65 AWX/Tower Automatisierung und Integration von Benutzer- und Rollenverwaltung

- name: Benutzer anlegen
  user:
    name: johndoe
    shell: /bin/bash
    groups: developers
    state: present

- name: SSH-Schlüssel hinzufügen
  authorized_key:
    user: johndoe
    key: "{{ ansible_user_ssh_key }}"

# group_vars/all.yml
system_users:
  - name: johndoe
    groups: [developers, ssh_users]
    ssh_key: "ssh-rsa AAAAB3NzaC1yc2E..."
  - name: janedoe
    groups: [admins, ssh_users]
    ssh_key: "ssh-rsa AAAAB3NzaC1yc2E..."

# Playbook
- name: Benutzer aus Liste erstellen
  user:
    name: "{{ item.name }}"
    groups: "{{ item.groups }}"
  loop: "{{ system_users }}"

pip install ansible-tower-cli
awx config host https://tower.example.com
awx config username admin
awx config password your_password

# Team erstellen
awx teams create --name "DevOps Team" --organization "Default"

# Benutzer hinzufügen
awx users create --username johndoe --email johndoe@example.com \
    --first-name John --last-name Doe

# Benutzer zum Team hinzufügen
awx teams associate --team "DevOps Team" --user johndoe

# Rolle an Team vergeben
awx roles grant --team "DevOps Team" --type admin \
    --target-team "DevOps Team"

# Projekt-spezifische Berechtigung
awx roles grant --team "DevOps Team" --type execute \
    --job-template "Deploy Webserver"

# Wesentliche LDAP-Einstellungen
AUTH_LDAP_SERVER_URI = "ldap://ldap.example.com"
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "ou=users,dc=example,dc=com", 
    ldap.SCOPE_SUBTREE, 
    "(uid=%(user)s)"
)

# Mapping-Beispiel (vereinfacht)
LDAP_GROUP_MAPPINGS:
  "cn=ansible-admins,ou=groups,dc=example,dc=com":
    - organization_admin: ["Default"]
  "cn=devops,ou=groups,dc=example,dc=com":
    - execute: ["Deploy Webserver", "Update Database"]

- name: Neuen Mitarbeiter onboarden
  hosts: localhost
  vars:
    new_user:
      username: "{{ username }}"
      email: "{{ email }}"
      team: "{{ team_name }}"
  tasks:
    - name: Benutzer in Tower anlegen
      shell: |
        awx users create --username {{ new_user.username }} \
          --email {{ new_user.email }}

    - name: Zu Team hinzufügen
      shell: |
        awx teams associate --team "{{ new_user.team }}" \
          --user {{ new_user.username }}

- name: Mitarbeiter offboarden
  hosts: localhost
  tasks:
    - name: Benutzer in Tower deaktivieren
      shell: |
        awx users modify {{ username }} --is-active false

    - name: SSH-Schlüssel von allen Systemen entfernen
      authorized_key:
        user: "{{ username }}"
        state: absent
      delegate_to: "{{ item }}"
      loop: "{{ groups['all'] }}"

- name: Berechtigungsaudit durchführen
  hosts: localhost
  tasks:
    - name: Alle aktiven Benutzer auflisten
      shell: awx users list --is-active true
      register: active_users

    - name: Benutzer ohne Login in letzten 90 Tagen
      shell: |
        awx users list --last-login__lt="{{ (ansible_date_time.epoch | int - 7776000) | 
        strftime('%Y-%m-%d') }}"
      register: inactive_users

- name: Berechtigungsbericht erstellen
  template:
    src: permission_report.j2
    dest: /tmp/permission_report_{{ ansible_date_time.date }}.html
  vars:
    report_data:
      active_users: "{{ active_users.stdout | from_json }}"
      inactive_users: "{{ inactive_users.stdout | from_json }}"

# Python-Beispiel für Tower-API
import requests

def create_team(tower_url, token, team_name, org_id):
    headers = {
        'Authorization': f'Bearer {token}',
        'Content-Type': 'application/json'
    }
    data = {
        'name': team_name,
        'organization': org_id
    }
    response = requests.post(
        f'{tower_url}/api/v2/teams/',
        json=data,
        headers=headers
    )
    return response.json()

# Verbindung testen
awx config

# Debug-Modus aktivieren
awx --verbose teams list