New idrange management module

There is a new idrange management module placed in the plugins folder:

    plugins/modules/ipaidrange.py

The idrange module allows to ensure presence and absence of idranges.

Here is the documentation of the module:

    README-idrange.md

New example playbooks have been added:

    playbooks/idrange/idrange-absent.yml
    playbooks/idrange/idrange-ad-posix-present.yml
    playbooks/idrange/idrange-ad-present.yml
    playbooks/idrange/idrange-present.yml

New tests for the module can be found at:

    tests/idrange/test_idrange.yml
    tests/idrange/test_idrange_client_context.yml

tests/idrange/tasks_remove_trust.yml

@@ -0,0 +1,24 @@
+---
+- name: Ensure testing trust is absent
+  ipatrust:
+    ipaadmin_password: SomeADMINpassword
+    ipaapi_context: "{{ ipa_context | default(omit) }}"
+    realm: "{{ adserver.domain }}"
+    state: absent
+
+- name: Ensure testing idranges are absent
+  ipaidrange:
+    ipaadmin_password: SomeADMINpassword
+    ipaapi_context: "{{ ipa_context | default(omit) }}"
+    name:
+      - "{{ adserver.realm }}_id_range"
+    continue: yes
+    state: absent
+
+- name: Remove dns forward zone
+  ipadnsforwardzone:
+    ipaadmin_password: SomeADMINpassword
+    ipaapi_context: "{{ ipa_context | default(omit) }}"
+    name: "{{ adserver.domain }}"
+    state: absent
+  when: trust_dnszone is defined and trust_dnszone.changed

tests/idrange/tasks_set_trust.yml

@@ -0,0 +1,36 @@
+---
+- name: Ensure DNS forward zone to Windows AD
+  ipadnsforwardzone:
+    ipaadmin_password: SomeADMINpassword
+    ipaapi_context: "{{ ipa_context | default(omit) }}"
+    name: "{{ adserver.domain }}"
+    forwarders:
+      - ip_address: "{{ adserver.ip_address }}"
+    forwardpolicy: first
+  register: trust_dnszone
+
+- name: Set trust to Widows AD
+  ipatrust:
+    ipaadmin_password: SomeADMINpassword
+    ipaapi_context: "{{ ipa_context | default(omit) }}"
+    realm: "{{ adserver.domain }}"
+    admin: Administrator
+    password: "{{ adserver.password }}"
+    base_id: "{{ trust_base_id | default(omit) }}"
+    range_type: "{{ trust_range_type | default(omit) }}"
+    range_size: "{{ trust_range_size | default(omit) }}"
+  register: result
+  failed_when: result.failed
+
+- name: Retrieve Domain Security Identifier
+  shell:
+    cmd: |
+      kinit -c test_krb5_cache admin <<< SomeADMINpassword > /dev/null
+      KRB5CCNAME=test_krb5_cache ipa trust-show {{ adserver.domain }} | sed -n "/Domain Security Identifier/s/ //gp" | cut -d":" -f2
+      kdestroy -c test_krb5_cache -A -q > /dev/null
+  register: getsid
+  no_log: yes
+
+- name: Set ipa_domain_sid.
+  set_fact:
+    ipa_domain_sid: "{{ getsid.stdout }}"

tests/idrange/test_idrange.yml

@@ -0,0 +1,280 @@
+---
+- name: Test idrange
+  hosts: "{{ ipa_test_host | default('ipaserver') }}"
+  become: no
+  gather_facts: no
+
+  vars:
+    adserver:
+      domain: "{{ winserver_domain | default('windows.local')}}"
+      realm: "{{ winserver_realm | default(winserver_domain) | default('windows.local') | upper }}"
+      password: "{{ winserver_admin_password | default('SomeW1Npassword') }}"
+      ip_address: "{{ winserver_ip | default(omit) }}"
+
+  tasks:
+  # CLEANUP TEST ITEMS
+  - name: Remove test trust.
+    include_tasks: tasks_remove_trust.yml
+    when: trust_test_is_supported | default(false)
+
+  - name: Ensure testing idranges are absent
+    ipaidrange:
+      ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
+      name:
+        - "{{ adserver.realm }}_id_range"
+        - local_id_range
+        - ad_id_range
+        - ad_posix_id_range
+      continue: yes
+      state: absent
+
+  # CREATE TEST ITEMS
+
+  # TESTS
+
+  # Test local idrange, only if ipa-adtrust-install was not executed.
+  - block:
+      - name: Ensure idrange with minimal attributes is present
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          base_id: 150000000
+          range_size: 200000
+        register: result
+        failed_when:
+          not (result.failed or result.changed) or (result.failed and 'ipa-adtrust-install has already been run' not in result.msg)
+
+      - name: Ensure idrange with minimal attributes is present, again
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          base_id: 150000000
+          range_size: 200000
+        register: result
+        failed_when:
+          result.changed or (result.failed and 'ipa-adtrust-install has already been run' not in result.msg)
+
+      - name: Ensure idrange with minimal attributes is absent
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          state: absent
+        register: range_delete
+        failed_when: range_delete.failed or (result.changed and not range_delete.changed)
+
+      # Test local idrange, even after ipa-adtrust-install.
+      - name: Ensure local idrange is present
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          base_id: 150000000
+          range_size: 200000
+          rid_base: 1000000
+          secondary_rid_base: 200000000
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Ensure local idrange is present again
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          base_id: 150000000
+          range_size: 200000
+          rid_base: 1000000
+          secondary_rid_base: 200000000
+        register: result
+        failed_when: result.changed or result.failed
+
+      - name: Ensure local idrange is absent
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          state: absent
+          continue: no
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Ensure local idrange is absent again
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+          state: absent
+          continue: no
+        register: result
+        failed_when: result.changed or result.failed
+
+    rescue:
+      - name: Ensure local idranges is absent
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: local_id_range
+
+  - block:
+      # Create trust with range_type: ipa-ad-trust-posix
+      - name: Create trust with range_type 'ipa-ad-trust'
+        include_tasks: tasks_set_trust.yml
+        vars:
+          trust_base_id: 10000000
+          trust_range_size: 200000
+          trust_range_type: ipa-ad-trust
+
+      # Can't user secondary_rid_base with dom_sid/dom_name
+      - name: Ensure AD-trust idrange is present
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          base_id: 150000000
+          range_size: 200000
+          rid_base: 1000000
+          idrange_type: ipa-ad-trust
+          dom_sid: "{{ ipa_domain_sid }}"
+          auto_private_groups: "false"
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Ensure AD-trust idrange is present again
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          base_id: 150000000
+          range_size: 200000
+          rid_base: 1000000
+          idrange_type: ipa-ad-trust
+          dom_sid: "{{ ipa_domain_sid }}"
+          auto_private_groups: "false"
+        register: result
+        failed_when: result.changed or result.failed
+
+      - name: Check if AD-trust idrange is present, uning domain name
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          base_id: 150000000
+          range_size: 200000
+          rid_base: 1000000
+          idrange_type: ipa-ad-trust
+          dom_name: "{{ adserver.domain }}"
+          auto_private_groups: "false"
+        check_mode: true
+        register: result
+        failed_when: result.changed or result.failed
+
+      - name: Modify AD-trust idrange 'base_id'
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          base_id: 151230000
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Modify AD-trust idrange 'base_id', again
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          base_id: 151230000
+        register: result
+        failed_when: result.changed or result.failed
+
+      - name: Modify AD-trust idrange 'range_size'
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          range_size: 100000
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Modify AD-trust idrange 'rid_base'
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          rid_base: 12345678
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Modify AD-trust idrange 'auto_private_groups'
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          auto_private_groups: "hybrid"
+        register: result
+        failed_when: not result.changed or result.failed
+
+      # Remove trust and idrange
+      - name: Remove test trust.
+        include_tasks: tasks_remove_trust.yml
+
+      - name: Ensure AD-trust idrange is absent
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_id_range
+          state: absent
+
+      # Create trust with range_type: ipa-ad-trust-posix
+      - name: Create trust with range_type 'ipa-ad-trust-posix'
+        include_tasks: tasks_set_trust.yml
+        vars:
+          trust_base_id: 10000000
+          trust_range_size: 2000000
+          trust_range_type: ipa-ad-trust-posix
+
+      # Can't user secondary_rid_base or rid_base with "ad-trust-posix"
+      - name: Ensure AD-trust-posix idrange is present
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_posix_id_range
+          base_id: 150000000
+          range_size: 200000
+          idrange_type: ipa-ad-trust-posix
+          dom_sid: "{{ ipa_domain_sid }}"
+        register: result
+        failed_when: not result.changed or result.failed
+
+      - name: Ensure AD-trust-posix idrange is present again
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name: ad_posix_id_range
+          base_id: 150000000
+          range_size: 200000
+          idrange_type: ipa-ad-trust-posix
+          dom_sid: "{{ ipa_domain_sid }}"
+        register: result
+        failed_when: result.changed or result.failed
+
+    always:
+      # CLEANUP TEST ITEMS
+      - name: Remove test trust.
+        include_tasks: tasks_remove_trust.yml
+
+      - name: Ensure testing idranges are absent
+        ipaidrange:
+          ipaadmin_password: SomeADMINpassword
+          ipaapi_context: "{{ ipa_context | default(omit) }}"
+          name:
+            - "{{ adserver.realm }}_id_range"
+            - local_id_range
+            - ad_id_range
+            - ad_posix_id_range
+          continue: yes
+          state: absent
+
+    when: trust_test_is_supported | default(false)

tests/idrange/test_idrange_client_context.yml

@@ -0,0 +1,39 @@
+---
+- name: Test idrange
+  hosts: ipaclients, ipaserver
+  # Change "become" or "gather_facts" to "yes",
+  # if you test playbook requires any.
+  become: no
+  gather_facts: no
+
+  tasks:
+  - name: Include FreeIPA facts.
+    include_tasks: ../env_freeipa_facts.yml
+
+  # Test will only be executed if host is not a server.
+  - name: Execute with server context in the client.
+    ipaidrange:
+      ipaadmin_password: SomeADMINpassword
+      ipaapi_context: server
+      name: ThisShouldNotWork
+    register: result
+    failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
+    when: ipa_host_is_client
+
+# Import basic module tests, and execute with ipa_context set to 'client'.
+# If ipaclients is set, it will be executed using the client, if not,
+# ipaserver will be used.
+#
+# With this setup, tests can be executed against an IPA client, against
+# an IPA server using "client" context, and ensure that tests are executed
+# in upstream CI.
+
+- name: Test idrange using client context, in client host.
+  import_playbook: test_idrange.yml
+  when: groups['ipaclients']
+  vars:
+    ipa_test_host: ipaclients
+
+- name: Test idrange using client context, in server host.
+  import_playbook: test_idrange.yml
+  when: groups['ipaclients'] is not defined or not groups['ipaclients']