mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
37e74ddd63
A user password reaches its application through Ansible, a shell, a container exec -e and finally the runtime's own environment reader. The generator seeded it from the same alphabet as the become password, punctuation included, and that does not survive the chain intact. Three roles had already worked around it by declaring a separate alphanumeric credential for an identity that their meta/users.yml already declares, and saying so in the description. Removing those without fixing the generator would have reintroduced exactly the bug they were built against, so the generator is fixed first and all three now read the user's own password. At length 64 the smaller alphabet costs nothing worth measuring, and the become password keeps the old one because it travels a different path. Zammad additionally used the bot's password for its wizard-bypass admin, one secret for two users. Each has its own declaration and now its own value. A test asserts the generated password is alphanumeric, so a future change to the alphabet fails there rather than inside a Ruby ENV.fetch in a container.
40 lines
1.6 KiB
Django/Jinja
40 lines
1.6 KiB
Django/Jinja
{
|
|
"Token": "{{ ZAMMAD_INITIAL_ADMIN_PASSWORD }}",
|
|
"TextModuleLocale": { "Locale": "{{ HOST_LL_CC_TAG }}" },
|
|
"Users": [
|
|
{
|
|
"login": "{{ ZAMMAD_WIZARD_BYPASS_USER.username }}",
|
|
"firstname": "{{ ZAMMAD_WIZARD_BYPASS_USER.firstname }}",
|
|
"lastname": "{{ ZAMMAD_WIZARD_BYPASS_USER.lastname }}",
|
|
"email": "{{ ZAMMAD_WIZARD_BYPASS_USER.email }}",
|
|
"password": "{{ ZAMMAD_WIZARD_BYPASS_PASSWORD }}"
|
|
}
|
|
],
|
|
"Settings": [
|
|
{ "name": "system_init_done", "value": true },
|
|
{ "name": "fqdn", "value": "{{ ZAMMAD_HOSTNAME }}" },
|
|
{ "name": "http_type", "value": "{{ ZAMMAD_WEB_PROTOCOL }}" },
|
|
{ "name": "organization", "value": "{{ ORGANIZATION }}" },
|
|
{ "name": "product_name", "value": "{{ SOFTWARE_NAME }} Helpdesk" },
|
|
{ "name": "developer_mode", "value": false },
|
|
{ "name": "user_create_account", "value": false },
|
|
{ "name": "user_lost_password", "value": true }
|
|
{% if ZAMMAD_OIDC_ENABLED %}
|
|
,
|
|
{ "name": "auth_openid_connect", "value": true },
|
|
{
|
|
"name": "auth_openid_connect_credentials",
|
|
"value": {
|
|
"display_name": "{{ OIDC.BUTTON_TEXT }}",
|
|
"identifier": "{{ OIDC.CLIENT.ID }}",
|
|
"secret": "{{ OIDC.CLIENT.SECRET }}",
|
|
"issuer": "{{ OIDC.CLIENT.ISSUER_URL }}",
|
|
"scope": "openid email profile",
|
|
"uid_field": "sub",
|
|
"send_scope_to_token_endpoint": true
|
|
}
|
|
}
|
|
{% endif %}
|
|
]
|
|
}
|