
 # - { group: mygroup }  # if just a group required
 users_and_groups_system: []
 
-# override this to load a different uid/gid vars file
-users_and_groups_system_vars_prefix: "default"
+# Define which regular users to create using this variable.  Although you can
+# specify individual users in the same way as `users_and_groups_system`, it
+# is recommended just to specify group and all group members will be added.
+# users_and_groups_regular:
+# - group: studio-webops
+users_and_groups_regular: []
+
+# Override these in vars/
+system_uids: {} # username -> uid
+system_gids: {} # group -> gid
+regular_uids: {} # username -> uid
+regular_gids: {} # group -> gid
+regular_users_authorized_keys: {} # username -> key (multi-line string)
+regular_groups_additional_groups: {} # username -> groups
+regular_groups_members: {} # group -> list of usernames
+
+# Define which files to read in from /vars
+users_and_groups_system_vars_prefixes:
+  - "default"
+  - "{{ ec2.tags['business-unit'] | lower }}"
+users_and_groups_regular_vars_prefixes:
+  - "default"
+  - "{{ ec2.tags['business-unit'] | lower }}"

ansible/roles/users-and-groups/meta/main.yml

@@ -0,0 +1,3 @@
+---
+dependencies:
+  - role: get-ec2-facts

ansible/roles/users-and-groups/tasks/add-regular.yml

@@ -0,0 +1,87 @@
+---
+# Note these tasks can also be used elsewhere via import_role
+
+- name: Include uid and gid vars
+  ansible.builtin.include_vars:
+    dir: vars
+    files_matching: "{{ item }}-regular-.*.yml$"
+  loop: "{{ users_and_groups_regular_vars_prefixes }}"
+
+- name: Calculate list of groups
+  ansible.builtin.set_fact:
+    regular_groups_1: "{{ users_and_groups_regular | map(attribute='group') }}"
+    regular_groups_2: "{{ users_and_groups_regular | selectattr('groups', 'defined') | map(attribute='groups') | flatten }}"
+
+- name: Add regular groups
+  ansible.builtin.group:
+    name: "{{ item }}"
+    state: present
+    system: no
+    gid: "{{ regular_gids[item]|default(omit) }}"
+  loop: "{{ (regular_groups_1 + regular_groups_2) | unique }}"
+
+- name: Calculate groups where we will add all members
+  ansible.builtin.set_fact:
+    regular_groups_for_adding_users: "{{ users_and_groups_regular | rejectattr('name', 'defined') | selectattr('group', 'defined') | map(attribute='group') }}"
+    users_regular: []
+
+- name: Add group members to user list fact
+  ansible.builtin.set_fact:
+    users_regular: "{{ users_regular + [{
+      'name': item.name,
+      'group': item.group,
+      'groups': item.groups|default([]) + regular_groups_additional_groups[item.group]|default([]),
+      'uid': item.uid | default(regular_uids[item.name]|default(omit)),
+      'create_home': item.create_home | default(true),
+      'home': item.home | default('/home/' + item.name),
+      'state': item.state | default('present'),
+      'authorized_keys': item.authorized_keys | default(regular_users_authorized_keys[item.name]|default(omit))
+      }] }}"
+  vars:
+    item:
+      group: "{{ loop_item[0].key }}"
+      name: "{{ loop_item[1] }}"
+  when: item.group in regular_groups_for_adding_users
+  loop_control:
+    loop_var: loop_item
+    label: "{{ item.name }}:{{ item.group }}"
+  loop: "{{ regular_groups_members | dict2items | subelements('value') }}"
+
+- name: Add regular users to user list fact
+  set_fact:
+    users_regular: "{{ users_regular + [{
+      'name': item.name,
+      'group': item.group,
+      'groups': item.groups|default([]) + regular_groups_additional_groups[item.group]|default([]),
+      'uid': item.uid | default(regular_uids[item.name]|default(omit)),
+      'create_home': item.create_home | default(true),
+      'home': item.home | default('/home/' + item.name),
+      'state': item.state | default('present'),
+      'authorized_keys': item.authorized_keys | default(regular_users_authorized_keys[item.name]|default(omit))
+      }] }}"
+  loop_control:
+    label: "{{ item.name }}"
+  loop: "{{ users_and_groups_regular | selectattr('name', 'defined') }}"
+
+- name: Update regular users
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    group: "{{ item.group }}"
+    groups: "{{ item.groups }}"
+    uid: "{{ item.uid|default(omit) }}"
+    create_home: "{{ item.create_home }}"
+    home: "{{ item.home }}"
+    state: "{{ item.state }}"
+    system: no
+  loop_control:
+    label: "{{ item.name }}:{{ item.group }}"
+  loop: "{{ users_regular }}"
+
+- name: Update authorized keys
+  ansible.posix.authorized_key:
+    user: "{{ item.name }}"
+    key: "{{ item.authorized_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
+  loop: "{{ users_regular | rejectattr('state', 'equalto', 'absent') | selectattr('authorized_keys', 'defined') }}"
+  when: not ansible_check_mode

ansible/roles/users-and-groups/tasks/add-system.yml

@@ -4,7 +4,8 @@
 - name: Include uid and gid vars
   ansible.builtin.include_vars:
     dir: vars
-    files_matching: "{{ users_and_groups_system_vars_prefix }}-system-.*.yml$"
+    files_matching: "{{ item }}-system-.*.yml$"
+  loop: "{{ users_and_groups_system_vars_prefixes }}"
 
 - name: Calculate list of groups
   ansible.builtin.set_fact:
@@ -16,15 +17,15 @@
     name: "{{ item }}"
     state: present
     system: yes
-    gid: "{{ system_gids[item] }}"
-  loop: "{{ (system_groups_1 + system_groups_2) | unique | intersect(system_gids.keys()) }}"
+    gid: "{{ system_gids[item]|default(omit) }}"
+  loop: "{{ (system_groups_1 + system_groups_2) | unique }}"
 
 - name: Add system users
   ansible.builtin.user:
     name: "{{ item.name }}"
     group: "{{ item.group }}"
     groups: "{{ item.groups | default([]) }}"
-    uid: "{{ item.uid | default(system_uids[item.name]) }}"
+    uid: "{{ item.uid | default(system_uids[item.name]|default(omit)) }}"
     create_home: "{{ item.create_home | default(true) }}"
     home: "{{ item.home | default('/home/' + item.name) }}"
     system: yes

ansible/roles/users-and-groups/tasks/main.yml

@@ -4,3 +4,11 @@
     - amibuild
     - ec2provision
     - ec2patch
+    - users-and-groups-system
+
+- import_tasks: add-regular.yml
+  tags:
+    - amibuild
+    - ec2provision
+    - ec2patch
+    - users-and-groups-regular

ansible/roles/users-and-groups/vars/hmpps-regular-groups.yml

@@ -0,0 +1,22 @@
+# define all non-system groups in use in hmpps accounts here
+
+# define gid if you want consistency across servers
+regular_gids:
+  studio-webops: 2001
+  syscon-nomis: 2051
+
+# define any additional groups that team members should be added to
+regular_groups_additional_groups:
+  studio-webops:
+    - wheel
+  syscon-nomis:
+    - wheel
+
+# define members of each group
+regular_groups_members:
+  studio-webops:
+    - drobinson-moj
+    - Sandhya1874
+    - KarenMoss1510
+  syscon-nomis:
+    - vinnydigital

ansible/roles/users-and-groups/vars/hmpps-regular-users.yml

@@ -0,0 +1,21 @@
+# Define UID/ssh keys for hmpps non-system users
+# NOTE: please do not commit email addresssed in authorized keys
+
+# define a UID if you want consistency across servers
+regular_uids:
+  drobinson-moj: 2001
+  Sandhya1874: 2002
+  KarenMoss1510: 2003
+  vinnydigital: 2051
+
+# please do not commit email addresses
+regular_users_authorized_keys:
+  drobinson-moj: |
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMmybIRrtx8sU+/7+d9s7RppiZv+UTgszC9Ed7NqOMYBI5D6lD32AJQmDgDvHWZtmt1PCq5SLkkrz8wVqKkKewTtsf7AZ8Nb8B2NBcKNvKeASgljE/cLpPm/zoRndID9qEsSfmZVYsp+C7QrS9O0PIUUDgnhZyN73LsAzRH3G2GSvoT4wvrHcftiMP6Cg9/Nc+JZZQ1SW8CTIOlvxSN3C0Rxw++WUIbwD2Hur9utMqHQvViR8GfAf7Du2YPwwgUEWYP7exC4e5YMyQbxEjVeKM/gF7KNygEeev4kpl0KMQw1vMF6IsXr6ffZygypIB/E7duCUnb50wwp3BdpLfEXthiul1+0z7OFnbCNejiC5GNShLV2UzwLCyVabQUTFbQnoHlSGHbtC6CCTYZei/l20djd1PDDhBCIViveZBM3vyv+APkEZwyE7/idy0wS4190dwpTJwVr6AmxgN9SBbv5BpXhlWZu628bo8tI9JoeXHistanfSi6xLmzRCLuRJeknE=
+  Sandhya1874: |
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5pf/PHML6OILGUS2BHuiE2sZwBFPMGC6A2Q3C3YKg+aIXK0ZqEdydQOmgnUFd/s639stoOo0iDfEyoqMVXjYvw17sEI0QTG6U0xOwoBlB4kOOmODVvhxqzSxL4YsUJFNLLkZa/zMym5keLj2+Aq8GYy0sw+4IFEC7OJwrHUW7ov/QZGJcVUs6S6A+2P2mdDVex2iGePR8Yzk0tf0ZP/ObGuEV+GSpBs5j0QtvYgwkBmYyzLfPPH/flkcCnUXIu8R07i0Es10GPO6s9XbdH31L9hMfiHNMcOtB2+mRMROkLzuIng5Pscvk7glutfxcZco9Bb2DO2DyTaPwAt8MDIBLVi5SYvWIeyhQXEBoOdUAiC57vas2eOsyfj6ETFNM+XMAcxt92drIJCp/SRloP1669EgRwbN0uWFtLGrKyLxOEJLm2E2o2K25WmwXzWZjlEUq2Hi31GenIEgYkzPOiTjZzh91PLcZwi3Iiej3FGQh38qcA5xd7ITbWv4RW8qaWaktaqDb4JlDgbDUHANFdyF/zhJAbBFNABy5L5plhPeGRmYYS1Yk1iIcg1DyqaZZQulsXYdpxqGiDtyn7mUjp3dx2AmX46ZbGWID1zRHAIjtPwq2VflH6a1ozwrQxJNZj50swxg1899r6p4cClgI5mtb6uTOYzcJKvoxPJdmGJ6hjQ==
+  KarenMoss1510: |
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDuy419UHR9kn5bsumNjC+vNzMvKjwZFE8KU6y0x5JguSBB4Vj4uM+gqNsVpdGRcV0EX9jCEZ7gVSIYyomOZazAMyguzj/tjxysMlSajlZ49+EXK0JLE6wcmF9W0vZ7SqR7T4afMOVOm78ixjZTGfkMuGXaue6QhfmP5HZXpkH8Y8KiYz/rj9ZHm1BMZv5101BWxHNLs70O7KG2e0AbcnsrEPmWr57tU7GCwBJUjaQZhpBKBe0fRWIZDQHsJ6t1Aia+KPN1uml+loIRl0Q7Onozk2JZn/G8N+FWOotxXHlb7Wbli1yZTcbCYD3jGqrrRdqIEIVJ8WpjGMh/aRe0GmTU4fwHuHadH7FjNMMAhnSxh0vuu/L29cq5YSCKnLpuBWQIYG+ousW9/cYuekfvaO5K4Uew1MupeAZOddRs7KQK+FgzByYIxH7aQRr8cICw+7oC2a54PRVyzGDL2nTIntLwXL0IQEsE/gbnFx1AwWov6i4z8yU1cLIQdz4vg/xlYHVj8bn0RgIPL8/S12MiSlo4NwcU4alrTYitPB6sGcHD3TrfG6mWGNS1mGoWfpLcnvS9wVH/6BYfqrPUeAGj5RIcfvRMEsVPE18dvyREzUnXOhKhHYf5O9oiW/HxerIJCGLIAhsPHVGe7YjAkZFbdNAyHskaiX/M2mF7FIVWTrTaXQ==
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID3gmEWJ3ar9iOmHWGdx9BXJB10ZksaKG3FRdr8qBVx9
+  vinnydigital: |
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQFZK3svaYe8YTRx7B2pxYag/HZ1Zafbfqr0I7hbIbd