text: #!/usr/bin/python
  # -*- coding: UTF-8 -*-
  
  # Copyright (c) 2016, Adfinis SyGroup AG
  # Tobias Rueetschi <tobias.ruetschi@adfinis-sygroup.ch>
  #
  # This file is part of Ansible
  #
  # Ansible is free software: you can redistribute it and/or modify
  # it under the terms of the GNU General Public License as published by
  # the Free Software Foundation, either version 3 of the License, or
  # (at your option) any later version.
  #
  # Ansible is distributed in the hope that it will be useful,
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  # GNU General Public License for more details.
  #
  # You should have received a copy of the GNU General Public License
  # along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
  #
  
  
  from datetime import date
  import crypt
  from ansible.module_utils.basic import AnsibleModule
  from ansible.module_utils.univention_umc import (
      umc_module_for_add,
      umc_module_for_edit,
      ldap_search,
      base_dn,
  )
  from dateutil.relativedelta import relativedelta
  
  
  DOCUMENTATION = '''
  ---
  module: udm_user
  version_added: "2.2"
  author: "Tobias Rueetschi (@2-B)"
  short_description: Manage posix users on a univention corporate server
  description:
      - "This module allows to manage posix users on a univention corporate
         server (UCS).
         It uses the python API of the UCS to create a new object or edit it."
  requirements:
      - Python >= 2.6
  options:
      state:
          required: false
          default: "present"
          choices: [ present, absent ]
          description:
              - Whether the user is present or not.
      username:
          required: true
          description:
              - User name
          aliases: ['name']
      firstname:
          required: false
          description:
              - First name. Required if C(state=present).
      lastname:
          required: false
          description:
              - Last name. Required if C(state=present).
      password:
          required: false
          default: None
          description:
              - Password. Required if C(state=present).
      birthday:
          required: false
          default: None
          description:
              - Birthday
      city:
          required: false
          default: None
          description:
              - City of users business address.
      country:
          required: false
          default: None
          description:
              - Country of users business address.
      department_number:
          required: false
          default: None
          description:
              - Department number of users business address.
          aliases: [ departmentNumber ]
      description:
          required: false
          default: None
          description:
              - Description (not gecos)
      display_name:
          required: false
          default: None
          description:
              - Display name (not gecos)
          aliases: [ displayName ]
      email:
          required: false
          default: ['']
          description:
              - A list of e-mail addresses.
      employee_number:
          required: false
          default: None
          description:
              - Employee number
          aliases: [ employeeNumber ]
      employee_type:
          required: false
          default: None
          description:
              - Employee type
          aliases: [ employeeType ]
      gecos:
          required: false
          default: None
          description:
              - GECOS
      groups:
          required: false
          default: []
          description:
              - "POSIX groups, the LDAP DNs of the groups will be found with the
                 LDAP filter for each group as $GROUP:
                 C((&(objectClass=posixGroup)(cn=$GROUP)))."
      home_share:
          required: false
          default: None
          description:
              - "Home NFS share. Must be a LDAP DN, e.g.
                 C(cn=home,cn=shares,ou=school,dc=example,dc=com)."
          aliases: [ homeShare ]
      home_share_path:
          required: false
          default: None
          description:
              - Path to home NFS share, inside the homeShare.
          aliases: [ homeSharePath ]
      home_telephone_number:
          required: false
          default: []
          description:
              - List of private telephone numbers.
          aliases: [ homeTelephoneNumber ]
      homedrive:
          required: false
          default: None
          description:
              - Windows home drive, e.g. C("H:").
      mail_alternative_address:
          required: false
          default: []
          description:
              - List of alternative e-mail addresses.
          aliases: [ mailAlternativeAddress ]
      mail_home_server:
          required: false
          default: None
          description:
              - FQDN of mail server
          aliases: [ mailHomeServer ]
      mail_primary_address:
          required: false
          default: None
          description:
              - Primary e-mail address
          aliases: [ mailPrimaryAddress ]
      mobile_telephone_number:
          required: false
          default: []
          description:
              - Mobile phone number
          aliases: [ mobileTelephoneNumber ]
      organisation:
          required: false
          default: None
          description:
              - Organisation
      override_pw_history:
          required: false
          default: False
          description:
              - Override password history
          aliases: [ overridePWHistory ]
      override_pw_length:
          required: false
          default: False
          description:
              - Override password check
          aliases: [ overridePWLength ]
      pager_telephonenumber:
          required: false
          default: []
          description:
              - List of pager telephone numbers.
          aliases: [ pagerTelephonenumber ]
      phone:
          required: false
          default: []
          description:
              - List of telephone numbers.
      postcode:
          required: false
          default: None
          description:
              - Postal code of users business address.
      primary_group:
          required: false
          default: cn=Domain Users,cn=groups,$LDAP_BASE_DN
          description:
              - Primary group. This must be the group LDAP DN.
          aliases: [ primaryGroup ]
      profilepath:
          required: false
          default: None
          description:
              - Windows profile directory
      pwd_change_next_login:
          required: false
          default: None
          choices: [ '0', '1' ]
          description:
              - Change password on next login.
          aliases: [ pwdChangeNextLogin ]
      room_number:
          required: false
          default: None
          description:
              - Room number of users business address.
          aliases: [ roomNumber ]
      samba_privileges:
          required: false
          default: []
          description:
              - "Samba privilege, like allow printer administration, do domain
                 join."
          aliases: [ sambaPrivileges ]
      samba_user_workstations:
          required: false
          default: []
          description:
              - Allow the authentication only on this Microsoft Windows host.
          aliases: [ sambaUserWorkstations ]
      sambahome:
          required: false
          default: None
          description:
              - Windows home path, e.g. C('\\\\$FQDN\\$USERNAME').
      scriptpath:
          required: false
          default: None
          description:
              - Windows logon script.
      secretary:
          required: false
          default: []
          description:
              - A list of superiors as LDAP DNs.
      serviceprovider:
          required: false
          default: ['']
          description:
              - Enable user for the following service providers.
      shell:
          required: false
          default: '/bin/bash'
          description:
              - Login shell
      street:
          required: false
          default: None
          description:
              - Street of users business address.
      title:
          required: false
          default: None
          description:
              - Title, e.g. C(Prof.).
      unixhome:
          required: false
          default: '/home/$USERNAME'
          description:
              - Unix home directory
      userexpiry:
          required: false
          default: Today + 1 year
          description:
              - Account expiry date, e.g. C(1999-12-31).
      position:
          required: false
          default: ''
          description:
              - "Define the whole position of users object inside the LDAP tree,
                 e.g. C(cn=employee,cn=users,ou=school,dc=example,dc=com)."
      ou:
          required: false
          default: ''
          description:
              - "Organizational Unit inside the LDAP Base DN, e.g. C(school) for
                 LDAP OU C(ou=school,dc=example,dc=com)."
      subpath:
          required: false
          default: 'cn=users'
          description:
              - "LDAP subpath inside the organizational unit, e.g.
                 C(cn=teachers,cn=users) for LDAP container
                 C(cn=teachers,cn=users,dc=example,dc=com)."
  '''
  
  
  EXAMPLES = '''
  # Create a user on a UCS
  - udm_user: name=FooBar
              password=secure_password
              firstname=Foo
              lastname=Bar
  
  # Create a user with the DN
  # C(uid=foo,cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com)
  - udm_user: name=foo
              password=secure_password
              firstname=Foo
              lastname=Bar
              ou=school
              subpath='cn=teachers,cn=users'
  # or define the position
  - udm_user: name=foo
              password=secure_password
              firstname=Foo
              lastname=Bar
              position='cn=teachers,cn=users,ou=school,dc=school,dc=example,dc=com'
  '''
  
  
  RETURN = '''# '''
  
  
  def main():
      expiry = date.strftime(date.today() + relativedelta(years=1), "%Y-%m-%d")
      module = AnsibleModule(
          argument_spec = dict(
              birthday                = dict(default=None,
                                             type='str'),
              city                    = dict(default=None,
                                             type='str'),
              country                 = dict(default=None,
                                             type='str'),
              department_number       = dict(default=None,
                                             type='str',
                                             aliases=['departmentNumber']),
              description             = dict(default=None,
                                             type='str'),
              display_name            = dict(default=None,
                                             type='str',
                                             aliases=['displayName']),
              email                   = dict(default=[''],
                                             type='list'),
              employee_number         = dict(default=None,
                                             type='str',
                                             aliases=['employeeNumber']),
              employee_type           = dict(default=None,
                                             type='str',
                                             aliases=['employeeType']),
              firstname               = dict(default=None,
                                             type='str'),
              gecos                   = dict(default=None,
                                             type='str'),
              groups                  = dict(default=[],
                                             type='list'),
              home_share              = dict(default=None,
                                             type='str',
                                             aliases=['homeShare']),
              home_share_path         = dict(default=None,
                                             type='str',
                                             aliases=['homeSharePath']),
              home_telephone_number   = dict(default=[],
                                             type='list',
                                             aliases=['homeTelephoneNumber']),
              homedrive               = dict(default=None,
                                             type='str'),
              lastname                = dict(default=None,
                                             type='str'),
              mail_alternative_address= dict(default=[],
                                             type='list',
                                             aliases=['mailAlternativeAddress']),
              mail_home_server        = dict(default=None,
                                             type='str',
                                             aliases=['mailHomeServer']),
              mail_primary_address    = dict(default=None,
                                             type='str',
                                             aliases=['mailPrimaryAddress']),
              mobile_telephone_number = dict(default=[],
                                             type='list',
                                             aliases=['mobileTelephoneNumber']),
              organisation            = dict(default=None,
                                             type='str'),
              overridePWHistory       = dict(default=False,
                                             type='bool',
                                             aliases=['override_pw_history']),
              overridePWLength        = dict(default=False,
                                             type='bool',
                                             aliases=['override_pw_length']),
              pager_telephonenumber   = dict(default=[],
                                             type='list',
                                             aliases=['pagerTelephonenumber']),
              password                = dict(default=None,
                                             type='str',
                                             no_log=True),
              phone                   = dict(default=[],
                                             type='list'),
              postcode                = dict(default=None,
                                             type='str'),
              primary_group           = dict(default=None,
                                             type='str',
                                             aliases=['primaryGroup']),
              profilepath             = dict(default=None,
                                             type='str'),
              pwd_change_next_login   = dict(default=None,
                                             type='str',
                                             choices=['0', '1'],
                                             aliases=['pwdChangeNextLogin']),
              room_number             = dict(default=None,
                                             type='str',
                                             aliases=['roomNumber']),
              samba_privileges        = dict(default=[],
                                             type='list',
                                             aliases=['sambaPrivileges']),
              samba_user_workstations = dict(default=[],
                                             type='list',
                                             aliases=['sambaUserWorkstations']),
              sambahome               = dict(default=None,
                                             type='str'),
              scriptpath              = dict(default=None,
                                             type='str'),
              secretary               = dict(default=[],
                                             type='list'),
              serviceprovider         = dict(default=[''],
                                             type='list'),
              shell                   = dict(default='/bin/bash',
                                             type='str'),
              street                  = dict(default=None,
                                             type='str'),
              title                   = dict(default=None,
                                             type='str'),
              unixhome                = dict(default=None,
                                             type='str'),
              userexpiry              = dict(default=expiry,
                                             type='str'),
              username                = dict(required=True,
                                             aliases=['name'],
                                             type='str'),
              position                = dict(default='',
                                             type='str'),
              ou                      = dict(default='',
                                             type='str'),
              subpath                 = dict(default='cn=users',
                                             type='str'),
              state                   = dict(default='present',
                                             choices=['present', 'absent'],
                                             type='str')
          ),
          supports_check_mode=True,
          required_if = ([
              ('state', 'present', ['firstname', 'lastname', 'password'])
          ])
      )
      username    = module.params['username']
      position    = module.params['position']
      ou          = module.params['ou']
      subpath     = module.params['subpath']
      state       = module.params['state']
      changed     = False
  
      users = list(ldap_search(
          '(&(objectClass=posixAccount)(uid={}))'.format(username),
          attr=['uid']
      ))
      if position != '':
          container = position
      else:
          if ou != '':
              ou = 'ou={},'.format(ou)
          if subpath != '':
              subpath = '{},'.format(subpath)
          container = '{}{}{}'.format(subpath, ou, base_dn())
      user_dn = 'uid={},{}'.format(username, container)
  
      exists = bool(len(users))
  
      if state == 'present':
          try:
              if not exists:
                  obj = umc_module_for_add('users/user', container)
              else:
                  obj = umc_module_for_edit('users/user', user_dn)
  
              if module.params['displayName'] is None:
                  module.params['displayName'] = '{} {}'.format(
                      module.params['firstname'],
                      module.params['lastname']
                  )
              if module.params['unixhome'] is None:
                  module.params['unixhome'] = '/home/{}'.format(
                      module.params['username']
                  )
              for k in obj.keys():
                  if (k != 'password' and
                          k != 'groups' and
                          k != 'overridePWHistory' and
                          k in module.params and
                          module.params[k] is not None):
                      obj[k] = module.params[k]
              # handle some special values
              obj['e-mail'] = module.params['email']
              password = module.params['password']
              if obj['password'] is None:
                  obj['password'] = password
              else:
                  old_password = obj['password'].split('}', 2)[1]
                  if crypt.crypt(password, old_password) != old_password:
                      obj['overridePWHistory'] = module.params['overridePWHistory']
                      obj['overridePWLength']  = module.params['overridePWLength']
                      obj['password'] = password
  
              diff = obj.diff()
              if exists:
                  for k in obj.keys():
                      if obj.hasChanged(k):
                          changed = True
              else:
                  changed = True
              if not module.check_mode:
                  if not exists:
                      obj.create()
                  elif changed:
                      obj.modify()
          except:
              module.fail_json(
                  msg="Creating/editing user {} in {} failed".format(
                      username,
                      container
                  )
              )
          try:
              groups = module.params['groups']
              if groups:
                  filter = '(&(objectClass=posixGroup)(|(cn={})))'.format(
                      ')(cn='.join(groups)
                  )
                  group_dns = list(ldap_search(filter, attr=['dn']))
                  for dn in group_dns:
                      grp = umc_module_for_edit('groups/group', dn[0])
                      if user_dn not in grp['users']:
                          grp['users'].append(user_dn)
                          if not module.check_mode:
                              grp.modify()
                          changed = True
          except:
              module.fail_json(
                  msg="Adding groups to user {} failed".format(username)
              )
  
      if state == 'absent' and exists:
          try:
              obj = umc_module_for_edit('users/user', user_dn)
              if not module.check_mode:
                  obj.remove()
              changed = True
          except:
              module.fail_json(
                  msg="Removing user {} failed".format(username)
              )
  
      module.exit_json(
          changed=changed,
          username=username,
          diff=diff,
          container=container
      )
  
  
  if __name__ == '__main__':
      main()
  