New netgroup management module

There is a new netgroup management module placed in the plugins folder:

    plugins/modules/ipanetgroup.py

The netgroup module allows to ensure presence or absence of netgroup
and manage netgroup members.

Here is the documentation for the module:

    README-netgroup.md

New example playbooks have been added:

    playbooks/netgroup/netgroup-absent.yml
    playbooks/netgroup/netgroup-member-absent.yml
    playbooks/netgroup/netgroup-member-present.yml
    playbooks/netgroup/netgroup-present.yml

New tests for the module:

    tests/netgroup/test_netgroup.yml
    tests/netgroup/test_netgroup_client_context.yml
    tests/netgroup/test_netgroup_member.yml
    tests/netgroup/test_netgroup_member_absent.yml
    tests/netgroup/test_netgroup_member_case_insensitive.yml

Signed-off-by: Denis Karpelevich <dkarpele@redhat.com>
This commit is contained in:
Denis Karpelevich
2022-08-10 23:18:47 +02:00
parent 6e44b4d034
commit 495677df38
12 changed files with 1471 additions and 0 deletions

View File

@@ -0,0 +1,149 @@
---
- name: Test netgroup
hosts: "{{ ipa_test_host | default('ipaserver') }}"
become: no
gather_facts: no
tasks:
- block:
# CLEANUP TEST ITEMS
- name: Ensure netgroups are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- my_netgroup1
- my_netgroup2
- my_netgroup3
state: absent
# CREATE TEST ITEMS
- name: Get Domain from server name
set_fact:
ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
when: ipaserver_domain is not defined
- name: Ensure netgroup my_netgroup2 is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup2
- name: Ensure netgroup my_netgroup3 is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup3
# TESTS
- name: Ensure netgroup my_netgroup1 is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
register: result
failed_when: not result.changed or result.failed
- name: Ensure netgroup my_netgroup1 is present again
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
register: result
failed_when: result.changed or result.failed
- name: Ensure netgroup my_netgroup1 is present with description and
nisdomain
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
description: My netgroup 1
nisdomain: domain.test
register: result
failed_when: not result.changed or result.failed
- name: Ensure netgroup my_netgroup1 is present with new description
and new nisdomain
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
description: New description
nisdomain: new-domain.test
register: result
failed_when: not result.changed or result.failed
- name: Ensure netgroup my_netgroup1 is present with description and
nisdomain again
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
description: New description
nisdomain: new-domain.test
register: result
failed_when: result.changed or result.failed
- name: Ensure 2 netgroups aren't present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- my_netgroup1
- my_netgroup2
register: result
failed_when: result.changed or not result.failed or
"Only one netgroup can be added at a time." not in result.msg
- name: Ensure netgroup my_netgroup1 is absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
state: absent
register: result
failed_when: not result.changed or result.failed
- name: Ensure netgroup my_netgroup1 is absent again
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup1
state: absent
register: result
failed_when: result.changed or result.failed
# netgroup and hostgroup with the same name are deprecated
- name: Ensure hostgroup my_netgroup2 isn't present
ipahostgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: my_netgroup2
register: result
failed_when: result.changed or not result.failed or
"Hostgroups and netgroups share a common namespace" not in result.msg
- name: Ensure netgroups my_netgroup2, my_netgroup3 are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- my_netgroup2
- my_netgroup3
state: absent
register: result
failed_when: not result.changed
always:
# cleanup
- name: Ensure netgroups are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- my_netgroup1
- my_netgroup2
- my_netgroup3
state: absent

View File

@@ -0,0 +1,51 @@
---
- name: Test netgroup
hosts: ipaclients, ipaserver
become: no
gather_facts: no
tasks:
- name: Include FreeIPA facts.
include_tasks: ../env_freeipa_facts.yml
# Test will only be executed if host is not a server.
- name: Execute with server context in the client.
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: server
name: ThisShouldNotWork
register: result
failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
when: ipa_host_is_client
# Import basic module tests, and execute with ipa_context set to 'client'.
# If ipaclients is set, it will be executed using the client, if not,
# ipaserver will be used.
#
# With this setup, tests can be executed against an IPA client, against
# an IPA server using "client" context, and ensure that tests are executed
# in upstream CI.
- name: Test netgroup using client context, in client host.
import_playbook: test_netgroup.yml
when: groups['ipaclients']
vars:
ipa_test_host: ipaclients
- name: Test netgroup using client context, in server host.
import_playbook: test_netgroup.yml
when: groups['ipaclients'] is not defined or not groups['ipaclients']
vars:
ipa_context: client
- name: Test netgroup with member using client context, in client host.
import_playbook: test_netgroup_member.yml
when: groups['ipaclients']
vars:
ipa_test_host: ipaclients
- name: Test netgroup with member using client context, in server host.
import_playbook: test_netgroup_member.yml
when: groups['ipaclients'] is not defined or not groups['ipaclients']
vars:
ipa_context: client

View File

@@ -0,0 +1,159 @@
---
- name: Netgroup member test
hosts: "{{ ipa_test_host | default('ipaserver') }}"
become: no
gather_facts: no
tasks:
- block:
- name: Get Domain from server name
set_fact:
ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
when: ipaserver_domain is not defined
- name: Set host1_fqdn .. host2_fqdn
set_fact:
host1_fqdn: "{{ 'host1.' + ipaserver_domain }}"
host2_fqdn: "{{ 'host2.' + ipaserver_domain }}"
# CLEANUP TEST ITEMS
- name: Ensure users user1, user2 are absent
ipauser:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: user1,user2
state: absent
- name: Ensure group group1 is absent
ipagroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: group1
state: absent
- name: Ensure hosts are absent
ipahost:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
state: absent
- name: Ensure netgroups TestNetgroup1, admins are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- TestNetgroup1,admins
state: absent
# CREATE TEST ITEMS
- name: Ensure users user1, user2 are present
ipauser:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
users:
- name: user1
first: first1
last: last1
- name: user2
first: first2
last: last2
- name: Ensure groups group1 are present
ipagroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: group1
- name: Ensure hosts "{{ 'host[1..2].' + ipaserver_domain }}" are present
ipahost:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
hosts:
- name: "{{ host1_fqdn }}"
force: yes
- name: "{{ host2_fqdn }}"
force: yes
- name: Ensure netgroup admins is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: admins
# TEST
- name: Ensure netgroup TestNetgroup1 is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
action: netgroup
description: Description for TestNetgroup1
nisdomain: "{{ ipaserver_domain }}"
register: result
failed_when: not result.changed or result.failed
- name: Ensure netgroup is present with members
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
user: user1,user2
group: group1
host: "{{ host1_fqdn }}"
hostgroup: ipaservers
netgroup: admins
action: member
register: result
failed_when: not result.changed or result.failed
- name: Ensure netgroup is present with members again (idempotence check)
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
user: user1,user2
group: group1
host:
- "{{ host1_fqdn }}"
- host1
hostgroup: ipaservers
netgroup: admins
action: member
register: result
failed_when: result.changed or result.failed
always:
# CLEANUP TEST ITEMS
- name: Ensure users user1, user2 are absent
ipauser:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: user1,user2
state: absent
- name: Ensure group group1 is absent
ipagroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: group1
state: absent
- name: Ensure hosts are absent
ipahost:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
state: absent
- name: Ensure netgroups TestNetgroup1, admins are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- TestNetgroup1,admins
state: absent

View File

@@ -0,0 +1,206 @@
---
- name: Netgroup member absent test
hosts: "{{ ipa_test_host | default('ipaserver') }}"
become: no
gather_facts: no
tasks:
- block:
- name: Get Domain from server name
set_fact:
ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
when: ipaserver_domain is not defined
- name: Set host1_fqdn .. host2_fqdn
set_fact:
host1_fqdn: "{{ 'host1.' + ipaserver_domain }}"
host2_fqdn: "{{ 'host2.' + ipaserver_domain }}"
# CLEANUP TEST ITEMS
- name: Ensure users user1, user2 are absent
ipauser:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: user1,user2
state: absent
- name: Ensure group group1 is absent
ipagroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: group1
state: absent
- name: Ensure hosts are absent
ipahost:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
state: absent
- name: Ensure netgroups TestNetgroup1, admins are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- TestNetgroup1,admins
state: absent
# CREATE TEST ITEMS
- name: Ensure users user1, user2 are present
ipauser:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
users:
- name: user1
first: first1
last: last1
- name: user2
first: first2
last: last2
- name: Ensure group group1 is present
ipagroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: group1
- name: Ensure hosts "{{ 'host[1..2].' + ipaserver_domain }}" are present
ipahost:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
hosts:
- name: "{{ host1_fqdn }}"
force: yes
- name: "{{ host2_fqdn }}"
force: yes
- name: Ensure netgroup admins is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: admins
- name: Ensure netgroup TestNetgroup1 is present
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
description: Description for TestNetgroup1
nisdomain: "{{ ipaserver_domain }}"
- name: Ensure netgroup is present with members
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
user: user1,user2
group: group1
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
hostgroup: ipaservers
netgroup: admins
action: member
# TEST
- name: Ensure members are absent in netgroup
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
user: user1
group: group1
host:
- "{{ host1_fqdn }}"
- host1
hostgroup: ipaservers
netgroup: admins
action: member
state: absent
register: result
failed_when: not result.changed or result.failed
- name: Ensure some members are still present in netgroup
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
user: user2
host:
- "{{ host2_fqdn }}"
action: member
register: result
failed_when: result.changed or result.failed
- name: Ensure host was removed by hostname from netgroup
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
host:
- host2
action: member
state: absent
register: result
failed_when: not result.changed or result.failed
- name: Ensure member user2 presents in netgroup
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: TestNetgroup1
user: user2
action: member
register: result
failed_when: result.changed or result.failed
- name: Ensure members from netgroups my_netgroup1,my_netgroup2 aren't
absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- my_netgroup1
- my_netgroup2
state: absent
action: member
register: result
failed_when: result.changed or not result.failed or
"Members can be removed only from one netgroup at a time." not in
result.msg
always:
# CLEANUP TEST ITEMS
- name: Ensure users user1, user2 are absent
ipauser:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: user1,user2
state: absent
- name: Ensure group group1 is absent
ipagroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name: group1
state: absent
- name: Ensure hosts are absent
ipahost:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
state: absent
- name: Ensure netgroups TestNetgroup1, admins are absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
ipaapi_context: "{{ ipa_context | default(omit) }}"
name:
- TestNetgroup1,admins
state: absent

View File

@@ -0,0 +1,251 @@
---
- name: Test netgroup members should be case insensitive.
hosts: "{{ ipa_test_host | default('ipaserver') }}"
become: no
gather_facts: no
vars:
groups_present:
- eleMENT1
- Element2
- eLeMenT3
- ElemENT4
tasks:
- block:
# SETUP
- name: Get Domain from server name
set_fact:
ipaserver_domain: "{{ ansible_facts['fqdn'].split('.')[1:] | join ('.') }}"
when: ipaserver_domain is not defined
- name: Ensure test groups exist.
ipagroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
loop: "{{ groups_present }}"
- name: Ensure test hostgroups exist.
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name: "hostgroup{{ item }}"
loop: "{{ groups_present }}"
- name: Ensure test netgroups exist.
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "netgroup{{ item }}"
loop: "{{ groups_present }}"
- name: Ensure test hosts exist.
ipahost:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}.{{ ipaserver_domain }}"
force: yes
loop: "{{ groups_present }}"
- name: Ensure test users exist.
ipauser:
ipaadmin_password: SomeADMINpassword
name: "user{{ item }}"
first: "{{ item }}"
last: "{{ item }}"
loop: "{{ groups_present }}"
- name: Ensure netgroups don't exist
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
loop: "{{ groups_present }}"
# TESTS
- name: Start tests.
debug:
msg: "Tests are starting."
- name: Ensure netgroups exist
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or not result.changed
- name: Ensure netgroups exist with members
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item }}"
host: "{{ item }}.{{ ipaserver_domain }}"
group: "{{ item }}"
user: "user{{ item }}"
netgroup: "netgroup{{ item }}"
action: member
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or not result.changed
- name: Ensure netgroups exist with members, lowercase
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item | lower }}"
host: "{{ item | lower }}.{{ ipaserver_domain }}"
group: "{{ item | lower }}"
user: "user{{ item | lower }}"
netgroup: "netgroup{{ item | lower }}"
action: member
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or result.changed
- name: Ensure netgroups exist with members, uppercase
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item | upper }}"
host: "{{ item | upper }}.{{ ipaserver_domain }}"
group: "{{ item | upper }}"
user: "user{{ item | upper }}"
netgroup: "netgroup{{ item | upper }}"
action: member
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or result.changed
- name: Ensure netgroup member is absent
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item }}"
host: "{{ item }}.{{ ipaserver_domain }}"
group: "{{ item }}"
user: "user{{ item }}"
netgroup: "netgroup{{ item }}"
action: member
state: absent
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or not result.changed
- name: Ensure netgroup member is absent, lowercase
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item | lower }}"
host: "{{ item | lower }}.{{ ipaserver_domain }}"
group: "{{ item | lower }}"
user: "user{{ item | lower }}"
netgroup: "netgroup{{ item | lower }}"
action: member
state: absent
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or result.changed
- name: Ensure netgroup member is absent, uppercase
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item | upper }}"
host: "{{ item | upper }}.{{ ipaserver_domain }}"
group: "{{ item | upper }}"
user: "user{{ item | upper }}"
netgroup: "netgroup{{ item | upper }}"
action: member
state: absent
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or result.changed
- name: Ensure netgroup member is present, uppercase
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item | upper }}"
host: "{{ item | upper }}.{{ ipaserver_domain }}"
group: "{{ item | upper }}"
user: "user{{ item | upper }}"
netgroup: "netgroup{{ item | upper }}"
action: member
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or not result.changed
- name: Ensure netgroup member is present, lowercase
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item | lower }}"
host: "{{ item | lower }}.{{ ipaserver_domain }}"
group: "{{ item | lower }}"
user: "user{{ item | lower }}"
netgroup: "netgroup{{ item | lower }}"
action: member
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or result.changed
- name: Ensure netgroup member is present, mixed case
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
hostgroup: "hostgroup{{ item }}"
host: "{{ item }}.{{ ipaserver_domain }}"
group: "{{ item }}"
user: "user{{ item }}"
netgroup: "netgroup{{ item }}"
action: member
loop: "{{ groups_present }}"
register: result
failed_when: result.failed or result.changed
- name: End tests.
debug:
msg: "All tests executed."
always:
# cleanup
- name: Ensure netgroups do not exist
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
loop: "{{ groups_present }}"
- name: Ensure test groups do not exist.
ipagroup:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}"
state: absent
loop: "{{ groups_present }}"
- name: Ensure test hostgroups do not exist.
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name: "hostgroup{{ item }}"
state: absent
loop: "{{ groups_present }}"
- name: Ensure test netgroups do not exist.
ipanetgroup:
ipaadmin_password: SomeADMINpassword
name: "netgroup{{ item }}"
state: absent
loop: "{{ groups_present }}"
- name: Ensure test hosts do not exist.
ipahost:
ipaadmin_password: SomeADMINpassword
name: "{{ item }}.{{ ipaserver_domain }}"
state: absent
loop: "{{ groups_present }}"
- name: Ensure test users do not exist.
ipauser:
ipaadmin_password: SomeADMINpassword
name: "user{{ item }}"
state: absent
loop: "{{ groups_present }}"