ipadelegation: Allow execution of plugin in client host.

Update delegation README file and add tests for executing plugin with
`ipaapi_context` set to `client`.

A new test playbook can be found at:

    tests/delegation/test_delegation_client_context.yml

The new test file can be executed in a FreeIPA client host that is
not a server. In this case, it should be defined in the `ipaclients`
group, in the inventory file.

README-delegation.md

@@ -142,6 +142,7 @@ Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
+`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
 `name` \| `aciname` | The list of delegation name strings. | yes
 `permission` \| `permissions` |  The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no
 `attribute` \| `attrs` | The attribute list to which the delegation applies. | no

tests/delegation/test_delegation.yml

@@ -1,6 +1,6 @@
 ---
 - name: Test delegation
-  hosts: ipaserver
+  hosts: "{{ ipa_test_host | default('ipaserver') }}"
   become: true
 
   tasks:
@@ -10,12 +10,14 @@
   - name: Ensure test groups are absent
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: managers,managers2,employees,employees2
       state: absent
 
   - name: Ensure delegation "basic manager attributes" is absent
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       state: absent
 
@@ -24,21 +26,25 @@
   - name: Ensure test group managers is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: managers
 
   - name: Ensure test group managers2 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: managers2
 
   - name: Ensure test group employees is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: employees
 
   - name: Ensure test group employees2 is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: employees2
 
   # TESTS
@@ -46,6 +52,7 @@
   - name: Ensure delegation "basic manager attributes" is present
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read
       attribute:
@@ -58,6 +65,7 @@
   - name: Ensure delegation "basic manager attributes" is present again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read
       attribute:
@@ -70,6 +78,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different attribute employeetype
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read
       attribute:
@@ -82,6 +91,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different attribute employeetype again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read
       attribute:
@@ -94,6 +104,7 @@
   - name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - departmentnumber
@@ -104,6 +115,7 @@
   - name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - departmentnumber
@@ -114,6 +126,7 @@
   - name: Ensure delegation "basic manager attributes" member attributes employeetype and employeenumber are present
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - employeetype
@@ -125,6 +138,7 @@
   - name: Ensure delegation "basic manager attributes" member attributes employeetype and employeenumber are present again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - employeetype
@@ -136,6 +150,7 @@
   - name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - employeenumber
@@ -148,6 +163,7 @@
   - name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - employeenumber
@@ -162,6 +178,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different read,write permission
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read,write
       attribute:
@@ -174,6 +191,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different read,write permission again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read,write
       attribute:
@@ -186,6 +204,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different group managers2
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       group: managers2
     register: result
@@ -194,6 +213,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different group managers2 again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       group: managers2
     register: result
@@ -202,6 +222,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different membergroup employees2
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       membergroup: employees2
     register: result
@@ -210,6 +231,7 @@
   - name: Ensure delegation "basic manager attributes" is present with different membergroup employees2 again
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       membergroup: employees2
     register: result
@@ -218,6 +240,7 @@
   - name: Ensure delegation "basic manager attributes" fails with bad permission read,read
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read,read
     register: result
@@ -226,6 +249,7 @@
   - name: Ensure delegation "basic manager attributes" fails with bad permission read,write,write
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       permission: read,write,write
     register: result
@@ -234,6 +258,7 @@
   - name: Ensure delegation "basic manager attributes" fails with bad attribute businesscategory,businesscategory
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       attribute:
       - businesscategory
@@ -246,11 +271,13 @@
   - name: Ensure delegation "basic manager attributes" is absent
     ipadelegation:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: "basic manager attributes"
       state: absent
 
   - name: Ensure test groups are absent
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: managers,managers2,employees,employees2
       state: absent

tests/delegation/test_delegation_client_context.yml

@@ -0,0 +1,37 @@
+---
+- name: Test delegation
+  hosts: ipaclients, ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+  - name: Include FreeIPA facts.
+    include_tasks: ../env_freeipa_facts.yml
+
+  # Test will only be executed if host is not a server.
+  - name: Execute with server context in the client.
+    ipadelegation:
+      ipaadmin_password: SomeADMINpassword
+      ipaapi_context: server
+      name: ThisShouldNotWork
+    register: result
+    failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
+    when: ipa_host_is_client
+
+# Import basic module tests, and execute with ipa_context set to 'client'.
+# If ipaclients is set, it will be executed using the client, if not,
+# ipaserver will be used.
+#
+# With this setup, tests can be executed against an IPA client, against
+# an IPA server using "client" context, and ensure that tests are executed
+# in upstream CI.
+
+- name: Test delegation using client context, in client host.
+  import_playbook: test_delegation.yml
+  when: groups['ipaclients']
+  vars:
+    ipa_test_host: ipaclients
+
+- name: Test delegation using client context, in server host.
+  import_playbook: test_delegation.yml
+  when: groups['ipaclients'] is not defined or not groups['ipaclients']