Adding tacacs+ container for testing

4 files changed, 71 insertions, 0 deletions

diff --git a/tools/docker-compose/README.md b/tools/docker-compose/README.md
index b450398ee0..e071f33923 100644
--- a/tools/docker-compose/README.md
+++ b/tools/docker-compose/README.md
@@ -244,6 +244,7 @@ $ make docker-compose
 - [SAML and OIDC Integration](#saml-and-oidc-integration)
 - [OpenLDAP Integration](#openldap-integration)
 - [Splunk Integration](#splunk-integration)
+- [tacacs+ Integration](#tacacs+-integration)
 
 ### Start a Shell
 
@@ -472,6 +473,29 @@ ansible-playbook tools/docker-compose/ansible/plumb_splunk.yml
 
 Once the playbook is done running Splunk should now be setup in your development environment. You can log into the admin console (see above for username/password) and click on "Searching and Reporting" in the left hand navigation. In the search box enter `source="http:tower_logging_collections"` and click search.
 
+### - tacacs+ Integration
+
+tacacs+ is an networking protocol that provides external authentication which can be used with AWX. This section describes how to build a reference tacacs+ instance and plumb it with your AWX for testing purposes.
+
+First, be sure that you have the awx.awx collection installed by running `make install_collection`.
+
+Anytime you want to run a tacacs+ instance alongside AWX we can start docker-compose with the TACACS option to get a containerized instance with the command:
+```bash
+TACACS=true make docker-compose
+```
+
+Once the containers come up a new port (49) should be exposed and the tacacs+ server should be running on those ports.
+
+Now we are ready to configure and plumb tacacs+ with AWX. To do this we have provided a playbook which will:
+* Backup and configure the tacacsplus adapter in AWX. NOTE: this will back up your existing settings but the password fields can not be backed up through the API, you need a DB backup to recover this.
+
+```bash
+export CONTROLLER_USERNAME=<your username>
+export CONTROLLER_PASSWORD=<your password>
+ansible-playbook tools/docker-compose/ansible/plumb_tacacs.yml
+```
+
+Once the playbook is done running tacacs+ should now be setup in your development environment. This server has the accounts listed on https://hub.docker.com/r/dchidell/docker-tacacs
 
 ### Prometheus and Grafana integration
 
diff --git a/tools/docker-compose/ansible/plumb_tacacs.yml b/tools/docker-compose/ansible/plumb_tacacs.yml
new file mode 100644
index 0000000000..c7dcbe5e22
--- /dev/null
+++ b/tools/docker-compose/ansible/plumb_tacacs.yml
@@ -0,0 +1,32 @@
+---
+- name: Plumb a tacacs+ instance
+  hosts: localhost
+  connection: local
+  gather_facts: False
+  vars:
+    awx_host: "https://localhost:8043"
+  tasks:
+    - name: Load existing and new tacacs+ settings
+      set_fact:
+        existing_tacacs: "{{ lookup('awx.awx.controller_api', 'settings/tacacsplus', host=awx_host, verify_ssl=false) }}"
+        new_tacacs: "{{ lookup('template', 'tacacsplus_settings.json.j2') }}"
+
+    - name: Display existing tacacs+ configuration
+      debug:
+        msg:
+          - "Here is your existing tacacsplus configuration for reference:"
+          - "{{ existing_tacacs }}"
+
+    - pause:
+        prompt: "Continuing to run this will replace your existing tacacs settings (displayed above). They will all be captured. Be sure that is backed up before continuing"
+
+    - name: Write out the existing content
+      copy:
+        dest: "../_sources/existing_tacacsplus_adapter_settings.json"
+        content: "{{ existing_tacacs }}"
+
+    - name: Configure AWX tacacs+ adapter
+      awx.awx.settings:
+        settings: "{{ new_tacacs }}"
+        controller_host: "{{ awx_host }}"
+        validate_certs: False
diff --git a/tools/docker-compose/ansible/roles/sources/templates/docker-compose.yml.j2 b/tools/docker-compose/ansible/roles/sources/templates/docker-compose.yml.j2
index 7badd37181..6bc49347b2 100644
--- a/tools/docker-compose/ansible/roles/sources/templates/docker-compose.yml.j2
+++ b/tools/docker-compose/ansible/roles/sources/templates/docker-compose.yml.j2
@@ -175,6 +175,14 @@ services:
     depends_on:
       - prometheus
 {% endif %}
+{% if enable_tacacs|bool %}
+  tacacs:
+    image: dchidell/docker-tacacs
+    container_name: tools_tacacs_1
+    hostname: tacacs
+    ports:
+      - "49:49"
+{% endif %}
   # A useful container that simply passes through log messages to the console
   # helpful for testing awx/tower logging
   # logstash:
diff --git a/tools/docker-compose/ansible/templates/tacacsplus_settings.json.j2 b/tools/docker-compose/ansible/templates/tacacsplus_settings.json.j2
new file mode 100644
index 0000000000..fe9dd8c391
--- /dev/null
+++ b/tools/docker-compose/ansible/templates/tacacsplus_settings.json.j2
@@ -0,0 +1,7 @@
+{
+    "TACACSPLUS_HOST": "tacacs",
+    "TACACSPLUS_PORT": 49,
+    "TACACSPLUS_SECRET": "ciscotacacskey",
+    "TACACSPLUS_SESSION_TIMEOUT": 5,
+    "TACACSPLUS_AUTH_PROTOCOL": "ascii"
+}