ipasudocmd: Allow execution of plugin in client host.

Update sudocmd README file and add tests for executing plugin with
`ipaapi_context` set to `client`.

A new test playbook can be found at:

    tests/sudocmd/test_sudocmd_client_context.yml

The new test file can be executed in a FreeIPA client host that is
not a server. In this case, it should be defined in the `ipaclients`
group, in the inventory file.

README-sudocmd.md

@@ -83,6 +83,7 @@ Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
+`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
 `name` \| `sudocmd` | The sudo command strings. | yes
 `description` | The command description string. | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no

tests/sudocmd/test_sudocmd.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Test sudocmd
-  hosts: ipaserver
+  hosts: "{{ ipa_test_host | default('ipaserver') }}"
   become: true
   gather_facts: false
 
@@ -9,6 +9,7 @@
   - name: Ensure sudocmds are absent
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/bin/su
       - /usr/sbin/ifconfig
@@ -18,6 +19,7 @@
   - name: Ensure sudocmd is present
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: /usr/bin/su
       state: present
     register: result
@@ -26,6 +28,7 @@
   - name: Ensure sudocmd is present again
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: /usr/bin/su
       state: present
     register: result
@@ -34,6 +37,7 @@
   - name: Ensure sudocmd is absent
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: /usr/bin/su
       state: absent
     register: result
@@ -42,6 +46,7 @@
   - name: Ensure sudocmd is absent again
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: /usr/bin/su
       state: absent
     register: result
@@ -50,6 +55,7 @@
   - name: Ensure multiple sudocmd are present
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/ifconfig
       - /usr/sbin/iwlist
@@ -60,6 +66,7 @@
   - name: Ensure multiple sudocmd are present again
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/ifconfig
       - /usr/sbin/iwlist
@@ -70,6 +77,7 @@
   - name: Ensure multiple sudocmd are absent
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/ifconfig
       - /usr/sbin/iwlist
@@ -80,6 +88,7 @@
   - name: Ensure multiple sudocmd are absent again
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/ifconfig
       - /usr/sbin/iwlist
@@ -90,6 +99,7 @@
   - name: Ensure sudocmds are absent
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/bin/su
       - /usr/sbin/ifconfig
@@ -99,6 +109,7 @@
   - name: Ensure sudocmds are absent
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/ifconfig
       state: absent
@@ -106,6 +117,7 @@
   - name: Ensure sudocmds are present
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/iwlist
       state: present
@@ -113,6 +125,7 @@
   - name: Ensure multiple sudocmd are absent when only one was present
     ipasudocmd:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name:
       - /usr/sbin/ifconfig
       - /usr/sbin/iwlist

tests/sudocmd/test_sudocmd_client_context.yml

@@ -0,0 +1,37 @@
+---
+- name: Test sudocmd
+  hosts: ipaclients, ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+  - name: Include FreeIPA facts.
+    include_tasks: ../env_freeipa_facts.yml
+
+  # Test will only be executed if host is not a server.
+  - name: Execute with server context in the client.
+    ipasudocmd:
+      ipaadmin_password: SomeADMINpassword
+      ipaapi_context: server
+      name: ThisShouldNotWork
+    register: result
+    failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
+    when: ipa_host_is_client
+
+# Import basic module tests, and execute with ipa_context set to 'client'.
+# If ipaclients is set, it will be executed using the client, if not,
+# ipaserver will be used.
+#
+# With this setup, tests can be executed against an IPA client, against
+# an IPA server using "client" context, and ensure that tests are executed
+# in upstream CI.
+
+- name: Test sudocmd using client context, in client host.
+  import_playbook: test_sudocmd.yml
+  when: groups['ipaclients']
+  vars:
+    ipa_test_host: ipaclients
+
+- name: Test sudocmd using client context, in server host.
+  import_playbook: test_sudocmd.yml
+  when: groups['ipaclients'] is not defined or not groups['ipaclients']