na_ontap_cifs_server does not expose -advertised-enc-types

[j-k-y]

Summary

We need to remove RC4/DES from the valid advertised encryption types to kerberos. Our Active Directory have these protocols explicitly disabled.

This can be modified in ONTAP CLI with "vserver cifs security modify -vserver XXX -advertised-enc-types aes-256,aes-128".

"advertised-enc-types" currently is not implemented in the "na_ontap_cifs_server" module.

I tried to workaround with REST CLI command, but it fails for an existing CIFS server because the CLI is requesting interactive user and password credentials to modify the Active Directory computer account. This is another problem.

• name: Set Kerberos advertised encryption types to AES only
  netapp.ontap.na_ontap_rest_cli:
  hostname: "{{ netapp_hostname }}"
  username: "{{ netapp_username }}"
  password: "{{ netapp_password }}"
  validate_certs: "{{ validate_certs }}"
  command: "vserver/cifs/security"
  verb: "PATCH"
  params:
  vserver: "{{ item.vserver }}"
  body:
  advertised_enc_types: "{{ item.advertised_enc_types }}"
  loop: "{{ cifs_servers }}"

Error: {'message': 'I order to update the advertised encryption types, the password for the CIFS server machine account must be reset. Enter the username and password for the CIFS domain "XXXXX".', 'code': '656474'}"}

Component Name

netapp.ontap.na_ontap_cifs_server

Additional Information

[DhivyaBharathi215]

The story DEVOPS-8481 created.