permission: Use IPAAnsibleModule class

ipaadmin_variables are handled by IPAAnsibleModule,
ansible_module.params_get is used to get the parameters and
ansible_module.ipa_connect is used to simplify the module.

plugins/modules/ipapermission.py

@@ -31,13 +31,9 @@ DOCUMENTATION = """
 module: ipapermission
 short description: Manage FreeIPA permission
 description: Manage FreeIPA permission and permission members
+extends_documentation_fragment:
+  - ipamodule_base_docs
 options:
-  ipaadmin_principal:
-    description: The admin principal.
-    default: admin
-  ipaadmin_password:
-    description: The admin password.
-    required: false
   name:
     description: The permission name string.
     required: true
@@ -133,20 +129,14 @@ RETURN = """
 """
 
 
-from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.ansible_freeipa_module import \
-    temp_kinit, temp_kdestroy, valid_creds, api_connect, api_command, \
+    IPAAnsibleModule, compare_args_ipa
-    compare_args_ipa, module_params_get, api_check_ipa_version
-import six
-
-if six.PY3:
-    unicode = str
 
 
 def find_permission(module, name):
     """Find if a permission with the given name already exist."""
     try:
-        _result = api_command(module, "permission_show", name, {"all": True})
+        _result = module.ipa_command("permission_show", name, {"all": True})
     except Exception:  # pylint: disable=broad-except
         # An exception is raised if permission name is not found.
         return None
@@ -191,12 +181,9 @@ def gen_args(right, attrs, bindtype, subtree,
 
 
 def main():
-    ansible_module = AnsibleModule(
+    ansible_module = IPAAnsibleModule(
         argument_spec=dict(
             # general
-            ipaadmin_principal=dict(type="str", default="admin"),
-            ipaadmin_password=dict(type="str", required=False, no_log=True),
-
             name=dict(type="list", aliases=["cn"],
                       default=None, required=True),
             # present
@@ -243,31 +230,27 @@ def main():
     # Get parameters
 
     # general
-    ipaadmin_principal = module_params_get(ansible_module,
+    names = ansible_module.params_get("name")
-                                           "ipaadmin_principal")
-    ipaadmin_password = module_params_get(ansible_module, "ipaadmin_password")
-    names = module_params_get(ansible_module, "name")
 
     # present
-    right = module_params_get(ansible_module, "right")
+    right = ansible_module.params_get("right")
-    attrs = module_params_get(ansible_module, "attrs")
+    attrs = ansible_module.params_get("attrs")
-    bindtype = module_params_get(ansible_module, "bindtype")
+    bindtype = ansible_module.params_get("bindtype")
-    subtree = module_params_get(ansible_module, "subtree")
+    subtree = ansible_module.params_get("subtree")
-    extra_target_filter = module_params_get(ansible_module,
+    extra_target_filter = ansible_module.params_get("extra_target_filter")
-                                            "extra_target_filter")
+    rawfilter = ansible_module.params_get("rawfilter")
-    rawfilter = module_params_get(ansible_module, "rawfilter")
+    target = ansible_module.params_get("target")
-    target = module_params_get(ansible_module, "target")
+    targetto = ansible_module.params_get("targetto")
-    targetto = module_params_get(ansible_module, "targetto")
+    targetfrom = ansible_module.params_get("targetfrom")
-    targetfrom = module_params_get(ansible_module, "targetfrom")
+    memberof = ansible_module.params_get("memberof")
-    memberof = module_params_get(ansible_module, "memberof")
+    targetgroup = ansible_module.params_get("targetgroup")
-    targetgroup = module_params_get(ansible_module, "targetgroup")
+    object_type = ansible_module.params_get("object_type")
-    object_type = module_params_get(ansible_module, "object_type")
+    no_members = ansible_module.params_get("no_members")
-    no_members = module_params_get(ansible_module, "no_members")
+    rename = ansible_module.params_get("rename")
-    rename = module_params_get(ansible_module, "rename")
+    action = ansible_module.params_get("action")
-    action = module_params_get(ansible_module, "action")
 
     # state
-    state = module_params_get(ansible_module, "state")
+    state = ansible_module.params_get("state")
 
     # Check parameters
 
@@ -311,7 +294,7 @@ def main():
                 msg="Argument '%s' can not be used with action "
                 "'%s' and state '%s'" % (x, action, state))
 
-    if bindtype == "self" and api_check_ipa_version("<", "4.8.7"):
+    if bindtype == "self" and ansible_module.ipa_check_version("<", "4.8.7"):
         ansible_module.fail_json(
             msg="Bindtype 'self' is not supported by your IPA version.")
 
@@ -324,13 +307,9 @@ def main():
 
     changed = False
     exit_args = {}
-    ccache_dir = None
+
-    ccache_name = None
+    # Connect to IPA API
-    try:
+    with ansible_module.ipa_connect():
-        if not valid_creds(ansible_module, ipaadmin_principal):
-            ccache_dir, ccache_name = temp_kinit(ipaadmin_principal,
-                                                 ipaadmin_password)
-        api_connect()
 
         commands = []
         for name in names:
@@ -454,8 +433,7 @@ def main():
 
         for name, command, args in commands:
             try:
-                result = api_command(ansible_module, command, name,
+                result = ansible_module.ipa_command(command, name, args)
-                                     args)
                 if "completed" in result:
                     if result["completed"] > 0:
                         changed = True
@@ -480,12 +458,6 @@ def main():
             if len(errors) > 0:
                 ansible_module.fail_json(msg=", ".join(errors))
 
-    except Exception as e:
-        ansible_module.fail_json(msg=str(e))
-
-    finally:
-        temp_kdestroy(ccache_dir, ccache_name)
-
     # Done
 
     ansible_module.exit_json(changed=changed, **exit_args)