internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-31 11:54:47 +00:00
Code Issues Projects Releases Wiki Activity

hbacrule: Fix member management idempotence issues.

Browse Source 
Members of hbacrule must be compared in a case insensitive manner.
This patch fixes comparation of member parameters against existing
members by converting parameters to lowercase.

Also, there were some cases where a change with an empty set of members
was issued to IPA API, leading to a result of 'changed: yes' when
'changed: no' was expected. The fix involved a refactoring of the
member management code.
This commit is contained in:
Rafael Guterres Jeffman
2021-11-12 19:03:15 -03:00
parent d2bcaa3b81
commit 0cebb3e2a2
2 changed files with 613 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files

271
plugins/modules/ipahbacrule.py
View File

@@ -238,12 +238,12 @@ def main():
hostcategory = ansible_module.params_get("hostcategory") hostcategory = ansible_module.params_get("hostcategory")
servicecategory = ansible_module.params_get("servicecategory") servicecategory = ansible_module.params_get("servicecategory")
nomembers = ansible_module.params_get("nomembers") nomembers = ansible_module.params_get("nomembers")
host = ansible_module.params_get("host") host = ansible_module.params_get_lowercase("host")
hostgroup = ansible_module.params_get("hostgroup") hostgroup = ansible_module.params_get_lowercase("hostgroup")
hbacsvc = ansible_module.params_get("hbacsvc") hbacsvc = ansible_module.params_get_lowercase("hbacsvc")
hbacsvcgroup = ansible_module.params_get("hbacsvcgroup") hbacsvcgroup = ansible_module.params_get_lowercase("hbacsvcgroup")
user = ansible_module.params_get("user") user = ansible_module.params_get_lowercase("user")
group = ansible_module.params_get("group") group = ansible_module.params_get_lowercase("group")
action = ansible_module.params_get("action") action = ansible_module.params_get("action")
# state # state
state = ansible_module.params_get("state") state = ansible_module.params_get("state")
@@ -307,7 +307,7 @@ def main():
# Ensure fqdn host names, use default domain for simple names # Ensure fqdn host names, use default domain for simple names
if host is not None: if host is not None:
_host = [ensure_fqdn(x, default_domain) for x in host] _host = [ensure_fqdn(x, default_domain).lower() for x in host]
host = _host host = _host
commands = [] commands = []
@@ -316,6 +316,13 @@ def main():
# Make sure hbacrule exists # Make sure hbacrule exists
res_find = find_hbacrule(ansible_module, name) res_find = find_hbacrule(ansible_module, name)
host_add, host_del = [], []
hostgroup_add, hostgroup_del = [], []
hbacsvc_add, hbacsvc_del = [], []
hbacsvcgroup_add, hbacsvcgroup_del = [], []
user_add, user_del = [], []
group_add, group_del = [], []
# Create command # Create command
if state == "present": if state == "present":
# Generate args # Generate args
@@ -353,69 +360,30 @@ def main():
res_find = {} res_find = {}
# Generate addition and removal lists # Generate addition and removal lists
host_add, host_del = gen_add_del_lists( if host:
host, res_find.get("memberhost_host")) host_add, host_del = gen_add_del_lists(
host, res_find.get("memberhost_host"))
hostgroup_add, hostgroup_del = gen_add_del_lists( if hostgroup:
hostgroup, res_find.get("memberhost_hostgroup")) hostgroup_add, hostgroup_del = gen_add_del_lists(
hostgroup, res_find.get("memberhost_hostgroup"))
hbacsvc_add, hbacsvc_del = gen_add_del_lists( if hbacsvc:
hbacsvc, res_find.get("memberservice_hbacsvc")) hbacsvc_add, hbacsvc_del = gen_add_del_lists(
hbacsvc, res_find.get("memberservice_hbacsvc"))
hbacsvcgroup_add, hbacsvcgroup_del = gen_add_del_lists( if hbacsvcgroup:
hbacsvcgroup, hbacsvcgroup_add, hbacsvcgroup_del = gen_add_del_lists(
res_find.get("memberservice_hbacsvcgroup")) hbacsvcgroup,
res_find.get("memberservice_hbacsvcgroup"))
user_add, user_del = gen_add_del_lists( if user:
user, res_find.get("memberuser_user")) user_add, user_del = gen_add_del_lists(
user, res_find.get("memberuser_user"))
group_add, group_del = gen_add_del_lists( if group:
group, res_find.get("memberuser_group")) group_add, group_del = gen_add_del_lists(
group, res_find.get("memberuser_group"))
# Add hosts and hostgroups
if len(host_add) > 0 or len(hostgroup_add) > 0:
commands.append([name, "hbacrule_add_host",
{
"host": host_add,
"hostgroup": hostgroup_add,
}])
# Remove hosts and hostgroups
if len(host_del) > 0 or len(hostgroup_del) > 0:
commands.append([name, "hbacrule_remove_host",
{
"host": host_del,
"hostgroup": hostgroup_del,
}])
# Add hbacsvcs and hbacsvcgroups
if len(hbacsvc_add) > 0 or len(hbacsvcgroup_add) > 0:
commands.append([name, "hbacrule_add_service",
{
"hbacsvc": hbacsvc_add,
"hbacsvcgroup": hbacsvcgroup_add,
}])
# Remove hbacsvcs and hbacsvcgroups
if len(hbacsvc_del) > 0 or len(hbacsvcgroup_del) > 0:
commands.append([name, "hbacrule_remove_service",
{
"hbacsvc": hbacsvc_del,
"hbacsvcgroup": hbacsvcgroup_del,
}])
# Add users and groups
if len(user_add) > 0 or len(group_add) > 0:
commands.append([name, "hbacrule_add_user",
{
"user": user_add,
"group": group_add,
}])
# Remove users and groups
if len(user_del) > 0 or len(group_del) > 0:
commands.append([name, "hbacrule_remove_user",
{
"user": user_del,
"group": group_del,
}])
elif action == "member": elif action == "member":
if res_find is None: if res_find is None:
@@ -424,63 +392,33 @@ def main():
# Generate add lists for host, hostgroup and # Generate add lists for host, hostgroup and
# res_find to only try to add hosts and hostgroups # res_find to only try to add hosts and hostgroups
# that not in hbacrule already # that not in hbacrule already
if host is not None and \ if host:
"memberhost_host" in res_find: host_add = gen_add_list(
host = gen_add_list( host, res_find.get("memberhost_host"))
host, res_find["memberhost_host"]) if hostgroup is not None:
if hostgroup is not None and \ hostgroup_add = gen_add_list(
"memberhost_hostgroup" in res_find: hostgroup, res_find.get("memberhost_hostgroup"))
hostgroup = gen_add_list(
hostgroup, res_find["memberhost_hostgroup"])
# Add hosts and hostgroups
if host is not None or hostgroup is not None:
commands.append([name, "hbacrule_add_host",
{
"host": host,
"hostgroup": hostgroup,
}])
# Generate add lists for hbacsvc, hbacsvcgroup and # Generate add lists for hbacsvc, hbacsvcgroup and
# res_find to only try to add hbacsvcs and hbacsvcgroups # res_find to only try to add hbacsvcs and hbacsvcgroups
# that not in hbacrule already # that not in hbacrule already
if hbacsvc is not None and \ if hbacsvc:
"memberservice_hbacsvc" in res_find: hbacsvc_add = gen_add_list(
hbacsvc = gen_add_list( hbacsvc, res_find.get("memberservice_hbacsvc"))
hbacsvc, res_find["memberservice_hbacsvc"]) if hbacsvcgroup:
if hbacsvcgroup is not None and \ hbacsvcgroup_add = gen_add_list(
"memberservice_hbacsvcgroup" in res_find:
hbacsvcgroup = gen_add_list(
hbacsvcgroup, hbacsvcgroup,
res_find["memberservice_hbacsvcgroup"]) res_find.get("memberservice_hbacsvcgroup"))
# Add hbacsvcs and hbacsvcgroups
if hbacsvc is not None or hbacsvcgroup is not None:
commands.append([name, "hbacrule_add_service",
{
"hbacsvc": hbacsvc,
"hbacsvcgroup": hbacsvcgroup,
}])
# Generate add lists for user, group and # Generate add lists for user, group and
# res_find to only try to add users and groups # res_find to only try to add users and groups
# that not in hbacrule already # that not in hbacrule already
if user is not None and \ if user:
"memberuser_user" in res_find: user_add = gen_add_list(
user = gen_add_list( user, res_find.get("memberuser_user"))
user, res_find["memberuser_user"]) if group:
if group is not None and \ group_add = gen_add_list(
"memberuser_group" in res_find: group, res_find.get("memberuser_group"))
group = gen_add_list(
group, res_find["memberuser_group"])
# Add users and groups
if user is not None or group is not None:
commands.append([name, "hbacrule_add_user",
{
"user": user,
"group": group,
}])
elif state == "absent": elif state == "absent":
if action == "hbacrule": if action == "hbacrule":
@@ -494,75 +432,39 @@ def main():
# Generate intersection lists for host, hostgroup and # Generate intersection lists for host, hostgroup and
# res_find to only try to remove hosts and hostgroups # res_find to only try to remove hosts and hostgroups
# that are in hbacrule # that are in hbacrule
if host is not None: if host:
if "memberhost_host" in res_find: if "memberhost_host" in res_find:
host = gen_intersection_list( host_del = gen_intersection_list(
host, res_find["memberhost_host"]) host, res_find["memberhost_host"])
else: if hostgroup:
host = None
if hostgroup is not None:
if "memberhost_hostgroup" in res_find: if "memberhost_hostgroup" in res_find:
hostgroup = gen_intersection_list( hostgroup_del = gen_intersection_list(
hostgroup, res_find["memberhost_hostgroup"]) hostgroup, res_find["memberhost_hostgroup"])
else:
hostgroup = None
# Remove hosts and hostgroups
if host is not None or hostgroup is not None:
commands.append([name, "hbacrule_remove_host",
{
"host": host,
"hostgroup": hostgroup,
}])
# Generate intersection lists for hbacsvc, hbacsvcgroup # Generate intersection lists for hbacsvc, hbacsvcgroup
# and res_find to only try to remove hbacsvcs and # and res_find to only try to remove hbacsvcs and
# hbacsvcgroups that are in hbacrule # hbacsvcgroups that are in hbacrule
if hbacsvc is not None: if hbacsvc:
if "memberservice_hbacsvc" in res_find: if "memberservice_hbacsvc" in res_find:
hbacsvc = gen_intersection_list( hbacsvc_del = gen_intersection_list(
hbacsvc, res_find["memberservice_hbacsvc"]) hbacsvc, res_find["memberservice_hbacsvc"])
else: if hbacsvcgroup:
hbacsvc = None
if hbacsvcgroup is not None:
if "memberservice_hbacsvcgroup" in res_find: if "memberservice_hbacsvcgroup" in res_find:
hbacsvcgroup = gen_intersection_list( hbacsvcgroup_del = gen_intersection_list(
hbacsvcgroup, hbacsvcgroup,
res_find["memberservice_hbacsvcgroup"]) res_find["memberservice_hbacsvcgroup"])
else:
hbacsvcgroup = None
# Remove hbacsvcs and hbacsvcgroups
if hbacsvc is not None or hbacsvcgroup is not None:
commands.append([name, "hbacrule_remove_service",
{
"hbacsvc": hbacsvc,
"hbacsvcgroup": hbacsvcgroup,
}])
# Generate intersection lists for user, group and # Generate intersection lists for user, group and
# res_find to only try to remove users and groups # res_find to only try to remove users and groups
# that are in hbacrule # that are in hbacrule
if user is not None: if user:
if "memberuser_user" in res_find: if "memberuser_user" in res_find:
user = gen_intersection_list( user_del = gen_intersection_list(
user, res_find["memberuser_user"]) user, res_find["memberuser_user"])
else: if group:
user = None
if group is not None:
if "memberuser_group" in res_find: if "memberuser_group" in res_find:
group = gen_intersection_list( group_del = gen_intersection_list(
group, res_find["memberuser_group"]) group, res_find["memberuser_group"])
else:
group = None
# Remove users and groups
if user is not None or group is not None:
commands.append([name, "hbacrule_remove_user",
{
"user": user,
"group": group,
}])
elif state == "enabled": elif state == "enabled":
if res_find is None: if res_find is None:
@@ -587,6 +489,53 @@ def main():
else: else:
ansible_module.fail_json(msg="Unkown state '%s'" % state) ansible_module.fail_json(msg="Unkown state '%s'" % state)
# Manage HBAC rule members.
# Add hosts and hostgroups
if len(host_add) > 0 or len(hostgroup_add) > 0:
commands.append([name, "hbacrule_add_host",
{
"host": host_add,
"hostgroup": hostgroup_add,
}])
# Remove hosts and hostgroups
if len(host_del) > 0 or len(hostgroup_del) > 0:
commands.append([name, "hbacrule_remove_host",
{
"host": host_del,
"hostgroup": hostgroup_del,
}])
# Add hbacsvcs and hbacsvcgroups
if len(hbacsvc_add) > 0 or len(hbacsvcgroup_add) > 0:
commands.append([name, "hbacrule_add_service",
{
"hbacsvc": hbacsvc_add,
"hbacsvcgroup": hbacsvcgroup_add,
}])
# Remove hbacsvcs and hbacsvcgroups
if len(hbacsvc_del) > 0 or len(hbacsvcgroup_del) > 0:
commands.append([name, "hbacrule_remove_service",
{
"hbacsvc": hbacsvc_del,
"hbacsvcgroup": hbacsvcgroup_del,
}])
# Add users and groups
if len(user_add) > 0 or len(group_add) > 0:
commands.append([name, "hbacrule_add_user",
{
"user": user_add,
"group": group_add,
}])
# Remove users and groups
if len(user_del) > 0 or len(group_del) > 0:
commands.append([name, "hbacrule_remove_user",
{
"user": user_del,
"group": group_del,
}])
# Execute commands # Execute commands
changed = ansible_module.execute_ipa_commands( changed = ansible_module.execute_ipa_commands(

503
tests/hbacrule/test_hbacrule_member_case_insensitive.yml Normal file
View File

@@ -0,0 +1,503 @@
---
- name: Test group
hosts: "{{ ipa_test_host | default('ipaserver') }}"
become: no
gather_facts: yes
vars:
user_list:
- User1
- uSer2
- usEr3
group_list:
- Group1
- gRoup2
- grOup3
host_list:
- HoSt01
- hOsT02
hostgroup_list:
- TestHostGroup
hbacsvc_list:
- Svc1
- sVC2
hbacsvcgroup_list:
- sVCgrOUp1
tasks:
- include_tasks: ../env_freeipa_facts.yml
- block:
# setup
- name: Ensure test hbacrule is absent
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
state: absent
- name: Ensure test users are present
ipauser:
ipaadmin_password: SomeADMINpassword
users:
- name: "{{ item }}"
first: First
last: Last
with_items: "{{ user_list }}"
- name: Ensure test groups are present
ipagroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
with_items: "{{ group_list }}"
- name: Ensure test hosts are present
ipahost:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}.{{ ipaserver_domain }}"
force: yes
with_items: "{{ host_list }}"
- name: Ensure test hostgroups are present
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
with_items: "{{ hostgroup_list }}"
- name: Ensure test hbac services are present
ipahbacsvc:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
with_items: "{{ hbacsvc_list }}"
- name: Ensure test hbac service groups are present
ipahbacsvcgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
with_items: "{{ hbacsvcgroup_list }}"
# Test with action: hbacrule
- name: Check if hbacrule present with members would trigger changes, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
hbacsvc:
- "{{ hbacsvc_list[0] }}"
- "{{ hbacsvc_list[1] }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] }}"
check_mode: yes
register: result
failed_when: not result.changed or result.failed
- name: Ensure hbacrule is present with members, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
hbacsvc:
- "{{ hbacsvc_list[0] }}"
- "{{ hbacsvc_list[1] }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] }}"
register: result
failed_when: not result.changed or result.failed
- name: Check if hbacrule present with members would not trigger changes, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
hbacsvc:
- "{{ hbacsvc_list[0] }}"
- "{{ hbacsvc_list[1] }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] }}"
check_mode: yes
register: result
failed_when: result.changed or result.failed
- name: Ensure hbacrule is present with members, lowercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | lower }}"
- "{{ user_list[2] | lower }}"
group:
- "{{ group_list[1] | lower }}"
- "{{ group_list[2] | lower }}"
host:
- "{{ host_list[0] | lower }}"
- "{{ host_list[1] | lower }}"
hostgroup:
- "{{ hostgroup_list[0] | lower }}"
hbacsvc:
- "{{ hbacsvc_list[0] | lower }}"
- "{{ hbacsvc_list[1] | lower }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | lower }}"
register: result
failed_when: result.changed or result.failed
- name: Ensure hbacrule is present with members, upercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | upper }}"
- "{{ user_list[2] | upper }}"
group:
- "{{ group_list[1] | upper }}"
- "{{ group_list[2] | upper }}"
host:
- "{{ host_list[0] | upper }}"
- "{{ host_list[1] | upper }}"
hostgroup:
- "{{ hostgroup_list[0] | upper }}"
hbacsvc:
- "{{ hbacsvc_list[0] | upper }}"
- "{{ hbacsvc_list[1] | upper }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | upper }}"
register: result
failed_when: result.changed or result.failed
- name: Ensure test hbacrule is absent
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
state: absent
# Test with action: members
- name: Ensure test hbacrule is present
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
- name: Check if hbacrule members present would trigger changes, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
hbacsvc:
- "{{ hbacsvc_list[0] }}"
- "{{ hbacsvc_list[1] }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] }}"
check_mode: yes
register: result
failed_when: not result.changed or result.failed
- name: Ensure hbacrule members present, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
hbacsvc:
- "{{ hbacsvc_list[0] }}"
- "{{ hbacsvc_list[1] }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] }}"
action: member
register: result
failed_when: not result.changed or result.failed
- name: Check if hbacrule members present would not trigger changes, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
hbacsvc:
- "{{ hbacsvc_list[0] }}"
- "{{ hbacsvc_list[1] }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] }}"
check_mode: yes
register: result
failed_when: result.changed or result.failed
- name: Ensure hbacrule members present, lowercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | lower }}"
- "{{ user_list[2] | lower }}"
group:
- "{{ group_list[1] | lower }}"
- "{{ group_list[2] | lower }}"
host:
- "{{ host_list[0] | lower }}"
- "{{ host_list[1] | lower }}"
hostgroup:
- "{{ hostgroup_list[0] | lower }}"
hbacsvc:
- "{{ hbacsvc_list[0] | lower }}"
- "{{ hbacsvc_list[1] | lower }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | lower }}"
action: member
register: result
failed_when: result.changed or result.failed
- name: Ensure hbacrule members present, upercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | upper }}"
- "{{ user_list[2] | upper }}"
group:
- "{{ group_list[1] | upper }}"
- "{{ group_list[2] | upper }}"
host:
- "{{ host_list[0] | upper }}"
- "{{ host_list[1] | upper }}"
hostgroup:
- "{{ hostgroup_list[0] | upper }}"
hbacsvc:
- "{{ hbacsvc_list[0] | upper }}"
- "{{ hbacsvc_list[1] | upper }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | upper }}"
action: member
register: result
failed_when: result.changed or result.failed
# Test absent members
- name: Check if hbacrule members absent would trigger change, upercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | upper }}"
- "{{ user_list[2] | upper }}"
group:
- "{{ group_list[1] | upper }}"
- "{{ group_list[2] | upper }}"
host:
- "{{ host_list[0] | upper }}"
- "{{ host_list[1] | upper }}"
hostgroup:
- "{{ hostgroup_list[0] | upper }}"
hbacsvc:
- "{{ hbacsvc_list[0] | upper }}"
- "{{ hbacsvc_list[1] | upper }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | upper }}"
action: member
state: absent
check_mode: yes
register: result
failed_when: not result.changed or result.failed
- name: Ensure hbacrule members are absent, upercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | upper }}"
- "{{ user_list[2] | upper }}"
group:
- "{{ group_list[1] | upper }}"
- "{{ group_list[2] | upper }}"
host:
- "{{ host_list[0] | upper }}"
- "{{ host_list[1] | upper }}"
hostgroup:
- "{{ hostgroup_list[0] | upper }}"
hbacsvc:
- "{{ hbacsvc_list[0] | upper }}"
- "{{ hbacsvc_list[1] | upper }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | upper }}"
action: member
state: absent
register: result
failed_when: not result.changed or result.failed
- name: Check if hbacrule members absent would not trigger change, upercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | upper }}"
- "{{ user_list[2] | upper }}"
group:
- "{{ group_list[1] | upper }}"
- "{{ group_list[2] | upper }}"
host:
- "{{ host_list[0] | upper }}"
- "{{ host_list[1] | upper }}"
hostgroup:
- "{{ hostgroup_list[0] | upper }}"
hbacsvc:
- "{{ hbacsvc_list[0] | upper }}"
- "{{ hbacsvc_list[1] | upper }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | upper }}"
action: member
state: absent
check_mode: yes
register: result
failed_when: result.changed or result.failed
- name: Ensure hbacrule members are absent, mixed case
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] }}"
- "{{ user_list[2] }}"
group:
- "{{ group_list[1] }}"
- "{{ group_list[2] }}"
host:
- "{{ host_list[0] }}"
- "{{ host_list[1] }}"
hostgroup:
- "{{ hostgroup_list[0] }}"
action: member
state: absent
register: result
failed_when: result.changed or result.failed
- name: Ensure hbacrule members are absent, lowercase
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
user:
- "{{ user_list[1] | lower }}"
- "{{ user_list[2] | lower }}"
group:
- "{{ group_list[1] | lower }}"
- "{{ group_list[2] | lower }}"
host:
- "{{ host_list[0] | lower }}"
- "{{ host_list[1] | lower }}"
hostgroup:
- "{{ hostgroup_list[0] | lower }}"
hbacsvc:
- "{{ hbacsvc_list[0] | lower }}"
- "{{ hbacsvc_list[1] | lower }}"
hbacsvcgroup:
- "{{ hbacsvcgroup_list[0] | lower }}"
action: member
state: absent
register: result
failed_when: result.changed or result.failed
always:
- name: Ensure test hbacrule is absent
ipahbacrule:
ipaadmin_password: SomeADMINpassword
name: testrule
state: absent
- name: Ensure test users are absent
ipauser:
ipaadmin_password: SomeADMINpassword
users:
- name: "{{ item }}"
state: absent
with_items: "{{ user_list }}"
- name: Ensure test groups are absent
ipagroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
with_items: "{{ group_list }}"
- name: Ensure test hosts are absent
ipahost:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}.{{ ipaserver_domain }}"
state: absent
with_items: "{{ host_list }}"
- name: Ensure test hostgroups are absent
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
with_items: "{{ hostgroup_list }}"
- name: Ensure test hbac services are absent
ipahbacsvc:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
with_items: "{{ hbacsvc_list }}"
- name: Ensure test hbac service groups are absent
ipahbacsvcgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
with_items: "{{ hbacsvcgroup_list }}"