ipauser: Fix certmapdata, add missing certmapdata data option

certmapdata was not processed properly. The certificate was not loaded and
therefore the `issuer` and `subject` could not be compared to the
certmapdata entries in the user record. The function `load_cert_from_str`
from ansible_freeipa_moduleis used for this.

Additionally there was no way to use the certmapdata data format. This
is now possible with the `data` option in the certmapdata dict.

Example: "data: X509:<I>dc=com,dc=example,CN=ca<S>dc=com,dc=example,CN=test"

`data` may not be used together with `certificate`, `issuer` and `subject`
in the same record.

Given certmapdata for the ipauser module is now converted to the internal
data representation using also the new function `DN_x500_text` from
`ansible_freeipa_module`.

New functions `convert_certmapdata` and `check_certmapdata` have been added
to ipauser.

tests/user/certmapdata/test_user_certmapdata.yml has been extended with
additional tasks to verify more complex issuer and subjects and also using
the data format.

tests/user/certmapdata/test_user_certmapdata.yml

@@ -126,8 +126,6 @@
       certmapdata:
       - issuer: CN=issuer1
         subject: CN=subject1
-      - issuer: CN=issuer2
-        subject: CN=subject2
       - issuer: CN=issuer3
         subject: CN=subject3
       action: member
@@ -142,8 +140,6 @@
       certmapdata:
       - issuer: CN=issuer1
         subject: CN=subject1
-      - issuer: CN=issuer2
-        subject: CN=subject2
       - issuer: CN=issuer3
         subject: CN=subject3
       action: member
@@ -151,6 +147,85 @@
     register: result
     failed_when: result.changed
 
+  - name: User test certmapdata members absent
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - issuer: CN=issuer2
+        subject: CN=subject2
+      action: member
+      state: absent
+    register: result
+    failed_when: not result.changed
+
+  - name: User test certmapdata members absent again
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - issuer: CN=issuer2
+        subject: CN=subject2
+      action: member
+      state: absent
+    register: result
+    failed_when: result.changed
+
+  - name: User test certmapdata member present
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - issuer: CN=ca,dc=example,dc=com
+        subject: CN=test,dc=example,dc=com
+      action: member
+    register: result
+    failed_when: not result.changed
+
+  - name: User test certmapdata member present again
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - issuer: CN=ca,dc=example,dc=com
+        subject: CN=test,dc=example,dc=com
+      action: member
+    register: result
+    failed_when: result.changed
+
+  - name: User test certmapdata member (data) present again
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - data: X509:<I>dc=com,dc=example,CN=ca<S>dc=com,dc=example,CN=test
+      action: member
+    register: result
+    failed_when: result.changed
+
+  - name: User test certmapdata member absent
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - issuer: CN=ca,dc=example,dc=com
+        subject: CN=test,dc=example,dc=com
+      action: member
+      state: absent
+    register: result
+    failed_when: not result.changed
+
+  - name: User test certmapdata member (data) absent again
+    ipauser:
+      ipaadmin_password: SomeADMINpassword
+      name: test
+      certmapdata:
+      - data: X509:<I>dc=com,dc=example,CN=ca<S>dc=com,dc=example,CN=test
+      action: member
+      state: absent
+    register: result
+    failed_when: result.changed
+
   - name: User test absent
     ipauser:
       ipaadmin_password: SomeADMINpassword