perf: Push password change and select finally use rdp to test connectivity. rdp does not support gateway

apps/accounts/automations/change_secret/host/aix/main.yml

@@ -79,7 +79,7 @@
         login_password: "{{ account.secret }}"
         login_host: "{{ jms_asset.address }}"
         login_port: "{{ jms_asset.port }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         become: "{{ account.become.ansible_become | default(False) }}"
         become_method: su
         become_user: "{{ account.become.ansible_user | default('') }}"
@@ -95,7 +95,7 @@
         login_port: "{{ jms_asset.port }}"
         login_user: "{{ account.username }}"
         login_private_key_path: "{{ account.private_key_path  }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         old_ssh_version: "{{ jms_asset.old_ssh_version | default(False) }}"
       when: account.secret_type == "ssh_key"
       delegate_to: localhost

apps/accounts/automations/change_secret/host/posix/main.yml

@@ -79,7 +79,7 @@
         login_password: "{{ account.secret }}"
         login_host: "{{ jms_asset.address }}"
         login_port: "{{ jms_asset.port }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         become: "{{ account.become.ansible_become | default(False) }}"
         become_method: su
         become_user: "{{ account.become.ansible_user | default('') }}"
@@ -95,7 +95,7 @@
         login_port: "{{ jms_asset.port }}"
         login_user: "{{ account.username }}"
         login_private_key_path: "{{ account.private_key_path  }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         old_ssh_version: "{{ jms_asset.old_ssh_version | default(False) }}"
       when: account.secret_type == "ssh_key"
       delegate_to: localhost

apps/accounts/automations/change_secret/host/windows_rdp_verify/main.yml

@@ -25,11 +25,11 @@
 
     - name: Verify password (pyfreerdp)
       rdp_ping:
-        login_host: "{{ jms_asset.address }}"
+        login_host: "{{ jms_asset.origin_address }}"
         login_port: "{{ jms_asset.protocols | selectattr('name', 'equalto', 'rdp') | map(attribute='port') | first }}"
         login_user: "{{ account.username }}"
         login_password: "{{ account.secret }}"
         login_secret_type: "{{ account.secret_type }}"
-        login_private_key_path: "{{ account.private_key_path }}"
+        gateway_args: "{{ jms_gateway | default(None) }}"
       when: account.secret_type == "password"
       delegate_to: localhost

apps/accounts/automations/push_account/host/aix/main.yml

@@ -79,7 +79,7 @@
         login_password: "{{ account.secret }}"
         login_host: "{{ jms_asset.address }}"
         login_port: "{{ jms_asset.port }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         become: "{{ account.become.ansible_become | default(False) }}"
         become_method: su
         become_user: "{{ account.become.ansible_user | default('') }}"
@@ -95,7 +95,7 @@
         login_port: "{{ jms_asset.port }}"
         login_user: "{{ account.username }}"
         login_private_key_path: "{{ account.private_key_path  }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         old_ssh_version: "{{ jms_asset.old_ssh_version | default(False) }}"
       when: account.secret_type == "ssh_key"
       delegate_to: localhost

apps/accounts/automations/push_account/host/posix/main.yml

@@ -79,7 +79,7 @@
         login_password: "{{ account.secret }}"
         login_host: "{{ jms_asset.address }}"
         login_port: "{{ jms_asset.port }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         become: "{{ account.become.ansible_become | default(False) }}"
         become_method: su
         become_user: "{{ account.become.ansible_user | default('') }}"
@@ -95,7 +95,7 @@
         login_port: "{{ jms_asset.port }}"
         login_user: "{{ account.username }}"
         login_private_key_path: "{{ account.private_key_path  }}"
-        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default('') }}"
+        gateway_args: "{{ jms_asset.ansible_ssh_common_args | default(None) }}"
         old_ssh_version: "{{ jms_asset.old_ssh_version | default(False) }}"
       when: account.secret_type == "ssh_key"
       delegate_to: localhost

apps/accounts/automations/push_account/host/windows_rdp_verify/main.yml

@@ -25,11 +25,11 @@
 
     - name: Verify password (pyfreerdp)
       rdp_ping:
-        login_host: "{{ jms_asset.address }}"
+        login_host: "{{ jms_asset.origin_address }}"
         login_port: "{{ jms_asset.protocols | selectattr('name', 'equalto', 'rdp') | map(attribute='port') | first }}"
         login_user: "{{ account.username }}"
         login_password: "{{ account.secret }}"
         login_secret_type: "{{ account.secret_type }}"
-        login_private_key_path: "{{ account.private_key_path }}"
+        gateway_args: "{{ jms_gateway | default(None) }}"
       when: account.secret_type == "password"
       delegate_to: localhost

apps/accounts/automations/verify_account/custom/rdp/main.yml

@@ -13,4 +13,3 @@
         login_user: "{{ account.username }}"
         login_password: "{{ account.secret }}"
         login_secret_type: "{{ account.secret_type }}"
-        login_private_key_path: "{{ account.private_key_path }}"

apps/assets/automations/ping/custom/rdp/main.yml

@@ -13,4 +13,3 @@
         login_host: "{{ jms_asset.address }}"
         login_port: "{{ jms_asset.port }}"
         login_secret_type: "{{ jms_account.secret_type }}"
-        login_private_key_path: "{{ jms_account.private_key_path }}"

apps/libs/ansible/modules/rdp_ping.py

@@ -36,7 +36,8 @@ conn_err_msg:
 '''
 
 import pyfreerdp
-from typing import NamedTuple
+import multiprocessing
+from sshtunnel import SSHTunnelForwarder
 from ansible.module_utils.basic import AnsibleModule
 
 
@@ -44,12 +45,6 @@ from ansible.module_utils.basic import AnsibleModule
 # Module execution.
 #
 
-class Param(NamedTuple):
-    hostname: str
-    port: int
-    username: str
-    password: str
-
 
 def common_argument_spec():
     options = dict(
@@ -58,37 +53,102 @@ def common_argument_spec():
         login_user=dict(type='str', required=False, default='root'),
         login_password=dict(type='str', required=False, no_log=True),
         login_secret_type=dict(type='str', required=False, default='password'),
-        login_private_key_path=dict(type='str', required=False, no_log=True),
+        gateway_args=dict(type='dict', required=False, default=None),
     )
     return options
 
 
-def main():
+class RDPConnectionManager:
-    options = common_argument_spec()
-    module = AnsibleModule(argument_spec=options, supports_check_mode=True)
-    result = {'changed': False, 'is_available': False}
 
-    secret_type = module.params['login_secret_type']
+    def __init__(self, module_params):
-    if secret_type != 'password':
+        self.params = module_params
-        module.fail_json(
+        self.ssh_tunnel = None
-            msg=f'The current ansible does not support \
+        self.connection_details = self.build_connection_details()
-                the verification method for {secret_type} types.'
+        self.result_queue = multiprocessing.Queue()
+
+    def build_connection_details(self):
+        connection_details = {
+            'hostname': self.params['login_host'],
+            'port': self.params['login_port'],
+            'username': self.params['username'],
+            'password': self.params['password']
+        }
+        return connection_details
+
+    def setup_ssh_tunnel(self):
+        gateway_args = self.params['gateway_args'] or {}
+        if not gateway_args:
+            return
+
+        tunnel = SSHTunnelForwarder(
+            (gateway_args['address'], gateway_args['port']),
+            ssh_username=gateway_args['username'],
+            ssh_password=gateway_args['secret'],
+            ssh_pkey=gateway_args['private_key_path'],
+            remote_bind_address=(
+                self.connection_details['hostname'],
+                self.connection_details['port']
+            )
         )
-        return module.exit_json(**result)
 
-    params = Param(
+        tunnel.start()
-        hostname=module.params['login_host'],
+        self.connection_details['hostname'] = '127.0.0.1'
-        port=module.params['login_port'],
+        self.connection_details['port'] = tunnel.local_bind_port
-        username=module.params['login_user'],
+        self.ssh_tunnel = tunnel
-        password=module.params['login_password']
-    )
 
-    is_available = pyfreerdp.check_connectivity(*params, '', 0)
+    def close_ssh_tunnel(self):
+        if self.ssh_tunnel:
+            self.ssh_tunnel.stop()
+
+    def prepare_connection(self):
+        self.setup_ssh_tunnel()
+
+    def cleanup_connection(self):
+        self.close_ssh_tunnel()
+
+    def check_rdp_connectivity(self):
+        connect_params = list(self.connection_details.values()) + ['', 0]
+        is_reachable = pyfreerdp.check_connectivity(*connect_params)
+        self.result_queue.put(is_reachable)
+
+    def attempt_connection(self):
+        if self.params['login_secret_type'] != 'password':
+            error_message = f'unsupported authentication method: {self.params["login_secret_type"]}'
+            return False, error_message
+
+        try:
+            self.prepare_connection()
+
+            connection_process = multiprocessing.Process(
+                target=self.check_rdp_connectivity
+            )
+            connection_process.start()
+            connection_process.join()
+
+            is_reachable = self.result_queue.get()
+            self.cleanup_connection()
+
+            if not is_reachable:
+                return False, 'RDP connection failed'
+        except Exception as ex:
+            return False, str(ex)
+        return True, ''
+
+
+def main():
+    argument_spec = common_argument_spec()
+    module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True)
+    result = {'changed': False}
+    module_params = module.params
+    rdp_manager = RDPConnectionManager(module_params)
+    is_available, error_message = rdp_manager.attempt_connection()
     result['is_available'] = is_available
+
     if not is_available:
-        module.fail_json(msg='Unable to connect to asset.')
+        module.fail_json(msg=f'Unable to connect to asset: {error_message}')
+
     return module.exit_json(**result)
 
 
 if __name__ == '__main__':
-    main()
+    main()

apps/libs/ansible/modules_utils/custom_common.py

@@ -151,10 +151,8 @@ class SSHClient:
         gateway_server = self.gateway_server
         if not gateway_server:
             return
-        try:
+
-            gateway_server.stop()
+        gateway_server.stop()
-        except Exception:
-            pass
 
     def before_runner_start(self):
         self.local_gateway_prepare()

apps/ops/ansible/inventory.py

@@ -187,6 +187,7 @@ class JMSInventory:
                 'protocol': protocol.name, 'port': protocol.port,
                 'spec_info': asset.spec_info, 'secret_info': secret_info,
                 'protocols': [{'name': p.name, 'port': p.port} for p in protocols],
+                'origin_address': asset.address
             },
             'jms_account': {
                 'id': str(account.id), 'username': account.username,