Skip to content

Commit 661deae

Browse files
tvpartytonighttvpartytonight
committed
(FM-8971) WIP-allow deferred function for pwd
1 parent 821b5c5 commit 661deae

File tree

4 files changed

+147
-24
lines changed

4 files changed

+147
-24
lines changed

‎functions/create_role.pp

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
function postgresql::create_role (
2+
$db,
3+
$port,
4+
$psql_user,
5+
$psql_group,
6+
$psql_path,
7+
$connect_settings,
8+
$cwd,
9+
$username,
10+
$password_sql,
11+
$login_sql,
12+
$createrole_sql,
13+
$createdb_sql,
14+
$superuser_sql,
15+
$replication_sql,
16+
$connection_limit
17+
18+
) {
19+
postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
20+
db => $db,
21+
port => $port,
22+
psql_user => $psql_user,
23+
psql_group => $psql_group,
24+
psql_path => $psql_path,
25+
connect_settings => $connect_settings,
26+
cwd => $cwd,
27+
command => Sensitive("CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}"),
28+
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
29+
require => undef,
30+
sensitive => true,
31+
}
32+
}

‎functions/pwd_hash_sql.pp

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
function postgresql::pwd_hash_sql (
2+
$password_hash_unsensitive,
3+
$password_hash,
4+
$update_password,
5+
$username,
6+
$hash,
7+
$salt,
8+
) {
9+
if $password_hash_unsensitive and $update_password {
10+
if($password_hash_unsensitive =~ /^(md5|SCRAM-SHA-256).+/) {
11+
$pwd_hash_sql = $password_hash_unsensitive
12+
} else {
13+
$pwd_hash_sql = postgresql::postgresql_password(
14+
$username,
15+
$password_hash,
16+
$password_hash =~ Sensitive[String],
17+
$hash,
18+
$salt,
19+
)
20+
}
21+
}
22+
}

‎functions/update_psql.pp

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
function postgresql::update_psql (
2+
$db,
3+
$port,
4+
$psql_user,
5+
$psql_group,
6+
$psql_path,
7+
$connect_settings,
8+
$cwd,
9+
$username,
10+
$pwd_hash_sql,
11+
) {
12+
postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****":
13+
db => $db,
14+
port => $port,
15+
psql_user => $psql_user,
16+
psql_group => $psql_group,
17+
psql_path => $psql_path,
18+
connect_settings => $connect_settings,
19+
cwd => $cwd,
20+
require => Postgresql_psql["CREATE ROLE ${username} ENCRYPTED PASSWORD ****"],
21+
command => Sensitive("ALTER ROLE \"${username}\" ENCRYPTED PASSWORD '${pwd_hash_sql}'"),
22+
unless => Sensitive("SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'"),
23+
sensitive => true,
24+
}
25+
}

‎manifests/server/role.pp

Lines changed: 68 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
psql_path => $psql_path,
7575
connect_settings => $connect_settings,
7676
cwd => $module_workdir,
77-
require => Postgresql_psql["CREATE ROLE ${username} ENCRYPTED PASSWORD ****"],
77+
# require => Postgresql_psql["CREATE ROLE ${username} ENCRYPTED PASSWORD ****"],
7878
}
7979

8080
if $ensure == 'present' {
@@ -84,17 +84,47 @@
8484
$createdb_sql = $createdb ? { true => 'CREATEDB', default => 'NOCREATEDB' }
8585
$superuser_sql = $superuser ? { true => 'SUPERUSER', default => 'NOSUPERUSER' }
8686
$replication_sql = $replication ? { true => 'REPLICATION', default => '' }
87-
if ($password_hash_unsensitive != false) {
87+
88+
if (type($password_hash_unsensitive) =~ Type[Deferred]) {
89+
$password_sql = Deferred('new', [String, $password_hash_unsensitive])
90+
} elsif ($password_hash_unsensitive != false) {
8891
$password_sql = "ENCRYPTED PASSWORD '${password_hash_unsensitive}'"
8992
} else {
9093
$password_sql = ''
9194
}
9295

93-
postgresql_psql { "CREATE ROLE ${username} ENCRYPTED PASSWORD ****":
94-
command => Sensitive("CREATE ROLE \"${username}\" ${password_sql} ${login_sql} ${createrole_sql} ${createdb_sql} ${superuser_sql} ${replication_sql} CONNECTION LIMIT ${connection_limit}"),
95-
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}'",
96-
require => undef,
97-
sensitive => true,
96+
if type($password_sql) =~ Type[Deferred] {
97+
Deferred('postgresql::create_role', [$db,
98+
$port_override,
99+
$psql_user,
100+
$psql_group,
101+
$psql_path,
102+
$connect_settings,
103+
$module_workdir,
104+
$username,
105+
$password_sql,
106+
$login_sql,
107+
$createrole_sql,
108+
$createdb_sql,
109+
$superuser_sql,
110+
$replication_sql,
111+
$connection_limit])
112+
} else {
113+
postgresql::create_role($db,
114+
$port_override,
115+
$psql_user,
116+
$psql_group,
117+
$psql_path,
118+
$connect_settings,
119+
$module_workdir,
120+
$username,
121+
$password_sql,
122+
$login_sql,
123+
$createrole_sql,
124+
$createdb_sql,
125+
$superuser_sql,
126+
$replication_sql,
127+
$connection_limit)
98128
}
99129

100130
postgresql_psql { "ALTER ROLE \"${username}\" ${superuser_sql}":
@@ -133,23 +163,37 @@
133163
unless => "SELECT 1 FROM pg_roles WHERE rolname = '${username}' AND rolconnlimit = ${connection_limit}",
134164
}
135165

136-
if $password_hash_unsensitive and $update_password {
137-
if($password_hash_unsensitive =~ /^(md5|SCRAM-SHA-256).+/) {
138-
$pwd_hash_sql = $password_hash_unsensitive
139-
} else {
140-
$pwd_hash_sql = postgresql::postgresql_password(
141-
$username,
142-
$password_hash,
143-
$password_hash =~ Sensitive[String],
144-
$hash,
145-
$salt,
146-
)
147-
}
148-
postgresql_psql { "ALTER ROLE ${username} ENCRYPTED PASSWORD ****":
149-
command => Sensitive("ALTER ROLE \"${username}\" ENCRYPTED PASSWORD '${pwd_hash_sql}'"),
150-
unless => Sensitive("SELECT 1 FROM pg_shadow WHERE usename = '${username}' AND passwd = '${pwd_hash_sql}'"),
151-
sensitive => true,
152-
}
166+
if type($password_hash_unsensitive) =~ Type[Deferred] {
167+
$pwd_hash_sql = Deferred('postgresql::pwd_hash_sql', [$password_hash_unsensitive, $password_hash, $update_password, $username, $hash, $salt])
168+
} else {
169+
$pwd_hash_sql = postgresql::pwd_hash_sql(
170+
$password_hash_unsensitive,
171+
$password_hash,
172+
$update_password,
173+
$username,
174+
$hash,
175+
$salt)
176+
}
177+
if (type($pwd_hash_sql) =~ Type[Deferred]) {
178+
Deferred('postgresql::update_psql', [$db,
179+
$port_override,
180+
$psql_user,
181+
$psql_group,
182+
$psql_path,
183+
$connect_settings,
184+
$module_workdir,
185+
$username,
186+
$pwd_hash_sql])
187+
} elsif $pwd_hash_sql {
188+
postgresql::update_psql($db,
189+
$port_override,
190+
$psql_user,
191+
$psql_group,
192+
$psql_path,
193+
$connect_settings,
194+
$module_workdir,
195+
$username,
196+
$pwd_hash_sql)
153197
}
154198
} else {
155199
# ensure == absent

0 commit comments

Comments
 (0)