ipagroup: Fix management of AD objects

When using AD objects, a user expects to use the more human readable
form, like "user@ad.domain", but this impose some dificulties on
evaluating which object is being referenced as AD has several forms to
refer to the same object.

Each object is AD is identified uniquely by its SID, and this is the
identifier that IPA stores in its database. When managing AD objects,
IPA finds its SID and works with that value.

ansible-freeipa tried to process these objects using the human readable
values, and it cause idempontence error when ensuring the values were
present or modified, and, at least in some cases, prevented the objects
to be made absent, as the object list created didn't match the SID to
the value used as module parameter.

By using SID to process the AD objects in ipagroup, the addition or
removal of members works and idempotence of these members is ensured.

The only issue with thils approach is that it only works no server
nodes. In client nodes, the conversion to SID is not available and the
same issues that existed before will still be present.

Tests were updated to reflect these changes, a new test, specific to
idempotence issues of AD objects was added:

   tests/group/test_group_ad_users.yml

Resolves: https://issues.redhat.com/browse/RHEL-70023

tests/group/test_group_idoverrideuser.yml

@@ -1,12 +1,17 @@
 ---
-- name: Test group
+- name: Test group idoverrideuser
   hosts: ipaserver
-  become: yes
-  gather_facts: yes
+  become: false
+  gather_facts: false
+  module_defaults:
+    ipagroup:
+      ipaadmin_password: SomeADMINpassword
+    ipaidoverrideuser:
+      ipaadmin_password: SomeADMINpassword
 
   vars:
-      ad_user: "{{ test_ad_user | default('AD\\aduser') }}"
-      ad_domain: "{{ test_ad_domain | default('ad.ipa.test') }}"
+    ad_user: "{{ test_ad_user | default('AD\\aduser') }}"
+    alt_user: "{{ test_alt_user | default('aduser@ad.ipa.test') }}"
 
   tasks:
     - name: Include tasks ../env_freeipa_facts.yml
@@ -15,38 +20,42 @@
     - name: Execute tests if ipa_verison >= 4.8.7 and trust test environment is supported
       when: ipa_version is version("4.8.7", ">=") and trust_test_is_supported | default(false)
       block:
-      - name: Create idoverrideuser.
-        ansible.builtin.shell: |
-          kinit -c idoverride_cache admin <<< SomeADMINpassword
-          ipa idoverrideuser-add "Default Trust View" {{ ad_user }}
-          kdestroy -A -q -c idoverride_cache
+      - name: Ensure test idoverrideuser is present
+        ipaidoverrideuser:
+          idview: "Default Trust View"
+          anchor: "{{ ad_user }}"
+        register: result
+        failed_when: result.failed and "no modifications to be performed" not in result.msg
 
-      - name: Remove testing groups.
+      - name: Ensure test groups are absent
         ipagroup:
-          ipaadmin_password: SomeADMINpassword
           name:
-          - idovergroup
+            - idovergroup
           state: absent
 
-      - name: Add group with idoverrideuser.
+      - name: Ensure group with idoverrideuser is present.
         ipagroup:
-          ipaadmin_password: SomeADMINpassword
           name: idovergroup
           idoverrideuser: "{{ ad_user }}"
         register: result
         failed_when: result.failed or not result.changed
 
-      - name: Add group with idoverrideuser, again.
+      - name: Ensure group with idoverrideuser is present, again.
         ipagroup:
-          ipaadmin_password: SomeADMINpassword
           name: idovergroup
           idoverrideuser: "{{ ad_user }}"
         register: result
         failed_when: result.failed or result.changed
 
-      - name: Remove idoverrideuser member.
+      - name: Ensure group with alternative idoverrideuser is present.
+        ipagroup:
+          name: idovergroup
+          idoverrideuser: "{{ alt_user }}"
+        register: result
+        failed_when: result.failed or result.changed
+
+      - name: Ensure idoverrideuser member is absent.
         ipagroup:
-          ipaadmin_password: SomeADMINpassword
           name: idovergroup
           idoverrideuser: "{{ ad_user }}"
           action: member
@@ -54,9 +63,8 @@
         register: result
         failed_when: result.failed or not result.changed
 
-      - name: Remove idoverrideuser member, again.
+      - name: Ensure idoverrideuser member is absent, again.
         ipagroup:
-          ipaadmin_password: SomeADMINpassword
           name: idovergroup
           idoverrideuser: "{{ ad_user }}"
           action: member
@@ -64,7 +72,7 @@
         register: result
         failed_when: result.failed or result.changed
 
-      - name: Add idoverrideuser member.
+      - name: Ensure idoverrideuser member is present.
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: idovergroup
@@ -73,7 +81,7 @@
         register: result
         failed_when: result.failed or not result.changed
 
-      - name: Add idoverrideuser member, again.
+      - name: Ensure idoverrideuser member is present, again.
         ipagroup:
           ipaadmin_password: SomeADMINpassword
           name: idovergroup
@@ -82,24 +90,17 @@
         register: result
         failed_when: result.failed or result.changed
 
-      - name: Cleanup idoverrideuser member.
-        ipagroup:
-          ipaadmin_password: SomeADMINpassword
-          name: idovergroup
-          idoverrideuser: "{{ ad_user }}"
-          state: absent
-
-      - name: Remove testing groups.
-        ipagroup:
-          ipaadmin_password: SomeADMINpassword
-          name:
-          - idovergroup
-          state: absent
-
       always:
+      - name: Remove testing groups.
+        ipagroup:
+          ipaadmin_password: SomeADMINpassword
+          name:
+          - idovergroup
+          state: absent
+
       - name: Remove idoverrideuser.
-        ansible.builtin.shell:
-          cmd: |
-            kinit -c idoverride_cache admin <<< SomeADMINpassword
-            ipa idoverrideuser-del "Default Trust View" {{ ad_user }}
-            kdestroy -A -q -c idoverride_cache
+        ipaidoverrideuser:
+          idview: "Default Trust View"
+          anchor: "{{ ad_user }}"
+          continue: true
+          state: absent