internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-08-01 04:14:42 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #350 from rjeffman/tests_skip_tests_ipa_version

Browse Source 
Add FreeIPA version as Ansible facts for testing.
This commit is contained in:
Thomas Woerner
2020-08-21 17:44:16 +02:00
committed by GitHub
parent 246593d77f 9cb75cdea7
commit 9a97303cca
4 changed files with 754 additions and 591 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/env_freeipa_facts.yml Normal file
View File

@@ -0,0 +1,18 @@
# This playbook should be included with `include_tasks` as the first task
# of a test playbook that requires FreeIPA information.
#
# Available Facts:
#
# ipa_version: The installed FreeIPA version.
# ipa_api_version: The installed FreeIPA API version.
#
---
- name: Retrieving FreeIPA version.
shell:
cmd: 'ipa --version | sed -n "s/VERSION: \([^,]*\).*API_VERSION: \([^,]*\).*/\1\\n\2/p"'
register: ipa_cmd_version
- name: Set FreeIPA facts.
set_fact:
ipa_version: "{{ ipa_cmd_version.stdout_lines[0] }}"
ipa_api_version: "{{ ipa_cmd_version.stdout_lines[1] }}"

381
tests/hostgroup/test_hostgroup_membermanager.yml
View File

@@ -5,215 +5,220 @@
gather_facts: false gather_facts: false
tasks: tasks:
- name: Ensure host-group testhostgroup is absent - include_tasks: ../env_freeipa_facts.yml
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name:
- testhostgroup
state: absent
- name: Ensure user manangeruser1 and manageruser2 is absent - name: Tests requiring IPA version 4.8.4+
ipauser: block:
ipaadmin_password: SomeADMINpassword - name: Ensure host-group testhostgroup is absent
name: manageruser1,manageruser2,unknown_user ipahostgroup:
state: absent ipaadmin_password: SomeADMINpassword
name:
- testhostgroup
state: absent
- name: Ensure group managergroup1 and managergroup2 are absent - name: Ensure user manangeruser1 and manageruser2 is absent
ipagroup: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup1,managergroup2 name: manageruser1,manageruser2,unknown_user
state: absent state: absent
- name: Ensure host-group testhostgroup is present - name: Ensure group managergroup1 and managergroup2 are absent
ipahostgroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: name: managergroup1,managergroup2
- testhostgroup state: absent
- name: Ensure user manageruser1 and manageruser2 are present - name: Ensure host-group testhostgroup is present
ipauser: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
users: name:
- name: manageruser1 - testhostgroup
first: manageruser1
last: Last1
- name: manageruser2
first: manageruser2
last: Last2
register: result
failed_when: not result.changed
- name: Ensure managergroup1 is present - name: Ensure user manageruser1 and manageruser2 are present
ipagroup: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup1 users:
register: result - name: manageruser1
failed_when: not result.changed first: manageruser1
last: Last1
- name: manageruser2
first: manageruser2
last: Last2
register: result
failed_when: not result.changed
- name: Ensure managergroup2 is present - name: Ensure managergroup1 is present
ipagroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup2 name: managergroup1
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure membermanager user1 is present for testhostgroup - name: Ensure managergroup2 is present
ipahostgroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: managergroup2
membermanager_user: manageruser1 register: result
register: result failed_when: not result.changed
failed_when: not result.changed
- name: Ensure membermanager user1 is present for testhostgroup again - name: Ensure membermanager user1 is present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager group1 is present for testhostgroup - name: Ensure membermanager user1 is present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_group: managergroup1 membermanager_user: manageruser1
register: result register: result
failed_when: not result.changed failed_when: result.changed
- name: Ensure membermanager group1 is present for testhostgroup again - name: Ensure membermanager group1 is present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_group: managergroup1 membermanager_group: managergroup1
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager user2 and group2 members are present for testhostgroup - name: Ensure membermanager group1 is present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser2 membermanager_group: managergroup1
membermanager_group: managergroup2 register: result
action: member failed_when: result.changed
register: result
failed_when: not result.changed
- name: Ensure membermanager user2 and group2 members are present for testhostgroup again - name: Ensure membermanager user2 and group2 members are present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser2 membermanager_user: manageruser2
membermanager_group: managergroup2 membermanager_group: managergroup2
action: member action: member
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager user and group members are present for testhostgroup again - name: Ensure membermanager user2 and group2 members are present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1,manageruser2 membermanager_user: manageruser2
membermanager_group: managergroup1,managergroup2 membermanager_group: managergroup2
action: member action: member
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: Ensure membermanager user1 and group1 members are absent for testhostgroup - name: Ensure membermanager user and group members are present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1,manageruser2
membermanager_group: managergroup1 membermanager_group: managergroup1,managergroup2
action: member action: member
state: absent register: result
register: result failed_when: result.changed
failed_when: not result.changed
- name: Ensure membermanager user1 and group1 members are absent for testhostgroup again - name: Ensure membermanager user1 and group1 members are absent for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
membermanager_group: managergroup1 membermanager_group: managergroup1
action: member action: member
state: absent state: absent
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager user1 and group1 members are absent for testhostgroup again
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name: testhostgroup
membermanager_user: manageruser1
membermanager_group: managergroup1
action: member
state: absent
register: result
failed_when: result.changed
- name: Ensure membermanager user1 and group1 members are present for testhostgroup - name: Ensure membermanager user1 and group1 members are present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
membermanager_group: managergroup1 membermanager_group: managergroup1
action: member action: member
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure membermanager user1 and group1 members are present for testhostgroup again - name: Ensure membermanager user1 and group1 members are present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
membermanager_group: managergroup1 membermanager_group: managergroup1
action: member action: member
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: Ensure membermanager user and group members are absent for testhostgroup - name: Ensure membermanager user and group members are absent for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1,manageruser2 membermanager_user: manageruser1,manageruser2
membermanager_group: managergroup1,managergroup2 membermanager_group: managergroup1,managergroup2
action: member action: member
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure membermanager user and group members are absent for testhostgroup again - name: Ensure membermanager user and group members are absent for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1,manageruser2 membermanager_user: manageruser1,manageruser2
membermanager_group: managergroup1,managergroup2 membermanager_group: managergroup1,managergroup2
action: member action: member
state: absent state: absent
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: Ensure user manangeruser1 and manageruser2 is absent - name: Ensure user manangeruser1 and manageruser2 is absent
ipauser: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: manageruser1,manageruser2 name: manageruser1,manageruser2
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure group managergroup1 and managergroup2 are absent - name: Ensure group managergroup1 and managergroup2 are absent
ipagroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup1,managergroup2 name: managergroup1,managergroup2
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure unknown membermanager_user member failure - name: Ensure unknown membermanager_user member failure
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: unknown_user membermanager_user: unknown_user
action: member action: member
register: result register: result
failed_when: result.changed or "no such entry" not in result.msg failed_when: result.changed or "no such entry" not in result.msg
- name: Ensure host-group testhostgroup is absent - name: Ensure host-group testhostgroup is absent
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: name:
- testhostgroup - testhostgroup
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
when: ipa_version is version('4.8.4', '>=')

180
tests/hostgroup/test_hostgroup_rename.yml
View File

@@ -5,101 +5,107 @@
gather_facts: false gather_facts: false
tasks: tasks:
- name: Ensure testing host-group are absent - include_tasks: ../env_freeipa_facts.yml
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name:
- databases
- datalake
- inexistenthostgroup
state: absent
- name: Ensure host-group databases is present - name: Tests requiring IPA version 4.8.7+
ipahostgroup: block:
ipaadmin_password: SomeADMINpassword - name: Ensure testing host-group are absent
name: databases ipahostgroup:
state: present ipaadmin_password: SomeADMINpassword
register: result name:
failed_when: not result.changed - databases
- datalake
- inexistenthostgroup
state: absent
- name: Rename host-group from `databases` to `datalake` - name: Ensure host-group databases is present
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: databases
rename: datalake state: present
state: renamed register: result
register: result failed_when: not result.changed
failed_when: not result.changed
- name: Ensure host-group database was already absent - name: Rename host-group from `databases` to `datalake`
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: database name: databases
state: absent rename: datalake
register: result state: renamed
failed_when: result.changed register: result
failed_when: not result.changed
- name: Rename host-group from `databases` to `datalake`, again - name: Ensure host-group database was already absent
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: database
rename: datalake state: absent
state: renamed register: result
register: result failed_when: result.changed
failed_when: result.changed or result.failed
- name: Rename host-group with same name. - name: Rename host-group from `databases` to `datalake`, again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: datalake name: databases
rename: datalake rename: datalake
state: renamed state: renamed
register: result register: result
failed_when: result.changed failed_when: result.changed or result.failed
- name: Ensure testing hostgroups do not exist. - name: Rename host-group with same name.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: inexistenthostgroup,alsoinexistent name: datalake
state: absent rename: datalake
state: renamed
register: result
failed_when: result.changed
- name: Rename inexistent host-group to an existing one. - name: Ensure testing hostgroups do not exist.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: inexistenthostgroup name: inexistenthostgroup,alsoinexistent
rename: datalake state: absent
state: renamed
register: result
failed_when: result.changed or result.failed
- name: Rename inexistent host-group to a non-existing one. - name: Rename inexistent host-group to an existing one.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: inexistenthostgroup name: inexistenthostgroup
rename: alsoinexistent rename: datalake
state: renamed state: renamed
register: result register: result
failed_when: not result.failed or "Attribute `rename` can not be used, unless hostgroup exists." not in result.msg failed_when: result.changed or result.failed
- name: Ensure host-group databases is present - name: Rename inexistent host-group to a non-existing one.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: inexistenthostgroup
state: present rename: alsoinexistent
state: renamed
register: result
failed_when: not result.failed or "Attribute `rename` can not be used, unless hostgroup exists." not in result.msg
- name: Rename host-group to an existing one. - name: Ensure host-group databases is present
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: databases
rename: datalake state: present
state: renamed
register: result
failed_when: not result.failed or "This entry already exists" not in result.msg
- name: Ensure host-group databases and datalake are absent - name: Rename host-group to an existing one.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: name: databases
- databases rename: datalake
- datalake state: renamed
state: absent register: result
failed_when: not result.failed or "This entry already exists" not in result.msg
- name: Ensure host-group databases and datalake are absent
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name:
- databases
- datalake
state: absent
when: ipa_version is version('4.8.7', '>=')

766
tests/service/test_service_without_skip_host_check.yml
View File

@@ -4,344 +4,478 @@
become: yes become: yes
tasks: tasks:
# setup - include_tasks: ../env_freeipa_facts.yml
- name: Setup test environment
include_tasks: env_setup.yml
# tests - name: Tests requiring IPA version 4.7.0+
- name: Ensure service is present block:
ipaservice: # setup
ipaadmin_password: SomeADMINpassword - name: Get Domain from server name
name: "HTTP/{{ svc_fqdn }}" set_fact:
pac_type: ipaserver_domain: "{{ ansible_fqdn.split('.')[1:] | join ('.') }}"
- MS-PAC when: ipaserver_domain is not defined
- PAD
auth_ind: otp
force: no
requires_pre_auth: yes
ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: not result.changed
- name: Ensure service is present, again - name: Set host1, host2 and svc hosts fqdn
ipaservice: set_fact:
ipaadmin_password: SomeADMINpassword host1_fqdn: "{{ 'host1.' + ipaserver_domain }}"
name: "HTTP/{{ svc_fqdn }}" host2_fqdn: "{{ 'host2.' + ipaserver_domain }}"
pac_type: svc_fqdn: "{{ 'svc.' + ipaserver_domain }}"
- MS_PAC
- PAD
auth_ind: otp
force: no
requires_pre_auth: yes
ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: result.changed
- name: Modify service. - name: Host absent
ipaservice: ipahost:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name:
pac_type: NONE - svc.ihavenodns.info
ok_as_delegate: yes - "{{ host1_fqdn }}"
ok_to_auth_as_delegate: yes - "{{ host2_fqdn }}"
register: result - "{{ svc_fqdn }}"
failed_when: not result.changed update_dns: yes
state: absent
- name: Modify service, again. - name: Get IPv4 address prefix from server node
ipaservice: set_fact:
ipaadmin_password: SomeADMINpassword ipv4_prefix: "{{ ansible_default_ipv4.address.split('.')[:-1] |
name: "HTTP/{{ svc_fqdn }}" join('.') }}"
pac_type: NONE
ok_as_delegate: yes
ok_to_auth_as_delegate: yes
register: result
failed_when: result.changed
- name: Ensure service is present, with host not in DNS. - name: Add hosts for tests.
ipaservice: ipahost:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: HTTP/svc.ihavenodns.info hosts:
force: yes - name: "{{ host1_fqdn }}"
register: result ip_address: "{{ ipv4_prefix + '.201' }}"
failed_when: not result.changed update_dns: yes
- name: "{{ host2_fqdn }}"
ip_address: "{{ ipv4_prefix + '.202' }}"
update_dns: yes
- name: "{{ svc_fqdn }}"
ip_address: "{{ ipv4_prefix + '.203' }}"
update_dns: yes
- name: svc.ihavenodns.info
update_dns: no
force: yes
- name: Ensure service is present, with host not in DNS, again. - name: Ensure testing user user01 is present.
ipaservice: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: HTTP/svc.ihavenodns.info name: user01
force: yes first: user01
register: result last: last
failed_when: result.changed
- name: Principal host/test.example.com present in service. - name: Ensure testing user user02 is present.
ipaservice: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: user02
principal: first: user02
- host/test.example.com last: last
action: member
register: result
failed_when: not result.changed
- name: Principal host/test.exabple.com present in service, again. - name: Ensure testing group group01 is present.
ipaservice: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: group01
principal:
- host/test.example.com
action: member
register: result
failed_when: result.changed
- name: Principal host/test.example.com absent in service. - name: Ensure testing group group02 is present.
ipaservice: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: group02
principal:
- host/test.example.com
action: member
state: absent
register: result
failed_when: not result.changed
- name: Principal host/test.example.com absent in service, again. - name: Ensure testing hostgroup hostgroup01 is present.
ipaservice: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: hostgroup01
principal:
- host/test.example.com
action: member
state: absent
register: result
failed_when: result.changed
- name: Ensure host can manage service. - name: Ensure testing hostgroup hostgroup02 is present.
ipaservice: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: hostgroup02
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
action: member
register: result
failed_when: not result.changed
- name: Ensure host can manage service, again. - name: Ensure services are absent.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name:
host: "{{ host1_fqdn }}" - "HTTP/{{ svc_fqdn }}"
action: member - HTTP/svc.ihavenodns.info
register: result state: absent
failed_when: result.changed
- name: Ensure host cannot manage service. # tests
ipaservice: - name: Ensure service is present
ipaadmin_password: SomeADMINpassword ipaservice:
name: "HTTP/{{ svc_fqdn }}" ipaadmin_password: SomeADMINpassword
host: name: "HTTP/{{ svc_fqdn }}"
- "{{ host1_fqdn }}" pac_type:
- "{{ host2_fqdn }}" - MS-PAC
action: member - PAD
state: absent auth_ind: otp
register: result force: no
failed_when: not result.changed requires_pre_auth: yes
ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: not result.changed
- name: Ensure host cannot manage service, again. - name: Ensure service is present, again
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
host: pac_type:
- "{{ host1_fqdn }}" - MS_PAC
- "{{ host2_fqdn }}" - PAD
action: member auth_ind: otp
state: absent force: no
register: result requires_pre_auth: yes
failed_when: result.changed ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups. - name: Modify service.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user: pac_type: NONE
- user01 ok_as_delegate: yes
- user02 ok_to_auth_as_delegate: yes
allow_create_keytab_group: register: result
- group01 failed_when: not result.changed
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups, again. - name: Modify service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user: pac_type: NONE
- user01 ok_as_delegate: yes
- user02 ok_to_auth_as_delegate: yes
allow_create_keytab_group: register: result
- group01 failed_when: result.changed
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups. - name: Ensure service is present, with host not in DNS.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: HTTP/svc.ihavenodns.info
allow_create_keytab_user: force: yes
- user01 register: result
- user02 failed_when: not result.changed
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups, again. - name: Ensure service is present, with host not in DNS, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: HTTP/svc.ihavenodns.info
allow_create_keytab_user: force: yes
- user01 register: result
- user02 failed_when: result.changed
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups - name: Principal host/test.example.com present in service.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: register: result
- group01 failed_when: not result.changed
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups, again. - name: Principal host/test.exabple.com present in service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: register: result
- group01 failed_when: result.changed
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups. - name: Principal host/test.example.com absent in service.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: state: absent
- group01 register: result
- group02 failed_when: not result.changed
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups, again. - name: Principal host/test.example.com absent in service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: state: absent
- group01 register: result
- group02 failed_when: result.changed
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
# - name: Ensure host can manage service.
- name: Ensure service is absent ipaservice:
ipaservice: ipaadmin_password: SomeADMINpassword
ipaadmin_password: SomeADMINpassword name: "HTTP/{{ svc_fqdn }}"
name: "HTTP/{{ svc_fqdn }}" host:
state: absent - "{{ host1_fqdn }}"
register: result - "{{ host2_fqdn }}"
failed_when: not result.changed action: member
register: result
failed_when: not result.changed
- name: Ensure service is absent, again - name: Ensure host can manage service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
state: absent host: "{{ host1_fqdn }}"
register: result action: member
failed_when: result.changed register: result
failed_when: result.changed
# cleanup - name: Ensure host cannot manage service.
- name: Cleanup test environment ipaservice:
include_tasks: env_cleanup.yml ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
action: member
state: absent
register: result
failed_when: not result.changed
- name: Ensure host cannot manage service, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
action: member
state: absent
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
#
- name: Ensure service is absent
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
state: absent
register: result
failed_when: not result.changed
- name: Ensure service is absent, again
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
state: absent
register: result
failed_when: result.changed
# cleanup
- name: Ensure services are absent.
ipaservice:
ipaadmin_password: SomeADMINpassword
name:
- "HTTP/{{ svc_fqdn }}"
- HTTP/svc.ihavenodns.info
state: absent
- name: Ensure host is absent
ipahost:
ipaadmin_password: SomeADMINpassword
name:
- "{{ svc_fqdn }}"
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
- svc.ihavenodns.info
state: absent
- name: Ensure testing users are absent.
ipauser:
ipaadmin_password: SomeADMINpassword
name:
- user01
- user02
state: absent
- name: Ensure testing groups are absent.
ipagroup:
ipaadmin_password: SomeADMINpassword
name:
- group01
- group02
state: absent
- name: Ensure testing hostgroup hostgroup01 is absent.
ipagroup:
ipaadmin_password: SomeADMINpassword
name:
- hostgroup01
state: absent
- name: Ensure testing hostgroup hostgroup02 is absent.
ipagroup:
ipaadmin_password: SomeADMINpassword
name:
- hostgroup02
state: absent
when: ipa_version is version('4.7.0', '>=')