internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-07-30 03:14:42 +00:00
Code Issues Projects Releases Wiki Activity

Add FreeIPA version as Ansible facts for testing.

Browse Source 
Some attributes are not present in all supported versions of FreeIPA,
and this might cause tests to fail due to unsupported versions.

This patch add the means to test if a test can be executed based on
the target host FreeIPA version.
This commit is contained in:
Rafael Guterres Jeffman
2020-08-14 11:10:30 -03:00
parent 675125ed0b
commit 9cb75cdea7
4 changed files with 754 additions and 591 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/env_freeipa_facts.yml Normal file
View File

@@ -0,0 +1,18 @@
# This playbook should be included with `include_tasks` as the first task
# of a test playbook that requires FreeIPA information.
#
# Available Facts:
#
# ipa_version: The installed FreeIPA version.
# ipa_api_version: The installed FreeIPA API version.
#
---
- name: Retrieving FreeIPA version.
shell:
cmd: 'ipa --version | sed -n "s/VERSION: \([^,]*\).*API_VERSION: \([^,]*\).*/\1\\n\2/p"'
register: ipa_cmd_version
- name: Set FreeIPA facts.
set_fact:
ipa_version: "{{ ipa_cmd_version.stdout_lines[0] }}"
ipa_api_version: "{{ ipa_cmd_version.stdout_lines[1] }}"

381
tests/hostgroup/test_hostgroup_membermanager.yml
View File

@@ -5,215 +5,220 @@
gather_facts: false gather_facts: false
tasks: tasks:
- name: Ensure host-group testhostgroup is absent - include_tasks: ../env_freeipa_facts.yml
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name:
- testhostgroup
state: absent
- name: Ensure user manangeruser1 and manageruser2 is absent - name: Tests requiring IPA version 4.8.4+
ipauser: block:
ipaadmin_password: SomeADMINpassword - name: Ensure host-group testhostgroup is absent
name: manageruser1,manageruser2,unknown_user ipahostgroup:
state: absent ipaadmin_password: SomeADMINpassword
name:
- testhostgroup
state: absent
- name: Ensure group managergroup1 and managergroup2 are absent - name: Ensure user manangeruser1 and manageruser2 is absent
ipagroup: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup1,managergroup2 name: manageruser1,manageruser2,unknown_user
state: absent state: absent
- name: Ensure host-group testhostgroup is present - name: Ensure group managergroup1 and managergroup2 are absent
ipahostgroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: name: managergroup1,managergroup2
- testhostgroup state: absent
- name: Ensure user manageruser1 and manageruser2 are present - name: Ensure host-group testhostgroup is present
ipauser: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
users: name:
- name: manageruser1 - testhostgroup
first: manageruser1
last: Last1
- name: manageruser2
first: manageruser2
last: Last2
register: result
failed_when: not result.changed
- name: Ensure managergroup1 is present - name: Ensure user manageruser1 and manageruser2 are present
ipagroup: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup1 users:
register: result - name: manageruser1
failed_when: not result.changed first: manageruser1
last: Last1
- name: manageruser2
first: manageruser2
last: Last2
register: result
failed_when: not result.changed
- name: Ensure managergroup2 is present - name: Ensure managergroup1 is present
ipagroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup2 name: managergroup1
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure membermanager user1 is present for testhostgroup - name: Ensure managergroup2 is present
ipahostgroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: managergroup2
membermanager_user: manageruser1 register: result
register: result failed_when: not result.changed
failed_when: not result.changed
- name: Ensure membermanager user1 is present for testhostgroup again - name: Ensure membermanager user1 is present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager group1 is present for testhostgroup - name: Ensure membermanager user1 is present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_group: managergroup1 membermanager_user: manageruser1
register: result register: result
failed_when: not result.changed failed_when: result.changed
- name: Ensure membermanager group1 is present for testhostgroup again - name: Ensure membermanager group1 is present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_group: managergroup1 membermanager_group: managergroup1
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager user2 and group2 members are present for testhostgroup - name: Ensure membermanager group1 is present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser2 membermanager_group: managergroup1
membermanager_group: managergroup2 register: result
action: member failed_when: result.changed
register: result
failed_when: not result.changed
- name: Ensure membermanager user2 and group2 members are present for testhostgroup again - name: Ensure membermanager user2 and group2 members are present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser2 membermanager_user: manageruser2
membermanager_group: managergroup2 membermanager_group: managergroup2
action: member action: member
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager user and group members are present for testhostgroup again - name: Ensure membermanager user2 and group2 members are present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1,manageruser2 membermanager_user: manageruser2
membermanager_group: managergroup1,managergroup2 membermanager_group: managergroup2
action: member action: member
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: Ensure membermanager user1 and group1 members are absent for testhostgroup - name: Ensure membermanager user and group members are present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1,manageruser2
membermanager_group: managergroup1 membermanager_group: managergroup1,managergroup2
action: member action: member
state: absent register: result
register: result failed_when: result.changed
failed_when: not result.changed
- name: Ensure membermanager user1 and group1 members are absent for testhostgroup again - name: Ensure membermanager user1 and group1 members are absent for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
membermanager_group: managergroup1 membermanager_group: managergroup1
action: member action: member
state: absent state: absent
register: result register: result
failed_when: result.changed failed_when: not result.changed
- name: Ensure membermanager user1 and group1 members are absent for testhostgroup again
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name: testhostgroup
membermanager_user: manageruser1
membermanager_group: managergroup1
action: member
state: absent
register: result
failed_when: result.changed
- name: Ensure membermanager user1 and group1 members are present for testhostgroup - name: Ensure membermanager user1 and group1 members are present for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
membermanager_group: managergroup1 membermanager_group: managergroup1
action: member action: member
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure membermanager user1 and group1 members are present for testhostgroup again - name: Ensure membermanager user1 and group1 members are present for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1 membermanager_user: manageruser1
membermanager_group: managergroup1 membermanager_group: managergroup1
action: member action: member
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: Ensure membermanager user and group members are absent for testhostgroup - name: Ensure membermanager user and group members are absent for testhostgroup
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1,manageruser2 membermanager_user: manageruser1,manageruser2
membermanager_group: managergroup1,managergroup2 membermanager_group: managergroup1,managergroup2
action: member action: member
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure membermanager user and group members are absent for testhostgroup again - name: Ensure membermanager user and group members are absent for testhostgroup again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: manageruser1,manageruser2 membermanager_user: manageruser1,manageruser2
membermanager_group: managergroup1,managergroup2 membermanager_group: managergroup1,managergroup2
action: member action: member
state: absent state: absent
register: result register: result
failed_when: result.changed failed_when: result.changed
- name: Ensure user manangeruser1 and manageruser2 is absent - name: Ensure user manangeruser1 and manageruser2 is absent
ipauser: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: manageruser1,manageruser2 name: manageruser1,manageruser2
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure group managergroup1 and managergroup2 are absent - name: Ensure group managergroup1 and managergroup2 are absent
ipagroup: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: managergroup1,managergroup2 name: managergroup1,managergroup2
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
- name: Ensure unknown membermanager_user member failure - name: Ensure unknown membermanager_user member failure
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: testhostgroup name: testhostgroup
membermanager_user: unknown_user membermanager_user: unknown_user
action: member action: member
register: result register: result
failed_when: result.changed or "no such entry" not in result.msg failed_when: result.changed or "no such entry" not in result.msg
- name: Ensure host-group testhostgroup is absent - name: Ensure host-group testhostgroup is absent
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: name:
- testhostgroup - testhostgroup
state: absent state: absent
register: result register: result
failed_when: not result.changed failed_when: not result.changed
when: ipa_version is version('4.8.4', '>=')

180
tests/hostgroup/test_hostgroup_rename.yml
View File

@@ -5,101 +5,107 @@
gather_facts: false gather_facts: false
tasks: tasks:
- name: Ensure testing host-group are absent - include_tasks: ../env_freeipa_facts.yml
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name:
- databases
- datalake
- inexistenthostgroup
state: absent
- name: Ensure host-group databases is present - name: Tests requiring IPA version 4.8.7+
ipahostgroup: block:
ipaadmin_password: SomeADMINpassword - name: Ensure testing host-group are absent
name: databases ipahostgroup:
state: present ipaadmin_password: SomeADMINpassword
register: result name:
failed_when: not result.changed - databases
- datalake
- inexistenthostgroup
state: absent
- name: Rename host-group from `databases` to `datalake` - name: Ensure host-group databases is present
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: databases
rename: datalake state: present
state: renamed register: result
register: result failed_when: not result.changed
failed_when: not result.changed
- name: Ensure host-group database was already absent - name: Rename host-group from `databases` to `datalake`
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: database name: databases
state: absent rename: datalake
register: result state: renamed
failed_when: result.changed register: result
failed_when: not result.changed
- name: Rename host-group from `databases` to `datalake`, again - name: Ensure host-group database was already absent
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: database
rename: datalake state: absent
state: renamed register: result
register: result failed_when: result.changed
failed_when: result.changed or result.failed
- name: Rename host-group with same name. - name: Rename host-group from `databases` to `datalake`, again
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: datalake name: databases
rename: datalake rename: datalake
state: renamed state: renamed
register: result register: result
failed_when: result.changed failed_when: result.changed or result.failed
- name: Ensure testing hostgroups do not exist. - name: Rename host-group with same name.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: inexistenthostgroup,alsoinexistent name: datalake
state: absent rename: datalake
state: renamed
register: result
failed_when: result.changed
- name: Rename inexistent host-group to an existing one. - name: Ensure testing hostgroups do not exist.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: inexistenthostgroup name: inexistenthostgroup,alsoinexistent
rename: datalake state: absent
state: renamed
register: result
failed_when: result.changed or result.failed
- name: Rename inexistent host-group to a non-existing one. - name: Rename inexistent host-group to an existing one.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: inexistenthostgroup name: inexistenthostgroup
rename: alsoinexistent rename: datalake
state: renamed state: renamed
register: result register: result
failed_when: not result.failed or "Attribute `rename` can not be used, unless hostgroup exists." not in result.msg failed_when: result.changed or result.failed
- name: Ensure host-group databases is present - name: Rename inexistent host-group to a non-existing one.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: inexistenthostgroup
state: present rename: alsoinexistent
state: renamed
register: result
failed_when: not result.failed or "Attribute `rename` can not be used, unless hostgroup exists." not in result.msg
- name: Rename host-group to an existing one. - name: Ensure host-group databases is present
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: databases name: databases
rename: datalake state: present
state: renamed
register: result
failed_when: not result.failed or "This entry already exists" not in result.msg
- name: Ensure host-group databases and datalake are absent - name: Rename host-group to an existing one.
ipahostgroup: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: name: databases
- databases rename: datalake
- datalake state: renamed
state: absent register: result
failed_when: not result.failed or "This entry already exists" not in result.msg
- name: Ensure host-group databases and datalake are absent
ipahostgroup:
ipaadmin_password: SomeADMINpassword
name:
- databases
- datalake
state: absent
when: ipa_version is version('4.8.7', '>=')

766
tests/service/test_service_without_skip_host_check.yml
View File

@@ -4,344 +4,478 @@
become: yes become: yes
tasks: tasks:
# setup - include_tasks: ../env_freeipa_facts.yml
- name: Setup test environment
include_tasks: env_setup.yml
# tests - name: Tests requiring IPA version 4.7.0+
- name: Ensure service is present block:
ipaservice: # setup
ipaadmin_password: SomeADMINpassword - name: Get Domain from server name
name: "HTTP/{{ svc_fqdn }}" set_fact:
pac_type: ipaserver_domain: "{{ ansible_fqdn.split('.')[1:] | join ('.') }}"
- MS-PAC when: ipaserver_domain is not defined
- PAD
auth_ind: otp
force: no
requires_pre_auth: yes
ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: not result.changed
- name: Ensure service is present, again - name: Set host1, host2 and svc hosts fqdn
ipaservice: set_fact:
ipaadmin_password: SomeADMINpassword host1_fqdn: "{{ 'host1.' + ipaserver_domain }}"
name: "HTTP/{{ svc_fqdn }}" host2_fqdn: "{{ 'host2.' + ipaserver_domain }}"
pac_type: svc_fqdn: "{{ 'svc.' + ipaserver_domain }}"
- MS_PAC
- PAD
auth_ind: otp
force: no
requires_pre_auth: yes
ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: result.changed
- name: Modify service. - name: Host absent
ipaservice: ipahost:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name:
pac_type: NONE - svc.ihavenodns.info
ok_as_delegate: yes - "{{ host1_fqdn }}"
ok_to_auth_as_delegate: yes - "{{ host2_fqdn }}"
register: result - "{{ svc_fqdn }}"
failed_when: not result.changed update_dns: yes
state: absent
- name: Modify service, again. - name: Get IPv4 address prefix from server node
ipaservice: set_fact:
ipaadmin_password: SomeADMINpassword ipv4_prefix: "{{ ansible_default_ipv4.address.split('.')[:-1] |
name: "HTTP/{{ svc_fqdn }}" join('.') }}"
pac_type: NONE
ok_as_delegate: yes
ok_to_auth_as_delegate: yes
register: result
failed_when: result.changed
- name: Ensure service is present, with host not in DNS. - name: Add hosts for tests.
ipaservice: ipahost:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: HTTP/svc.ihavenodns.info hosts:
force: yes - name: "{{ host1_fqdn }}"
register: result ip_address: "{{ ipv4_prefix + '.201' }}"
failed_when: not result.changed update_dns: yes
- name: "{{ host2_fqdn }}"
ip_address: "{{ ipv4_prefix + '.202' }}"
update_dns: yes
- name: "{{ svc_fqdn }}"
ip_address: "{{ ipv4_prefix + '.203' }}"
update_dns: yes
- name: svc.ihavenodns.info
update_dns: no
force: yes
- name: Ensure service is present, with host not in DNS, again. - name: Ensure testing user user01 is present.
ipaservice: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: HTTP/svc.ihavenodns.info name: user01
force: yes first: user01
register: result last: last
failed_when: result.changed
- name: Principal host/test.example.com present in service. - name: Ensure testing user user02 is present.
ipaservice: ipauser:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: user02
principal: first: user02
- host/test.example.com last: last
action: member
register: result
failed_when: not result.changed
- name: Principal host/test.exabple.com present in service, again. - name: Ensure testing group group01 is present.
ipaservice: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: group01
principal:
- host/test.example.com
action: member
register: result
failed_when: result.changed
- name: Principal host/test.example.com absent in service. - name: Ensure testing group group02 is present.
ipaservice: ipagroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: group02
principal:
- host/test.example.com
action: member
state: absent
register: result
failed_when: not result.changed
- name: Principal host/test.example.com absent in service, again. - name: Ensure testing hostgroup hostgroup01 is present.
ipaservice: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: hostgroup01
principal:
- host/test.example.com
action: member
state: absent
register: result
failed_when: result.changed
- name: Ensure host can manage service. - name: Ensure testing hostgroup hostgroup02 is present.
ipaservice: ipahostgroup:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: hostgroup02
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
action: member
register: result
failed_when: not result.changed
- name: Ensure host can manage service, again. - name: Ensure services are absent.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name:
host: "{{ host1_fqdn }}" - "HTTP/{{ svc_fqdn }}"
action: member - HTTP/svc.ihavenodns.info
register: result state: absent
failed_when: result.changed
- name: Ensure host cannot manage service. # tests
ipaservice: - name: Ensure service is present
ipaadmin_password: SomeADMINpassword ipaservice:
name: "HTTP/{{ svc_fqdn }}" ipaadmin_password: SomeADMINpassword
host: name: "HTTP/{{ svc_fqdn }}"
- "{{ host1_fqdn }}" pac_type:
- "{{ host2_fqdn }}" - MS-PAC
action: member - PAD
state: absent auth_ind: otp
register: result force: no
failed_when: not result.changed requires_pre_auth: yes
ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: not result.changed
- name: Ensure host cannot manage service, again. - name: Ensure service is present, again
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
host: pac_type:
- "{{ host1_fqdn }}" - MS_PAC
- "{{ host2_fqdn }}" - PAD
action: member auth_ind: otp
state: absent force: no
register: result requires_pre_auth: yes
failed_when: result.changed ok_as_delegate: no
ok_to_auth_as_delegate: no
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups. - name: Modify service.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user: pac_type: NONE
- user01 ok_as_delegate: yes
- user02 ok_to_auth_as_delegate: yes
allow_create_keytab_group: register: result
- group01 failed_when: not result.changed
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups, again. - name: Modify service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user: pac_type: NONE
- user01 ok_as_delegate: yes
- user02 ok_to_auth_as_delegate: yes
allow_create_keytab_group: register: result
- group01 failed_when: result.changed
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups. - name: Ensure service is present, with host not in DNS.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: HTTP/svc.ihavenodns.info
allow_create_keytab_user: force: yes
- user01 register: result
- user02 failed_when: not result.changed
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups, again. - name: Ensure service is present, with host not in DNS, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: HTTP/svc.ihavenodns.info
allow_create_keytab_user: force: yes
- user01 register: result
- user02 failed_when: result.changed
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups - name: Principal host/test.example.com present in service.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: register: result
- group01 failed_when: not result.changed
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups, again. - name: Principal host/test.exabple.com present in service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: register: result
- group01 failed_when: result.changed
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups. - name: Principal host/test.example.com absent in service.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: state: absent
- group01 register: result
- group02 failed_when: not result.changed
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups, again. - name: Principal host/test.example.com absent in service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user: principal:
- user01 - host/test.example.com
- user02 action: member
allow_retrieve_keytab_group: state: absent
- group01 register: result
- group02 failed_when: result.changed
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
# - name: Ensure host can manage service.
- name: Ensure service is absent ipaservice:
ipaservice: ipaadmin_password: SomeADMINpassword
ipaadmin_password: SomeADMINpassword name: "HTTP/{{ svc_fqdn }}"
name: "HTTP/{{ svc_fqdn }}" host:
state: absent - "{{ host1_fqdn }}"
register: result - "{{ host2_fqdn }}"
failed_when: not result.changed action: member
register: result
failed_when: not result.changed
- name: Ensure service is absent, again - name: Ensure host can manage service, again.
ipaservice: ipaservice:
ipaadmin_password: SomeADMINpassword ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}" name: "HTTP/{{ svc_fqdn }}"
state: absent host: "{{ host1_fqdn }}"
register: result action: member
failed_when: result.changed register: result
failed_when: result.changed
# cleanup - name: Ensure host cannot manage service.
- name: Cleanup test environment ipaservice:
include_tasks: env_cleanup.yml ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
action: member
state: absent
register: result
failed_when: not result.changed
- name: Ensure host cannot manage service, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
action: member
state: absent
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_create_keytab_user:
- user01
- user02
allow_create_keytab_group:
- group01
- group02
allow_create_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_create_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
register: result
failed_when: result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: not result.changed
- name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups, again.
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
allow_retrieve_keytab_user:
- user01
- user02
allow_retrieve_keytab_group:
- group01
- group02
allow_retrieve_keytab_host:
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
allow_retrieve_keytab_hostgroup:
- hostgroup01
- hostgroup02
action: member
state: absent
register: result
failed_when: result.changed
#
- name: Ensure service is absent
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
state: absent
register: result
failed_when: not result.changed
- name: Ensure service is absent, again
ipaservice:
ipaadmin_password: SomeADMINpassword
name: "HTTP/{{ svc_fqdn }}"
state: absent
register: result
failed_when: result.changed
# cleanup
- name: Ensure services are absent.
ipaservice:
ipaadmin_password: SomeADMINpassword
name:
- "HTTP/{{ svc_fqdn }}"
- HTTP/svc.ihavenodns.info
state: absent
- name: Ensure host is absent
ipahost:
ipaadmin_password: SomeADMINpassword
name:
- "{{ svc_fqdn }}"
- "{{ host1_fqdn }}"
- "{{ host2_fqdn }}"
- svc.ihavenodns.info
state: absent
- name: Ensure testing users are absent.
ipauser:
ipaadmin_password: SomeADMINpassword
name:
- user01
- user02
state: absent
- name: Ensure testing groups are absent.
ipagroup:
ipaadmin_password: SomeADMINpassword
name:
- group01
- group02
state: absent
- name: Ensure testing hostgroup hostgroup01 is absent.
ipagroup:
ipaadmin_password: SomeADMINpassword
name:
- hostgroup01
state: absent
- name: Ensure testing hostgroup hostgroup02 is absent.
ipagroup:
ipaadmin_password: SomeADMINpassword
name:
- hostgroup02
state: absent
when: ipa_version is version('4.7.0', '>=')