ipaconfig: Prevent configuration issues due to test failure.

Currently, if a test fails during execution of ipaconfig playbook
tests, or if the failed task is the task reverting to the original
configuration fails, the testing host might be left in a state that
may cause other tests to fail due to the inconsistent configuration
state.

This patch ensures that if a test fails, a known configuration, the
same as used is the default installation of FreeIPA used in upstream
CI, is applied to the host, providing safe environment for testing.

tests/config/test_config.yml

@@ -7,6 +7,7 @@
   tasks:
   - include_tasks: ../env_freeipa_facts.yml
 
+  - block:
       # Retrieve current configuration.
       - name: return current values of the global configuration options
         ipaconfig:
@@ -14,12 +15,12 @@
         register: previousconfig
 
       - debug:
-      msg: "{{previousconfig}}"
+          var: previousconfig
 
       # setup environment.
       - name: create test group
         ipagroup:
-      ipaadmin_password: 'SomeADMINpassword'
+          ipaadmin_password: SomeADMINpassword
           name: somedefaultgroup
 
       - name: Ensure the default e-mail domain is ipa.test.
@@ -249,14 +250,14 @@
       - name: change enable_migration
         ipaconfig:
           ipaadmin_password: SomeADMINpassword
-      enable_migration: '{{ not previousconfig.config.enable_migration }}'
+          enable_migration: '{{ not (previousconfig.config.enable_migration | bool) }}'
         register: result
         failed_when: not result.changed or result.failed
 
       - name: change enable_migration, again
         ipaconfig:
           ipaadmin_password: SomeADMINpassword
-      enable_migration: '{{ not previousconfig.config.enable_migration }}'
+          enable_migration: '{{ not (previousconfig.config.enable_migration | bool) }}'
         register: result
         failed_when: result.changed or result.failed
 
@@ -332,20 +333,20 @@
 
       - name: reset changed fields
         ipaconfig:
-      ipaadmin_password: 'SomeADMINpassword'
-      maxusername: '{{previousconfig.config.maxusername | default(omit)}}'
+          ipaadmin_password: SomeADMINpassword
+          maxusername: '{{ previousconfig.config.maxusername | default(32) | int }}'
           homedirectory: '{{ previousconfig.config.homedirectory | default(omit) }}'
           defaultshell: '{{ previousconfig.config.defaultshell | default(omit) }}'
           defaultgroup: '{{ previousconfig.config.defaultgroup | default(omit) }}'
           emaildomain: '{{ previousconfig.config.emaildomain | default(omit) }}'
-      searchtimelimit: '{{previousconfig.config.searchtimelimit | default(omit)}}'
-      searchrecordslimit: '{{previousconfig.config.searchrecordslimit | default(omit)}}'
+          searchtimelimit: '{{ previousconfig.config.searchtimelimit | default(2) | int }}'
+          searchrecordslimit: '{{ previousconfig.config.searchrecordslimit | default(100) | int }}'
           usersearch: '{{ previousconfig.config.usersearch | default(omit) }}'
           groupsearch: '{{ previousconfig.config.groupsearch | default(omit) }}'
-      enable_migration: '{{previousconfig.config.enable_migration | default(omit)}}'
+          enable_migration: '{{ previousconfig.config.enable_migration | default(False) | bool }}'
           groupobjectclasses: '{{ previousconfig.config.groupobjectclasses | default(omit) }}'
           userobjectclasses: '{{ previousconfig.config.userobjectclasses | default(omit) }}'
-      pwdexpnotify: '{{previousconfig.config.pwdexpnotify | default(omit)}}'
+          pwdexpnotify: '{{ previousconfig.config.pwdexpnotify | default(4) | int }}'
           configstring: '{{ previousconfig.config.configstring | default(omit) }}'
           selinuxusermapdefault: '{{ previousconfig.config.selinuxusermapdefault | default(omit) }}'
           selinuxusermaporder: '{{ previousconfig.config.selinuxusermaporder | default(omit) }}'
@@ -365,20 +366,20 @@
 
       - name: reset changed fields, again
         ipaconfig:
-      ipaadmin_password: 'SomeADMINpassword'
-      maxusername: '{{previousconfig.config.maxusername | default(omit)}}'
+          ipaadmin_password: SomeADMINpassword
+          maxusername: '{{ previousconfig.config.maxusername | default(omit) | int }}'
           homedirectory: '{{ previousconfig.config.homedirectory | default(omit) }}'
           defaultshell: '{{ previousconfig.config.defaultshell | default(omit) }}'
           defaultgroup: '{{ previousconfig.config.defaultgroup | default(omit) }}'
           emaildomain: '{{ previousconfig.config.emaildomain | default(omit) }}'
-      searchtimelimit: '{{previousconfig.config.searchtimelimit | default(omit)}}'
-      searchrecordslimit: '{{previousconfig.config.searchrecordslimit | default(omit)}}'
+          searchtimelimit: '{{ previousconfig.config.searchtimelimit | default(omit) | int }}'
+          searchrecordslimit: '{{ previousconfig.config.searchrecordslimit | default(omit) | int }}'
           usersearch: '{{ previousconfig.config.usersearch | default(omit) }}'
           groupsearch: '{{ previousconfig.config.groupsearch | default(omit) }}'
-      enable_migration: '{{previousconfig.config.enable_migration | default(omit)}}'
+          enable_migration: '{{ previousconfig.config.enable_migration | default(omit) | bool }}'
           groupobjectclasses: '{{ previousconfig.config.groupobjectclasses | default(omit) }}'
           userobjectclasses: '{{ previousconfig.config.userobjectclasses | default(omit) }}'
-      pwdexpnotify: '{{previousconfig.config.pwdexpnotify | default(omit)}}'
+          pwdexpnotify: '{{ previousconfig.config.pwdexpnotify | default(omit) | int }}'
           configstring: '{{ previousconfig.config.configstring | default(omit) }}'
           selinuxusermapdefault: '{{ previousconfig.config.selinuxusermapdefault | default(omit) }}'
           selinuxusermaporder: '{{ previousconfig.config.selinuxusermaporder | default(omit) }}'
@@ -396,10 +397,39 @@
               maxhostname: '{{ previousconfig.config.maxhostname | default(omit) }}'
         when: ipa_version is version('4.8.0', '>=')
 
-  # cleanup
+    rescue:
+      - name: Set fields to IPA default, due to error
+        ipaconfig:
+          ipaadmin_password: SomeADMINpassword
+          maxusername: '{{ previousconfig.config.maxusername | default(omit) | int }}'
+          homedirectory: '{{ previousconfig.config.homedirectory | default(omit) }}'
+          defaultshell: '{{ previousconfig.config.defaultshell | default(omit) }}'
+          defaultgroup: '{{ previousconfig.config.defaultgroup | default(omit) }}'
+          emaildomain: '{{ previousconfig.config.emaildomain | default(omit) }}'
+          searchtimelimit: '{{ previousconfig.config.searchtimelimit | default(omit) | int }}'
+          searchrecordslimit: '{{ previousconfig.config.searchrecordslimit | default(omit) | int }}'
+          usersearch: '{{ previousconfig.config.usersearch | default(omit) }}'
+          groupsearch: '{{ previousconfig.config.groupsearch | default(omit) }}'
+          enable_migration: '{{ previousconfig.config.enable_migration | default(omit) | bool }}'
+          groupobjectclasses: '{{ previousconfig.config.groupobjectclasses | default(omit) }}'
+          userobjectclasses: '{{ previousconfig.config.userobjectclasses | default(omit) }}'
+          pwdexpnotify: '{{ previousconfig.config.pwdexpnotify | default(omit) | int }}'
+          configstring: '{{ previousconfig.config.configstring | default(omit) }}'
+          selinuxusermapdefault: '{{ previousconfig.config.selinuxusermapdefault | default(omit) }}'
+          selinuxusermaporder: '{{ previousconfig.config.selinuxusermaporder | default(omit) }}'
+          pac_type: '{{ previousconfig.config.pac_type | default(omit) }}'
+          user_auth_type: '{{ previousconfig.config.user_auth_type | default(omit) }}'
+          domain_resolution_order: '{{ previousconfig.config.domain_resolution_order | default(omit) }}'
+          ca_renewal_master_server: '{{ previousconfig.config.ca_renewal_master_server | default(omit) }}'
+        register: result
 
+      - debug:
+          msg: "Due to a test failure, IPA CA-Renewal Server might not be correctly be set. Check your configuration."
+
+    always:
+      # cleanup
       - name: cleanup test group
         ipagroup:
-      ipaadmin_password: 'SomeADMINpassword'
+          ipaadmin_password: SomeADMINpassword
           name: somedefaultgroup
           state: absent