Horizon enrollment request plugin
Note
This module is part of the evertrust.horizon collection (version 2.0.0).
It is not included in ansible-core.
To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install evertrust.horizon.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: evertrust.horizon.horizon_request_enroll.
Synopsis
Request an enrollment against the Horizon API.
Note
This module has a corresponding action plugin.
Requirements
The below requirements are needed on the host that executes this module.
cryptography>=3.4.0
Parameters
Parameter |
Comments |
|---|---|
Path of a CA bundle used to validate the Horizon instance SSL certificate. |
|
Path of a client certificate. Required if you use certificate based authentication |
|
Path to the private key used for client-certificate authentication. Required if you use certificate based authentication. Restrict access to the key and inventory configuration files. |
|
Maximum number of seconds to wait for the controller to establish a connection to Horizon. Default: |
|
Certificate’s contact email. Default value will be the requester contact email address. |
|
A certificate signing request, or the path to the CSR file. If none is provided, one will be generated on-the-fly. |
|
The path to a CSR file. |
|
Your Horizon instance base endpoint. It must include the protocol (https://) and no trailing slash nor path. |
|
Key type to use when generating a key pair. If omitted, the default key type from the certificate profile is used. This option is not required when Choices:
|
|
Certificate’s labels. |
|
Certificate metadata as key-value pairs. |
|
Enrollment mode. If empty, will be inferred from the Horizon certificate profile configuration. Choices:
|
|
Certificate’s owner. |
|
Security password for the certificate. Password policies will be applied to check validity. Required only if the enrollment is centralized and the password generation mode is not random. Can also be required if the profile allows both centralized and decentralized enrollment with manual password generation. In that case, a password is necessary for decentralized enrollment. |
|
Name of the profile that will be used to request the enrollment of the certificate. |
|
Maximum number of seconds to wait between response reads by the controller after connecting to Horizon. Default: |
|
Free-text field editable by the requester to provide more context on the request. |
|
Certificate’s subject alternative names (SANs) of the certificate. Authorized values are: [dnsname, rfc822name, ipaddress, othername_upn, othername_guid, uri]. |
|
Certificate’s subject. You can either give the description of the subject, or the full DN. If you give the DN, other values won’t be used. |
|
Certificate’s team. |
|
Horizon identifier Required if you use credentials authentication |
|
Secret API key used for Horizon credential authentication. Required if you use credentials authentication. Store this value with Ansible Vault. Tasks containing lookup expressions with this value should use |
Notes
Note
Requesting certificate enrollment requires permission on the related profile.
Be sure to use the “Enroll API” permission instead of “Enroll”.
Examples
- name: Request centralized certificate enrollment
evertrust.horizon.horizon_request_enroll:
endpoint: "https://<horizon-endpoint>"
x_api_id: "<horizon-id>"
x_api_key: "<horizon-password>"
mode: "centralized"
password: "examplePassword"
key_type: "rsa-2048"
profile: "exampleProfile"
subject:
cn.1: "exampleCN"
sans:
dnsname: "exampleDnsname"
labels:
snow_id: "value1"
exp_tech: "value2"
requester_comment: "I need this certificate to access the VPN."
- name: Request decentralized certificate enrollment with a CSR
evertrust.horizon.horizon_request_enroll:
endpoint: "https://<horizon-endpoint>"
x_api_id: "<horizon-id>"
x_api_key: "<horizon-password>"
mode: "decentralized"
csr: |
-----BEGIN CERTIFICATE REQUEST-----
// Content
-----END CERTIFICATE REQUEST-----
password: "examplePassword"
key_type: "rsa-2048"
profile: "exampleProfile"
subject:
cn.1: "exampleCN"
ou.1: "exampleFirstOU"
ou.2: "exampleSecondOU"
sans:
dnsname:
- "exampleDnsName1"
- "exampleDnsName2"
labels:
snow_id: "value1"
exp_tech: "value2"
requester_comment: "I need this certificate to access the VPN."
- name: Request decentralized certificate enrollment using a CSR file
evertrust.horizon.horizon_request_enroll:
endpoint: "https://<horizon-endpoint>"
x_api_id: "<horizon-id>"
x_api_key: "<horizon-password>"
mode: "decentralized"
csr:
src: "/the/path/to/my/CSR.csr"
password: "examplePassword"
key_type: "rsa-2048"
profile: "exampleProfile"
subject:
cn.1: "exampleCN"
ou:
- "exampleFirstOU"
- "exampleSecondOU"
sans:
dnsname: "exampleDnsName"
labels:
label1: "value1"
label2: "value2"
requester_comment: "I need this certificate to access the VPN."
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
|---|---|
Private key generated locally while creating the certificate signing request. Returned: When the module generates a local key pair |
|
ID of the submitted enrollment request. This value corresponds to Horizon’s internal Returned: On successful request submission |
|
Status of the submitted enrollment request. Returned: On successful request submission |