Horizon template plugin

Note

This module is part of the evertrust.horizon collection (version 2.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install evertrust.horizon.

To use it in a playbook, specify: evertrust.horizon.horizon_template.

Synopsis

  • Performs a get template request against the Horizon API.

Note

This module has a corresponding action plugin.

Parameters

Parameter

Comments

ca_bundle

path

Path of a CA bundle used to validate the Horizon instance SSL certificate.

client_cert

path

Path of a client certificate.

Required if you use certificate based authentication

client_key

path

Path to the private key used for client-certificate authentication.

Required if you use certificate based authentication.

Restrict access to the key and inventory configuration files.

connect_timeout

float

Maximum number of seconds to wait for the controller to establish a connection to Horizon.

Default: 10.0

endpoint

string / required

Your Horizon instance base endpoint.

It must include the protocol (https://) and no trailing slash nor path.

profile

string / required

Name of the profile.

read_timeout

float

Maximum number of seconds to wait between response reads by the controller after connecting to Horizon.

Default: 60.0

workflow

string / required

Workflow of the template

Choices:

  • "enroll"

  • "recover"

  • "renew"

  • "revoke"

  • "update"

x_api_id

string

Horizon identifier

Required if you use credentials authentication

x_api_key

string

Secret API key used for Horizon credential authentication.

Required if you use credentials authentication.

Store this value with Ansible Vault.

Tasks containing lookup expressions with this value should use no_log=true.

Examples

- name: Get webra enroll template
  evertrust.horizon.horizon_template:
    endpoint: "https://<horizon-endpoint>"
    x_api_id: "<horizon-id>"
    x_api_key: "<horizon-password>"
    profile: "exampleProfile"
    workflow: "enroll"

- name: Get webra renew template
  evertrust.horizon.horizon_template:
    endpoint: "https://<horizon-endpoint>"
    x_api_id: "<horizon-id>"
    x_api_key: "<horizon-password>"
    profile: "exampleProfile"
    workflow: "renew"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

capabilities

dictionary

Describes how certificates will be enrolled on this profile.

Returned: If present

authorizedKeyTypes

list / elements=string

List of authorized key types for enrollment.

Returned: If present

centralized

boolean

Whether this profile supports centralized enrollment.

Returned: Always

decentralized

boolean

Whether this profile supports decentralized enrollment.

Returned: Always

defaultKeyType

string

Default key type used for centralized enrollment.

Returned: If present

escrow

boolean

Whether this profile will escrow the certificate private keys.

Returned: Always

p12passwordMode

string

Whether the user will be required to input their PKCS#12 password upon enrollment.

Returned: If present

p12passwordPolicy

string

Password policy for the P12 file.

Returned: If present

p12storeEncryptionType

string

Encryption type for the P12 file.

Returned: If present

preferredEnrollmentMode

string

If both centralized and decentralized enrollment are supported, this is the preferred mode.

Returned: If present

showP12OnEnroll

boolean

Whether the PKCS#12 file will be displayed to the user upon enrollment.

Returned: If present

showP12OnRecover

boolean

Whether the PKCS#12 file will be displayed to the user upon recovery.

Returned: If present

showP12PasswordOnEnroll

boolean

Whether the PKCS#12 password will be displayed to the user upon enrollment.

Returned: If present

showP12PasswordOnRecover

boolean

Whether the PKCS#12 password will be displayed to the user upon recovery.

Returned: If present

contactEmail

dictionary

Information about the certificate’s contact email and how to edit it.

Returned: If present

computationRule

string

Computation rule input will be evaluated and will override all other inputs.

Returned: If present

description

list / elements=dictionary

The description of the contact email.

Returned: If present

lang

string

The ISO 3166-1 (2-letters) code of the language used for the value.

Returned: Always

value

string

The localized value.

Returned: Always

editable

boolean

Whether the contact email is editable by the requester.

Returned: If present

mandatory

boolean

Whether the contact email is mandatory to submit this request.

Returned: If present

regex

string

The regex used to validate the contact email.

Returned: If present

value

string

The contact email.

Returned: If present

whitelist

list / elements=string

The list of allowed contact emails.

Returned: If present

extensions

list / elements=dictionary

Information about the certificate’s extensions and how to edit them.

Returned: If present

computationRule

string

Computation rule input will be evaluated and will override all other inputs.

Returned: If present

editable

boolean

Whether the extension element is editable by the requester.

Returned: If present

mandatory

boolean

Whether the extension element is mandatory to submit this request.

Returned: If present

regex

string

The regular expression to validate the extension element.

Returned: If present

type

string

The type of the extension element.

Returned: Always

value

string

The value of the extension element.

Returned: If present

labels

list / elements=dictionary

List of labels used internally to tag and group certificates.

Returned: If present

computationRule

string

The computation rule of the label element.

Returned: If present

description

list / elements=dictionary

The description of the label element.

Returned: If present

lang

string

The ISO 3166-1 (2-letters) code of the language used for the value.

Returned: Always

value

string

The localized value.

Returned: Always

displayName

list / elements=dictionary

The display name of the label element.

Returned: If present

lang

string

The ISO 3166-1 (2-letters) code of the language used for the value.

Returned: Always

value

string

The localized value.

Returned: Always

editable

boolean

Whether the label is editable.

Returned: If present

enum

list / elements=string

The enum used to validate the label element.

Returned: If present

label

string

The name of the label.

Returned: Always

mandatory

boolean

Whether the label element is mandatory to submit this request.

Returned: If present

regex

string

The regex used to validate the label element.

Returned: If present

suggestions

list / elements=string

The suggestions used to recommend the label element values.

Returned: If present

value

string

The value of the label element.

Returned: If present

metadata

list / elements=dictionary

Information about the certificate’s metadata and how to edit them.

Returned: If present

editable

boolean

Whether the metadata element is editable by the requester.

Returned: If present

metadata

string

Technical metadata related to the certificate.

Returned: Always

value

string

The value of the metadata element.

Returned: If present

owner

dictionary

Information about the certificate’s owner and how to edit it.

Returned: If present

computationRule

string

Computation rule input will be evaluated and will override all other inputs.

Returned: If present

description

list / elements=dictionary

The description of the owner element.

Returned: If present

lang

string

The ISO 3166-1 (2-letters) code of the language used for the value.

Returned: Always

value

string

The localized value.

Returned: Always

editable

boolean

Whether the owner element is editable by the requester.

Returned: If present

mandatory

boolean

Whether the owner element is mandatory to submit this request.

Returned: If present

value

string

The value of the owner element. This should be a principal identifier.

Returned: If present

passwordMode

string

The password mode of the certificate

Returned: If present (recover only)

passwordPolicy

dictionary

The password policy that will be used to generate the certificate’s PKCS#12 password.

Returned: If present

_id

string

The internal ID of the password policy.

Returned: Always

maxChar

integer

The maximum number of characters of the password.

Returned: If present

minChar

integer

The minimum number of characters of the password.

Returned: Always

minDiChar

integer

The minimum number of digits of the password.

Returned: If present

minLoChar

integer

The minimum number of lowercase characters of the password.

Returned: If present

minSpChar

integer

The minimum number of special characters of the password.

Returned: If present

minUpChar

integer

The minimum number of uppercase characters of the password.

Returned: If present

name

string

The name of the password policy.

Returned: Always

spChar

string

The special characters of the password accepted by the password policy.

Returned: If present

revocationReason

string

The reason for revoking the certificate

Returned: If present (revocation only)

sans

list / elements=dictionary

List of SAN elements that will be used to build the certificate’s Subject Alternative Name.

Returned: If present

computationRule

string

Computation rule input will be evaluated and will override all other inputs.

Returned: If present

editable

boolean

Whether the field is editable or not for the currently authenticated user.

Returned: If present

max

integer

The maximum number of SAN elements that must be provided.

Returned: If present

min

integer

The minimum number of SAN elements that must be provided.

Returned: If present

regex

string

A regular expression that will be used to validate the element’s value.

Returned: If present

type

string

SAN type.

Returned: Always

value

list / elements=string

SAN value.

Returned: If present

subject

list / elements=dictionary

List of DN elements that will be used to build the certificate’s Distinguished Name.

Returned: If present

computationRule

string

Computation rule input will be evaluated and will override all other inputs.

Returned: If present

editable

boolean

Whether the field is editable or not for the currently authenticated user.

Returned: If present

element

string

The element type and index.

Returned: Always

mandatory

boolean

Whether the field is mandatory or not.

Returned: If present

regex

string

A regular expression that will be used to validate the element’s value.

Returned: If present

type

string

The formatted element type.

Returned: If present

value

string

The element value.

Returned: If present

team

dictionary

Information about the certificate’s team and how to edit it.

Returned: If present

computationRule

string

Computation rule input will be evaluated and will override all other inputs.

Returned: If present

description

list / elements=dictionary

The description of the team element.

Returned: If present

lang

string

The ISO 3166-1 (2-letters) code of the language used for the value.

Returned: Always

value

string

The localized value.

Returned: Always

editable

boolean

Whether the team element is editable by the requester.

Returned: If present

mandatory

boolean

Whether the team element is mandatory to submit this request.

Returned: If present

value

string

The value of the team element. This should be a team identifier.

Returned: If present

Authors

  • Evertrust R&D (@EverTrust)