Some improvements in csui application

library/servicenow/env_user.py

@@ -5,6 +5,20 @@ import base64
 import socket
 from library.vault.client import clientV
 
+#approle:    csui-change-mgmt-dev
+#role_id     a3b2fdf3-8e8a-55d9-2688-13409145c7b2
+#secret_id   fc9674f1-5187-51e8-f8c8-29273b5f6951
+#read access to: apps-kv/dev/SNOW/*
+
+#approle:    csui-change-mgmt-acc
+#role_id     0743cc2f-ee65-3bf8-fe3d-27550db27d00
+#secret_id   225cc7f7-1e02-aca8-d84b-45da9a605012
+#read access to: apps-kv/acc/SNOW/*
+
+#approle:    csui-change-mgmt-prod
+#role_id     041f50d0-ece2-f9d7-8155-cbe2377081a8
+#secret_id   d83c9e67-98d0-9d51-afa0-0a4c680aa0ad
+#read access to: apps-kv/prod/SNOW/*
 
 HOSTNAME = socket.getfqdn()
 IS_DEV = ('.dev.' in HOSTNAME)
@@ -22,28 +36,43 @@ namespace_used = "EC/DIGIT_C4_SNET_ADMIN-ACC"
 base_url = "https://digituat.service-now.com/api/emdig/v1/itsm"
 vault_url = "https://sam-hcavault.cec.eu.int"
 
+#approle:    csui-change-mgmt-dev
+#role_id     a3b2fdf3-8e8a-55d9-2688-13409145c7b2
+#secret_id   fc9674f1-5187-51e8-f8c8-29273b5f6951
+#read access to: apps-kv/dev/SNOW/*
+
+#approle:    csui-change-mgmt-acc
+#role_id     0743cc2f-ee65-3bf8-fe3d-27550db27d00
+#secret_id   225cc7f7-1e02-aca8-d84b-45da9a605012
+#read access to: apps-kv/acc/SNOW/*
+
+#approle:    csui-change-mgmt-prod
+#role_id     041f50d0-ece2-f9d7-8155-cbe2377081a8
+#secret_id   d83c9e67-98d0-9d51-afa0-0a4c680aa0ad
+#read access to: apps-kv/prod/SNOW/*
+
+
 if IS_DEV:
     print('IS DEV')
     engine = "dev"
-    role_id_read = '3d20c565-ae1f-25dc-ba39-f17f20beb18e'
-    secret_approle_read = '50cf5e80-e509-708c-707a-29c127714bc5'
+    role_id_read = 'a3b2fdf3-8e8a-55d9-2688-13409145c7b2'
+    secret_approle_read = 'fc9674f1-5187-51e8-f8c8-29273b5f6951'
 elif IS_ACC :
     print('IS ACC')
     engine = "acc"
-    role_id_read = 'a516f820-6f9f-d963-9807-2aef7aeb3612'
-    secret_approle_read = '37dfe79f-33f7-2fde-c412-86c43d7bbe50'
+    role_id_read = '0743cc2f-ee65-3bf8-fe3d-27550db27d00'
+    secret_approle_read = '225cc7f7-1e02-aca8-d84b-45da9a605012'
 else :
     print('IS PROD')
     namespace_used = "EC/DIGIT_C4_SNET_ADMIN-PROD"
     base_url = "https://digit.service-now.com/api/emdig/v1/itsm"
     vault_url = "https://sam-hcpvault.cec.eu.int"
     engine = 'prod'
-    #Approle approle-prod-csui-change-mgmt
-    role_id_read = 'd6717ad9-75db-37f2-363d-50f21a52408a'
-    secret_approle_read = 'f13d0bbb-03ce-d470-27b3-8f606f3e86bf'
+    role_id_read = '041f50d0-ece2-f9d7-8155-cbe2377081a8'
+    secret_approle_read = 'd83c9e67-98d0-9d51-afa0-0a4c680aa0ad'
 
-#password = clientV.getPasswordByAppRole("apps-kv/"+engine+"/SNOW", vault_url, namespace_used, role_id_read, secret_approle_read)
-password = "+Xg76;CwCr4TgBCs"
+#necessary check with Javier
+password = clientV.getPasswordByAppRole("apps-kv/"+engine+"/SNOW/csui", vault_url, namespace_used, role_id_read, secret_approle_read)
 credentials = f"{username}:{password}"
 encoded_credentials = base64.b64encode(credentials.encode("utf-8")).decode("utf-8")
 authorization = f"Basic {encoded_credentials}"

library/vault/client.py

@@ -17,7 +17,7 @@ class Vault(object):
     def __init__(self):
         self.session = requests.Session()
 
-
+    #curl -H "X-Vault-Namespace: EC/DIGIT_C4_SNET_ADMIN-ACC" -X POST --tlsv1.2 --data '{"password": "password"}' https://sam-hcavault.cec.eu.int/v1/auth/userpass/login/fandrem
     def getPasswordByAppRole(self, key, vault_url, namespace_used, role_id, secret_id):
         # Create a client instance
         client = hvac.Client(url=vault_url, namespace=namespace_used,  verify=False)
@@ -26,7 +26,7 @@ class Vault(object):
         client.token = response['auth']['client_token']
         secret = self.getPasswordViaToken(key, vault_url, namespace_used, client.token )
         secret_data = False
-        if secret is not None and len(secret['errors']) == 0 and 'data' in secret:
+        if secret is not None  and 'data' in secret:
             secret_data = secret['data']['data']['password']
             #print(secret_data)
         else:
@@ -46,6 +46,5 @@ class Vault(object):
         return response.json()
 
 
-
 log = logging.getLogger(__name__)
 clientV = Vault()