Merge pull request #668 from rjeffman/ipaservice_use_default_error_handler

ipaservice: Use IPAAnsibleModule member result handler.
Merge pull request #683 from rjeffman/module_utils_lowercase_get
2026-03-27 13:53:06 +00:00 · 2021-11-29 15:38:08 +01:00 · 2021-11-29 13:39:37 +01:00 · 2021-11-26 10:55:57 -03:00 · 2021-11-25 15:16:44 -03:00 · 2021-11-25 13:53:26 +01:00
123 changed files with 1329 additions and 492 deletions
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -76,3 +76,11 @@ jobs:
        run: |
            pip install pylint==2.10.2
            pylint plugins --disable=import-error
+
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@1.1.0
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -38,3 +38,8 @@ repos:
    entry: utils/ansible-doc-test
    # args: ['-v', 'roles', 'plugins']
    files: ^.*.py$
+- repo: https://github.com/koalaman/shellcheck-precommit
+  rev: v0.8.0
+  hooks:
+  - id: shellcheck
+    args: ["--severity=warning"]  # Only show errors and warnings
--- a/molecule/resources/playbooks/prepare-common.yml
+++ b/molecule/resources/playbooks/prepare-common.yml
@@ -1,7 +1,7 @@
 ---
 # IPA depends on IPv6 and without it dirsrv service won't start.
 - name: Ensure IPv6 is ENABLED
-  sysctl:
+  ansible.posix.sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    sysctl_set: yes
@@ -19,14 +19,14 @@
 #   This is needed in some IPA versions in order to get KRA enabled.
 #   See https://pagure.io/freeipa/issue/7906 for more information.
 - name: stat protected_regular
-  stat:
+  ansible.builtin.stat:
    path: /proc/sys/fs/protected_regular
  register: result

 - name: Ensure fs.protected_regular is disabled
-  sysctl:
+  ansible.posix.sysctl:
    name: fs.protected_regular
-    value: '0'
+    value: 0
    sysctl_set: yes
    state: present
    reload: yes
--- a/molecule/resources/playbooks/prepare.yml
+++ b/molecule/resources/playbooks/prepare.yml
@@ -11,7 +11,7 @@
  #
  # To avoid this problem we create the directories before starting IPA.
  - name: Ensure lock dirs for DS exists
-    file:
+    ansible.builtin.file:
      state: directory
      owner: dirsrv
      group: dirsrv
@@ -22,6 +22,6 @@
      - /var/lock/dirsrv/slapd-TEST-LOCAL/

  - name: Ensure IPA server is up an running
-    service:
+    ansible.builtin.service:
      name: ipa
      state: started
--- a/plugins/doc_fragments/ipamodule_base_docs.py
+++ b/plugins/doc_fragments/ipamodule_base_docs.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+

 class ModuleDocFragment(object):  # pylint: disable=R0205,R0903
    DOCUMENTATION = r"""
--- a/plugins/module_utils/ansible_freeipa_module.py
+++ b/plugins/module_utils/ansible_freeipa_module.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.


+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 __all__ = ["gssapi", "netaddr", "api", "ipalib_errors", "Env",
           "DEFAULT_CONFIG", "LDAP_GENERALIZED_TIME_FORMAT",
           "kinit_password", "kinit_keytab", "run", "DN", "VERSION",
@@ -100,7 +103,7 @@ else:

    import socket
    import base64
-    import six
+    from ansible.module_utils import six

    try:
        from collections.abc import Mapping  # noqa
@@ -397,6 +400,14 @@ else:
    def module_params_get(module, name):
        return _afm_convert(module.params.get(name))

+    def module_params_get_lowercase(module, name):
+        value = _afm_convert(module.params.get(name))
+        if isinstance(value, list):
+            value = [v.lower() for v in value]
+        if isinstance(value, (str, unicode)):
+            value = value.lower()
+        return value
+
    def api_get_domain():
        return api.env.domain

@@ -699,6 +710,18 @@ else:
            """
            return module_params_get(self, name)

+        def params_get_lowercase(self, name):
+            """
+            Retrieve value set for module parameter as lowercase, if not None.
+
+            Parameters
+            ----------
+            name: string
+                The name of the parameter to retrieve.
+
+            """
+            return module_params_get_lowercase(self, name)
+
        def params_fail_used_invalid(self, invalid_params, state, action=None):
            """
            Fail module execution if one of the invalid parameters is not None.
--- a/plugins/modules/ipaautomember.py
+++ b/plugins/modules/ipaautomember.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -21,6 +20,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
@@ -100,7 +102,7 @@ EXAMPLES = """
    state: present
    inclusive:
    - key: "mail"
-      expression: "example.com$
+      expression: "example.com"

 # Delete an automember rule
 - ipaautomember:
@@ -307,15 +309,21 @@ def main():
                        commands.append([name, 'automember_add', args])
                        res_find = {}

-                    inclusive_add, inclusive_del = gen_add_del_lists(
-                        transform_conditions(inclusive or []),
-                        res_find.get("automemberinclusiveregex", [])
-                    )
+                    if inclusive is not None:
+                        inclusive_add, inclusive_del = gen_add_del_lists(
+                            transform_conditions(inclusive),
+                            res_find.get("automemberinclusiveregex", [])
+                        )
+                    else:
+                        inclusive_add, inclusive_del = [], []

-                    exclusive_add, exclusive_del = gen_add_del_lists(
-                        transform_conditions(exclusive or []),
-                        res_find.get("automemberexclusiveregex", [])
-                    )
+                    if exclusive is not None:
+                        exclusive_add, exclusive_del = gen_add_del_lists(
+                            transform_conditions(exclusive),
+                            res_find.get("automemberexclusiveregex", [])
+                        )
+                    else:
+                        exclusive_add, exclusive_del = [], []

                elif action == "member":
                    if res_find is None:
--- a/plugins/modules/ipaautomountlocation.py
+++ b/plugins/modules/ipaautomountlocation.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-
 # Authors:
 #   Chris Procter <cprocter@redhat.com>
@@ -19,6 +18,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipaconfig.py
+++ b/plugins/modules/ipaconfig.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipadelegation.py
+++ b/plugins/modules/ipadelegation.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipadnsconfig.py
+++ b/plugins/modules/ipadnsconfig.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -21,6 +20,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.


+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipadnsforwardzone.py
+++ b/plugins/modules/ipadnsforwardzone.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipadnsrecord.py
+++ b/plugins/modules/ipadnsrecord.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 """DNS Record ansible-freeipa module."""

 ANSIBLE_METADATA = {
@@ -866,8 +869,7 @@ from ansible.module_utils.ansible_freeipa_module import \
 import dns.reversename
 import dns.resolver

-import six
-
+from ansible.module_utils import six

 if six.PY3:
    unicode = str
--- a/plugins/modules/ipadnszone.py
+++ b/plugins/modules/ipadnszone.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
@@ -207,7 +210,7 @@ from ansible.module_utils.ansible_freeipa_module import (
    ipalib_errors
 )  # noqa: E402
 import netaddr
-import six
+from ansible.module_utils import six


 if six.PY3:
--- a/plugins/modules/ipagroup.py
+++ b/plugins/modules/ipagroup.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipahbacrule.py
+++ b/plugins/modules/ipahbacrule.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipahbacsvc.py
+++ b/plugins/modules/ipahbacsvc.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipahbacsvcgroup.py
+++ b/plugins/modules/ipahbacsvcgroup.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipahost.py
+++ b/plugins/modules/ipahost.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
@@ -403,7 +406,7 @@ host:
 from ansible.module_utils.ansible_freeipa_module import \
    IPAAnsibleModule, compare_args_ipa, gen_add_del_lists, \
    encode_certificate, is_ipv4_addr, is_ipv6_addr, ipalib_errors
-import six
+from ansible.module_utils import six
 if six.PY3:
    unicode = str

@@ -436,7 +439,7 @@ def find_dnsrecord(module, name):
    This function may raise ipalib_errors.NotFound in some cases,
    and it should be handled by the caller.
    """
-    domain_name = name[name.find(".")+1:]
+    domain_name = name[name.find(".") + 1:]
    host_name = name[:name.find(".")]

    _args = {
@@ -1228,7 +1231,7 @@ def main():
                         }])

                if len(dnsrecord_a_add) > 0 or len(dnsrecord_aaaa_add) > 0:
-                    domain_name = name[name.find(".")+1:]
+                    domain_name = name[name.find(".") + 1:]
                    host_name = name[:name.find(".")]

                    _args = {"idnsname": host_name}
@@ -1245,7 +1248,7 @@ def main():
                                     "dnsrecord_add", _args])

                if len(dnsrecord_a_del) > 0 or len(dnsrecord_aaaa_del) > 0:
-                    domain_name = name[name.find(".")+1:]
+                    domain_name = name[name.find(".") + 1:]
                    host_name = name[:name.find(".")]

                    # There seems to be an issue with dnsrecord_del (not
@@ -1361,7 +1364,7 @@ def main():

                    if "arecord" in dnsrecord_args or \
                       "aaaarecord" in dnsrecord_args:
-                        domain_name = name[name.find(".")+1:]
+                        domain_name = name[name.find(".") + 1:]
                        host_name = name[:name.find(".")]
                        dnsrecord_args["idnsname"] = host_name

--- a/plugins/modules/ipahostgroup.py
+++ b/plugins/modules/ipahostgroup.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipalocation.py
+++ b/plugins/modules/ipalocation.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipapermission.py
+++ b/plugins/modules/ipapermission.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipaprivilege.py
+++ b/plugins/modules/ipaprivilege.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 """ansible-freeipa module to manage FreeIPA privileges."""


@@ -108,8 +111,9 @@ RETURN = """


 from ansible.module_utils.ansible_freeipa_module import \
-    IPAAnsibleModule, compare_args_ipa, gen_add_del_lists
-import six
+    IPAAnsibleModule, compare_args_ipa, gen_add_del_lists, gen_add_list, \
+    gen_intersection_list
+from ansible.module_utils import six

 if six.PY3:
    unicode = str
@@ -126,22 +130,6 @@ def find_privilege(module, name):
        return _result["result"]


-# pylint: disable=unused-argument
-def result_handler(module, result, command, name, args, errors):
-    # Get all errors
-    # All "already a member" and "not a member" failures in the
-    # result are ignored. All others are reported.
-    for failed_item in result.get("failed", []):
-        failed = result["failed"][failed_item]
-        for member_type in failed:
-            for member, failure in failed[member_type]:
-                if "already a member" in failure \
-                   or "not a member" in failure:
-                    continue
-                errors.append("%s: %s %s: %s" % (
-                    command, member_type, member, failure))
-
-
 def main():
    ansible_module = IPAAnsibleModule(
        argument_spec=dict(
@@ -230,47 +218,31 @@ def main():
                if action == "privilege":
                    # Found the privilege
                    if res_find is not None:
-                        res_cmp = {
-                            k: v for k, v in res_find.items()
-                            if k not in [
-                                "objectclass", "cn", "dn",
-                                "memberof_permisssion"
-                            ]
-                        }
-                        # For all settings is args, check if there are
-                        # different settings in the find result.
-                        # If yes: modify
-                        if args and not compare_args_ipa(ansible_module, args,
-                                                         res_cmp):
+                        cmp = {"description": res_find.get("description")}
+                        if not compare_args_ipa(ansible_module, args, cmp):
                            commands.append([name, "privilege_mod", args])
                    else:
                        commands.append([name, "privilege_add", args])
                        res_find = {}

-                    member_args = {}
-                    if permission:
-                        member_args['permission'] = permission
+                    # Generate addition and removal lists
+                    permission_add, permission_del = gen_add_del_lists(
+                        permission, res_find.get("memberof_permission")
+                    )

-                    if not compare_args_ipa(ansible_module, member_args,
-                                            res_find):
-
-                        # Generate addition and removal lists
-                        permission_add, permission_del = gen_add_del_lists(
-                                permission, res_find.get("member_permission"))
-
-                        # Add members
-                        if len(permission_add) > 0:
-                            commands.append([name, "privilege_add_permission",
-                                             {
-                                                 "permission": permission_add,
-                                             }])
-                        # Remove members
-                        if len(permission_del) > 0:
-                            commands.append([
-                                name,
-                                "privilege_remove_permission",
-                                {"permission": permission_del}
-                            ])
+                    # Add members
+                    if len(permission_add) > 0:
+                        commands.append([name, "privilege_add_permission",
+                                         {
+                                             "permission": permission_add,
+                                         }])
+                    # Remove members
+                    if len(permission_del) > 0:
+                        commands.append([
+                            name,
+                            "privilege_remove_permission",
+                            {"permission": permission_del}
+                        ])

                elif action == "member":
                    if res_find is None:
@@ -280,8 +252,11 @@ def main():
                    if permission is None:
                        ansible_module.fail_json(msg="No permission given")

-                    commands.append([name, "privilege_add_permission",
-                                     {"permission": permission}])
+                    permission = gen_add_list(
+                        permission, res_find.get("memberof_permission"))
+                    if permission:
+                        commands.append([name, "privilege_add_permission",
+                                         {"permission": permission}])

            elif state == "absent":
                if action == "privilege":
@@ -296,10 +271,11 @@ def main():
                    if permission is None:
                        ansible_module.fail_json(msg="No permission given")

-                    commands.append([name, "privilege_remove_permission",
-                                     {
-                                         "permission": permission,
-                                     }])
+                    permission = gen_intersection_list(
+                        permission, res_find.get("memberof_permission"))
+                    if permission:
+                        commands.append([name, "privilege_remove_permission",
+                                         {"permission": permission}])

            elif state == "renamed":
                if not rename:
@@ -318,7 +294,8 @@ def main():

        # Execute commands

-        changed = ansible_module.execute_ipa_commands(commands, result_handler)
+        changed = ansible_module.execute_ipa_commands(
+            commands, fail_on_member_errors=True)

    # Done

--- a/plugins/modules/ipapwpolicy.py
+++ b/plugins/modules/ipapwpolicy.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/iparole.py
+++ b/plugins/modules/iparole.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-
 """ansible-freeipa iparole module implementation."""

@@ -21,6 +20,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
@@ -101,7 +104,7 @@ EXAMPLES = """
 from ansible.module_utils._text import to_text
 from ansible.module_utils.ansible_freeipa_module import \
    IPAAnsibleModule, gen_add_del_lists, compare_args_ipa
-import six
+from ansible.module_utils import six


 if six.PY3:
--- a/plugins/modules/ipaselfservice.py
+++ b/plugins/modules/ipaselfservice.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipaserver.py
+++ b/plugins/modules/ipaserver.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipaservice.py
+++ b/plugins/modules/ipaservice.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
@@ -183,21 +186,23 @@ EXAMPLES = """
      ipaadmin_password: SomeADMINpassword
      name: HTTP/www.example.com
      certificate:
-        - MIIC/zCCAeegAwIBAgIUMNHIbn+hhrOVew/2WbkteisV29QwDQYJKoZIhvcNAQELBQAw
-        DzENMAsGA1UEAwwEdGVzdDAeFw0yMDAyMDQxNDQxMDhaFw0zMDAyMDExNDQxMDhaMA8xDT
-        ALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+XVVGFYpH
-        VkcDfVnNInE1Y/pFciegdzqTjMwUWlRL4Zt3u96GhaMLRbtk+OfEkzLUAhWBOwEraELJzM
-        LJOMvjYF3C+TiGO7dStFLikZmccuSsSIXjnzIPwBXa8KvgRVRyGLoVvGbLJvmjfMXp0nIT
-        oTx/i74KF9S++WEes9H5ErJ99CDhLKFgq0amnvsgparYXhypHaRLnikn0vQINt55YoEd1s
-        4KrvEcD2VdZkIMPbLRu2zFvMprF3cjQQG4LT9ggfEXNIPZ1nQWAnAsu7OJEkNF+E4Mkmpc
-        xj9aGUVt5bsq1D+Tzj3GsidSX0nSNcZ2JltXRnL/5v63g5cZyE+nAgMBAAGjUzBRMB0GA1
-        UdDgQWBBRV0j7JYukuH/r/t9+QeNlRLXDlEDAfBgNVHSMEGDAWgBRV0j7JYukuH/r/t9+Q
-        eNlRLXDlEDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCgVy1+1kNwHs
-        5y1Zp0WjMWGCJC6/zw7FDG4OW5r2GJiCXZYdJ0UonY9ZtoVLJPrp2/DAv1m5DtnDhBYqic
-        uPgLzEkOS1KdTi20Otm/J4yxLLrZC5W4x0XOeSVPXOJuQWfwQ5pPvKkn6WxYUYkGwIt1OH
-        2nSMngkbami3CbSmKZOCpgQIiSlQeDJ8oGjWFMLDymYSHoVOIXHwNoooyEiaio3693l6no
-        obyGv49zyCVLVR1DC7i6RJ186ql0av+D4vPoiF5mX7+sKC2E8xEj9uKQ5GTWRh59VnRBVC
-        /SiMJ/H78tJnBAvoBwXxSEvj8Z3Kjm/BQqZfv4IBsA5yqV7MVq
+        - >
+          MIIC/zCCAeegAwIBAgIUMNHIbn+hhrOVew/2WbkteisV29QwDQYJKoZIhvcNAQELBQAw
+          DzENMAsGA1UEAwwEdGVzdDAeFw0yMDAyMDQxNDQxMDhaFw0zMDAyMDExNDQxMDhaMA8x
+          DTALBgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+XVVG
+          FYpHVkcDfVnNInE1Y/pFciegdzqTjMwUWlRL4Zt3u96GhaMLRbtk+OfEkzLUAhWBOwEr
+          aELJzMLJOMvjYF3C+TiGO7dStFLikZmccuSsSIXjnzIPwBXa8KvgRVRyGLoVvGbLJvmj
+          fMXp0nIToTx/i74KF9S++WEes9H5ErJ99CDhLKFgq0amnvsgparYXhypHaRLnikn0vQI
+          Nt55YoEd1s4KrvEcD2VdZkIMPbLRu2zFvMprF3cjQQG4LT9ggfEXNIPZ1nQWAnAsu7OJ
+          EkNF+E4Mkmpcxj9aGUVt5bsq1D+Tzj3GsidSX0nSNcZ2JltXRnL/5v63g5cZyE+nAgMB
+          AAGjUzBRMB0GA1UdDgQWBBRV0j7JYukuH/r/t9+QeNlRLXDlEDAfBgNVHSMEGDAWgBRV
+          0j7JYukuH/r/t9+QeNlRLXDlEDAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUA
+          A4IBAQCgVy1+1kNwHs5y1Zp0WjMWGCJC6/zw7FDG4OW5r2GJiCXZYdJ0UonY9ZtoVLJP
+          rp2/DAv1m5DtnDhBYqicuPgLzEkOS1KdTi20Otm/J4yxLLrZC5W4x0XOeSVPXOJuQWfw
+          Q5pPvKkn6WxYUYkGwIt1OH2nSMngkbami3CbSmKZOCpgQIiSlQeDJ8oGjWFMLDymYSHo
+          VOIXHwNoooyEiaio3693l6noobyGv49zyCVLVR1DC7i6RJ186ql0av+D4vPoiF5mX7+s
+          KC2E8xEj9uKQ5GTWRh59VnRBVC/SiMJ/H78tJnBAvoBwXxSEvj8Z3Kjm/BQqZfv4IBsA
+          5yqV7MVq
      action: member
      state: present

@@ -224,7 +229,8 @@ RETURN = """

 from ansible.module_utils.ansible_freeipa_module import \
    IPAAnsibleModule, compare_args_ipa, encode_certificate, \
-    gen_add_del_lists, ipalib_errors
+    gen_add_del_lists, gen_add_list, gen_intersection_list, ipalib_errors, \
+    api_get_realm, to_text


 def find_service(module, name):
@@ -284,7 +290,8 @@ def gen_args_smb(netbiosname, ok_as_delegate, ok_to_auth_as_delegate):


 def check_parameters(module, state, action, names, parameters):
-    assert isinstance(parameters, dict)
+    if not isinstance(parameters, dict):
+        raise AssertionError("parameters is not a dict")

    # invalid parameters for everything but state 'present', action 'service'.
    invalid = ['pac_type', 'auth_ind', 'skip_host_check',
@@ -405,23 +412,6 @@ def init_ansible_module():
    return ansible_module


-# pylint: disable=unused-argument
-def result_handler(module, result, command, name, args, errors):
-    # Get all errors
-    # All "already a member" and "not a member" failures in the
-    # result are ignored. All others are reported.
-    if "failed" in result and len(result["failed"]) > 0:
-        for item in result["failed"]:
-            failed_item = result["failed"][item]
-            for member_type in failed_item:
-                for member, failure in failed_item[member_type]:
-                    if "already a member" in failure \
-                       or "not a member" in failure:
-                        continue
-                    errors.append("%s: %s %s: %s" % (
-                        command, member_type, member, failure))
-
-
 def main():
    ansible_module = init_ansible_module()

@@ -492,6 +482,30 @@ def main():

        for name in names:
            res_find = find_service(ansible_module, name)
+            res_principals = []
+
+            if principal and res_find:
+                # When comparing principals to the existing ones,
+                # the REALM is needded, and are added here for those
+                # that do not have it.
+                principal = [
+                    p if "@" in p
+                    else "%s@%s" % (p, api_get_realm())
+                    for p in principal
+                ]
+                principal = list(set(principal))
+
+                # Create list of existing principal aliases as strings
+                # to compare with provided ones.
+                canonicalname = {
+                    to_text(p)
+                    for p in res_find.get("krbcanonicalname", [])
+                }
+                res_principals = [
+                    to_text(elem)
+                    for elem in res_find.get("krbprincipalname", [])
+                ]
+                res_principals = list(set(res_principals) - canonicalname)

            if state == "present":
                if action == "service":
@@ -576,8 +590,8 @@ def main():
                        host_add, host_del = gen_add_del_lists(
                            host, res_find.get('managedby_host', []))

-                        principal_add, principal_del = gen_add_del_lists(
-                            principal, res_find.get("principal"))
+                        principal_add, principal_del = \
+                            gen_add_del_lists(principal, res_principals)

                        (allow_create_keytab_user_add,
                         allow_create_keytab_user_del) = \
@@ -637,58 +651,64 @@ def main():
                    if res_find is None:
                        ansible_module.fail_json(msg="No service '%s'" % name)

-                    existing = res_find.get('usercertificate', [])
-                    if certificate is None:
-                        certificate_add = []
-                    else:
-                        certificate_add = [c for c in certificate
-                                           if c not in existing]
+                    certificate_add = gen_add_list(
+                        certificate, res_find.get("usercertificate"))
                    certificate_del = []
-                    host_add = host or []
+                    host_add = gen_add_list(
+                        host, res_find.get("managedby_host"))
                    host_del = []
-                    principal_add = principal or []
+                    principal_add = gen_add_list(principal, res_principals)
                    principal_del = []

-                    allow_create_keytab_user_add = \
-                        allow_create_keytab_user or []
+                    allow_create_keytab_user_add = gen_add_list(
+                        allow_create_keytab_user,
+                        res_find.get("ipaallowedtoperform_write_keys_user")
+                    )
+
                    allow_create_keytab_user_del = []
-                    allow_create_keytab_group_add = \
-                        allow_create_keytab_group or []
+                    allow_create_keytab_group_add = gen_add_list(
+                        allow_create_keytab_group,
+                        res_find.get("ipaallowedtoperform_write_keys_group")
+                    )
                    allow_create_keytab_group_del = []
-                    allow_create_keytab_host_add = \
-                        allow_create_keytab_host or []
+                    allow_create_keytab_host_add = gen_add_list(
+                        allow_create_keytab_host,
+                        res_find.get("ipaallowedtoperform_write_keys_host")
+                    )
                    allow_create_keytab_host_del = []
-                    allow_create_keytab_hostgroup_add = \
-                        allow_create_keytab_hostgroup or []
+                    allow_create_keytab_hostgroup_add = gen_add_list(
+                        allow_create_keytab_hostgroup,
+                        res_find.get(
+                            "ipaallowedtoperform_write_keys_hostgroup")
+                    )
                    allow_create_keytab_hostgroup_del = []
-                    allow_retrieve_keytab_user_add = \
-                        allow_retrieve_keytab_user or []
+                    allow_retrieve_keytab_user_add = gen_add_list(
+                        allow_retrieve_keytab_user,
+                        res_find.get("ipaallowedtoperform_read_keys_user")
+                    )
                    allow_retrieve_keytab_user_del = []
-                    allow_retrieve_keytab_group_add = \
-                        allow_retrieve_keytab_group or []
+                    allow_retrieve_keytab_group_add = gen_add_list(
+                        allow_retrieve_keytab_group,
+                        res_find.get("ipaallowedtoperform_read_keys_group")
+                    )
                    allow_retrieve_keytab_group_del = []
-                    allow_retrieve_keytab_host_add = \
-                        allow_retrieve_keytab_host or []
+                    allow_retrieve_keytab_host_add = gen_add_list(
+                        allow_retrieve_keytab_host,
+                        res_find.get("ipaallowedtoperform_read_keys_host")
+                    )
                    allow_retrieve_keytab_host_del = []
-                    allow_retrieve_keytab_hostgroup_add = \
-                        allow_retrieve_keytab_hostgroup or []
+                    allow_retrieve_keytab_hostgroup_add = gen_add_list(
+                        allow_retrieve_keytab_hostgroup,
+                        res_find.get("ipaallowedtoperform_read_keys_hostgroup")
+                    )
                    allow_retrieve_keytab_hostgroup_del = []

-                # Add principals
-                for _principal in principal_add:
+                if principal_add:
                    commands.append([name, "service_add_principal",
-                                     {
-                                         "krbprincipalname":
-                                         _principal,
-                                     }])
-
-                # Remove principals
-                for _principal in principal_del:
+                                     {"krbprincipalname": principal_add}])
+                if principal_del:
                    commands.append([name, "service_remove_principal",
-                                     {
-                                         "krbprincipalname":
-                                         _principal,
-                                     }])
+                                     {"krbprincipalname": principal_del}])

                for _certificate in certificate_add:
                    commands.append([name, "service_add_cert",
@@ -776,13 +796,12 @@ def main():
                        ansible_module.fail_json(msg="No service '%s'" % name)

                    # Remove principals
-                    if principal is not None:
-                        for _principal in principal:
-                            commands.append([name, "service_remove_principal",
-                                             {
-                                                 "krbprincipalname":
-                                                 _principal,
-                                             }])
+                    principal_del = gen_intersection_list(
+                        principal, res_principals)
+                    if principal_del:
+                        commands.append([name, "service_remove_principal",
+                                         {"krbprincipalname": principal_del}])
+
                    # Remove certificates
                    if certificate is not None:
                        existing = res_find.get('usercertificate', [])
@@ -795,28 +814,71 @@ def main():
                                                 }])

                    # Add hosts
+                    host = gen_intersection_list(
+                        host, res_find.get("managedby_host"))
                    if host is not None:
                        commands.append(
                            [name, "service_remove_host", {"host": host}])

+                    allow_create_keytab_user_del = gen_intersection_list(
+                        allow_create_keytab_user,
+                        res_find.get("ipaallowedtoperform_write_keys_user")
+                    )
+                    allow_create_keytab_group_del = gen_intersection_list(
+                        allow_create_keytab_group,
+                        res_find.get("ipaallowedtoperform_write_keys_group")
+                    )
+                    allow_create_keytab_host_del = gen_intersection_list(
+                        allow_create_keytab_host,
+                        res_find.get("ipaallowedtoperform_write_keys_host")
+                    )
+                    allow_create_keytab_hostgroup_del = gen_intersection_list(
+                        allow_create_keytab_hostgroup,
+                        res_find.get(
+                            "ipaallowedtoperform_write_keys_hostgroup")
+                    )
+
                    # Allow create keytab
-                    if allow_create_keytab_user is not None or \
-                       allow_create_keytab_group is not None or \
-                       allow_create_keytab_host is not None or \
-                       allow_create_keytab_hostgroup is not None:
+                    if any([
+                        allow_create_keytab_user_del,
+                        allow_create_keytab_group_del,
+                        allow_create_keytab_host_del,
+                        allow_create_keytab_hostgroup_del
+                    ]):
                        commands.append(
                            [name, "service_disallow_create_keytab",
-                             {'user': allow_create_keytab_user,
-                              'group': allow_create_keytab_group,
-                              'host': allow_create_keytab_host,
-                              'hostgroup': allow_create_keytab_hostgroup
+                             {'user': allow_create_keytab_user_del,
+                              'group': allow_create_keytab_group_del,
+                              'host': allow_create_keytab_host_del,
+                              'hostgroup': allow_create_keytab_hostgroup_del
                              }])

+                    allow_retrieve_keytab_user_del = gen_intersection_list(
+                        allow_retrieve_keytab_user,
+                        res_find.get("ipaallowedtoperform_read_keys_user")
+                    )
+                    allow_retrieve_keytab_group_del = gen_intersection_list(
+                        allow_retrieve_keytab_group,
+                        res_find.get("ipaallowedtoperform_read_keys_group")
+                    )
+                    allow_retrieve_keytab_host_del = gen_intersection_list(
+                        allow_retrieve_keytab_host,
+                        res_find.get("ipaallowedtoperform_read_keys_host")
+                    )
+                    allow_retrieve_keytab_hostgroup_del = \
+                        gen_intersection_list(
+                            allow_retrieve_keytab_hostgroup,
+                            res_find.get(
+                                "ipaallowedtoperform_read_keys_hostgroup")
+                        )
+
                    # Allow retriev keytab
-                    if allow_retrieve_keytab_user is not None or \
-                       allow_retrieve_keytab_group is not None or \
-                       allow_retrieve_keytab_host is not None or \
-                       allow_retrieve_keytab_hostgroup is not None:
+                    if any([
+                        allow_retrieve_keytab_user_del,
+                        allow_retrieve_keytab_group_del,
+                        allow_retrieve_keytab_host_del,
+                        allow_retrieve_keytab_hostgroup_del
+                    ]):
                        commands.append(
                            [name, "service_disallow_retrieve_keytab",
                             {'user': allow_retrieve_keytab_user,
@@ -839,13 +901,9 @@ def main():
            else:
                ansible_module.fail_json(msg="Unkown state '%s'" % state)

-        # Check mode exit
-        if ansible_module.check_mode:
-            ansible_module.exit_json(changed=len(commands) > 0, **exit_args)
-
        # Execute commands
-
-        changed = ansible_module.execute_ipa_commands(commands, result_handler)
+        changed = ansible_module.execute_ipa_commands(
+            commands, fail_on_member_errors=True)

    # Done
    ansible_module.exit_json(changed=changed, **exit_args)
--- a/plugins/modules/ipasudocmd.py
+++ b/plugins/modules/ipasudocmd.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipasudocmdgroup.py
+++ b/plugins/modules/ipasudocmdgroup.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipasudorule.py
+++ b/plugins/modules/ipasudorule.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
@@ -456,11 +459,31 @@ def main():
                    sudooption_add, sudooption_del = gen_add_del_lists(
                        sudooption, res_find.get('ipasudoopt', []))

+                    # runasuser attribute can be used with both IPA and
+                    # non-IPA (external) users. IPA will handle the correct
+                    # attribute to properly store data, so we need to compare
+                    # the provided list against both users and external
+                    # users list.
                    runasuser_add, runasuser_del = gen_add_del_lists(
-                        runasuser, res_find.get('ipasudorunas_user', []))
+                        runasuser,
+                        (
+                            res_find.get('ipasudorunas_user', [])
+                            + res_find.get('ipasudorunasextuser', [])
+                        )
+                    )

+                    # runasgroup attribute can be used with both IPA and
+                    # non-IPA (external) groups. IPA will handle the correct
+                    # attribute to properly store data, so we need to compare
+                    # the provided list against both groups and external
+                    # groups list.
                    runasgroup_add, runasgroup_del = gen_add_del_lists(
-                        runasgroup, res_find.get('ipasudorunas_group', []))
+                        runasgroup,
+                        (
+                            res_find.get('ipasudorunas_group', [])
+                            + res_find.get('ipasudorunasextgroup', [])
+                        )
+                    )

                    # Add hosts and hostgroups
                    if len(host_add) > 0 or len(hostgroup_add) > 0:
@@ -593,14 +616,38 @@ def main():
                       "ipasudoopt" in res_find:
                        sudooption = gen_add_list(
                            sudooption, res_find["ipasudoopt"])
-                    if runasuser is not None and \
-                       "ipasudorunas_user" in res_find:
+                    # runasuser attribute can be used with both IPA and
+                    # non-IPA (external) users, so we need to compare
+                    # the provided list against both users and external
+                    # users list.
+                    if (
+                        runasuser is not None
+                        and (
+                            "ipasudorunas_user" in res_find
+                            or "ipasudorunasextuser" in res_find
+                        )
+                    ):
                        runasuser = gen_add_list(
-                            runasuser, res_find["ipasudorunas_user"])
-                    if runasgroup is not None and \
-                       "ipasudorunasgroup_group" in res_find:
+                            runasuser,
+                            (list(res_find.get('ipasudorunas_user', []))
+                             + list(res_find.get('ipasudorunasextuser', [])))
+                        )
+                    # runasgroup attribute can be used with both IPA and
+                    # non-IPA (external) groups, so we need to compare
+                    # the provided list against both users and external
+                    # groups list.
+                    if (
+                        runasgroup is not None
+                        and (
+                            "ipasudorunasgroup_group" in res_find
+                            or "ipasudorunasextgroup" in res_find
+                        )
+                    ):
                        runasgroup = gen_add_list(
-                            runasgroup, res_find["ipasudorunasgroup_group"])
+                            runasgroup,
+                            (list(res_find.get("ipasudorunasgroup_group", []))
+                             + list(res_find.get("ipasudorunasextgroup", [])))
+                        )

                    # Add hosts and hostgroups
                    if host is not None or hostgroup is not None:
@@ -724,17 +771,43 @@ def main():
                                sudooption, res_find["ipasudoopt"])
                        else:
                            sudooption = None
+                    # runasuser attribute can be used with both IPA and
+                    # non-IPA (external) users, so we need to compare
+                    # the provided list against both users and external
+                    # users list.
                    if runasuser is not None:
-                        if "ipasudorunas_user" in res_find:
+                        if (
+                            "ipasudorunas_user" in res_find
+                            or "ipasudorunasextuser" in res_find
+                        ):
                            runasuser = gen_intersection_list(
-                                runasuser, res_find["ipasudorunas_user"])
+                                runasuser,
+                                (
+                                    list(res_find.get('ipasudorunas_user', []))
+                                    + list(res_find.get(
+                                        'ipasudorunasextuser', []))
+                                )
+                            )
                        else:
                            runasuser = None
+                    # runasgroup attribute can be used with both IPA and
+                    # non-IPA (external) groups, so we need to compare
+                    # the provided list against both groups and external
+                    # groups list.
                    if runasgroup is not None:
-                        if "ipasudorunasgroup_group" in res_find:
+                        if (
+                            "ipasudorunasgroup_group" in res_find
+                            or "ipasudorunasextgroup" in res_find
+                        ):
                            runasgroup = gen_intersection_list(
                                runasgroup,
-                                res_find["ipasudorunasgroup_group"])
+                                (
+                                    list(res_find.get(
+                                        "ipasudorunasgroup_group", []))
+                                    + list(res_find.get(
+                                        "ipasudorunasextgroup", []))
+                                )
+                            )
                        else:
                            runasgroup = None

--- a/plugins/modules/ipatopologysegment.py
+++ b/plugins/modules/ipatopologysegment.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipatopologysuffix.py
+++ b/plugins/modules/ipatopologysuffix.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/plugins/modules/ipatrust.py
+++ b/plugins/modules/ipatrust.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {'metadata_version': '1.1',
                    'supported_by': 'community',
                    'status': ['preview'],
--- a/plugins/modules/ipauser.py
+++ b/plugins/modules/ipauser.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
@@ -472,7 +475,7 @@ user:
 from ansible.module_utils.ansible_freeipa_module import \
    IPAAnsibleModule, compare_args_ipa, gen_add_del_lists, date_format, \
    encode_certificate, load_cert_from_str, DN_x500_text, to_text
-import six
+from ansible.module_utils import six
 if six.PY3:
    unicode = str

@@ -696,8 +699,8 @@ def check_certmapdata(data):

    i = data.find("<I>", 4)
    s = data.find("<S>", i)   # pylint: disable=invalid-name
-    issuer = data[i+3:s]
-    subject = data[s+3:]
+    issuer = data[i + 3:s]
+    subject = data[s + 3:]

    if i < 0 or s < 0 or "CN" not in issuer or "CN" not in subject:
        return False
--- a/plugins/modules/ipavault.py
+++ b/plugins/modules/ipavault.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    "metadata_version": "1.0",
    "supported_by": "community",
--- a/requirements-tests.txt
+++ b/requirements-tests.txt
@@ -3,5 +3,4 @@ pytest>=2.7
 pytest-sourceorder>=0.5
 pytest-split-tests>=1.0.3
 pytest-testinfra>=5.0
-jmespath>=0.9  # needed for the `json_query` filter
 pyyaml>=3
--- a/roles/ipabackup/library/ipabackup_get_backup_dir.py
+++ b/roles/ipabackup/library/ipabackup_get_backup_dir.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -40,7 +43,8 @@ author:

 EXAMPLES = '''
 # Get IPA_BACKUP_DIR from ipaplatform
- name: ipabackup_get_backup_dir:
+- name: Get IPA_BACKUP_DIR from ipaplatform
+  ipabackup_get_backup_dir:
  register result
 '''

--- a/roles/ipaclient/action_plugins/ipaclient_get_otp.py
+++ b/roles/ipaclient/action_plugins/ipaclient_get_otp.py
@@ -17,6 +17,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 try:
    import gssapi
 except ImportError:
--- a/roles/ipaclient/library/ipaclient_api.py
+++ b/roles/ipaclient/library/ipaclient_api.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {'metadata_version': '1.0',
                    'status': ['preview'],
                    'supported_by': 'community'}
--- a/roles/ipaclient/library/ipaclient_fix_ca.py
+++ b/roles/ipaclient/library/ipaclient_fix_ca.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {'metadata_version': '1.0',
                    'status': ['preview'],
                    'supported_by': 'community'}
--- a/roles/ipaclient/library/ipaclient_fstore.py
+++ b/roles/ipaclient/library/ipaclient_fstore.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_get_facts.py
+++ b/roles/ipaclient/library/ipaclient_get_facts.py
@@ -1,6 +1,9 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 DOCUMENTATION = """
 ---
 module: ipaclient_get_facts
@@ -12,9 +15,9 @@ author:

 import os
 import re
-import six
+from ansible.module_utils import six
 try:
-    from six.moves.configparser import RawConfigParser
+    from ansible.module_utils.six.moves.configparser import RawConfigParser
 except ImportError:
    from ConfigParser import RawConfigParser

@@ -81,7 +84,8 @@ def is_dogtag_configured(subsystem):
    # ca / kra is configured when the directory
    # /var/lib/pki/pki-tomcat/[ca|kra] # exists
    available_subsystems = {'ca', 'kra'}
-    assert subsystem in available_subsystems
+    if subsystem not in available_subsystems:
+        raise AssertionError("Subsystem '%s' not available" % subsystem)

    return os.path.isdir(os.path.join(VAR_LIB_PKI_TOMCAT, subsystem))

@@ -120,7 +124,7 @@ def get_ipa_conf():
        basedn=basedn,
        realm=realm,
        domain=domain
-        )
+    )


 def get_ipa_version():
@@ -147,7 +151,7 @@ def get_ipa_version():
            vendor_version=version.VENDOR_VERSION,
            version=version.VERSION,
            version_info=version_info
-            )
+        )


 def main():
@@ -193,7 +197,7 @@ def main():
    module.exit_json(
        changed=False,
        ansible_facts=dict(ipa=facts)
-        )
+    )


 if __name__ == '__main__':
--- a/roles/ipaclient/library/ipaclient_get_otp.py
+++ b/roles/ipaclient/library/ipaclient_get_otp.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -20,6 +19,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {'metadata_version': '1.0',
                    'status': ['preview'],
                    'supported_by': 'community'}
@@ -121,9 +124,9 @@ host:
 '''

 import os
-import six

 from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils import six

 from ipalib import api, errors
 from ipaplatform.paths import paths
--- a/roles/ipaclient/library/ipaclient_ipa_conf.py
+++ b/roles/ipaclient/library/ipaclient_ipa_conf.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_join.py
+++ b/roles/ipaclient/library/ipaclient_join.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -179,7 +182,7 @@ def main():
    if password is None and admin_keytab is None:
        module.fail_json(msg="Password or admin_keytab is needed")

-    client_domain = hostname[hostname.find(".")+1:]
+    client_domain = hostname[hostname.find(".") + 1:]
    nolog = tuple()
    env = {'PATH': SECURE_PATH}
    fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE)
--- a/roles/ipaclient/library/ipaclient_set_hostname.py
+++ b/roles/ipaclient/library/ipaclient_set_hostname.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_automount.py
+++ b/roles/ipaclient/library/ipaclient_setup_automount.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_firefox.py
+++ b/roles/ipaclient/library/ipaclient_setup_firefox.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_krb5.py
+++ b/roles/ipaclient/library/ipaclient_setup_krb5.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_nis.py
+++ b/roles/ipaclient/library/ipaclient_setup_nis.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_nss.py
+++ b/roles/ipaclient/library/ipaclient_setup_nss.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_ntp.py
+++ b/roles/ipaclient/library/ipaclient_setup_ntp.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_ssh.py
+++ b/roles/ipaclient/library/ipaclient_setup_ssh.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaclient/library/ipaclient_setup_sssd.py
+++ b/roles/ipaclient/library/ipaclient_setup_sssd.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -156,7 +159,7 @@ def main():
    options.krb5_offline_passwords = not options.no_krb5_offline_passwords

    fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE)
-    client_domain = hostname[hostname.find(".")+1:]
+    client_domain = hostname[hostname.find(".") + 1:]

    if configure_sssd_conf(fstore, cli_realm, cli_domain, cli_server,
                           options, client_domain, hostname):
--- a/roles/ipaclient/library/ipaclient_test.py
+++ b/roles/ipaclient/library/ipaclient_test.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -197,7 +200,7 @@ import socket
 import inspect

 try:
-    from six.moves.configparser import RawConfigParser
+    from ansible.module_utils.six.moves.configparser import RawConfigParser
 except ImportError:
    from ConfigParser import RawConfigParser

@@ -319,7 +322,7 @@ def main():
    if options.domain_name is None and options.servers is not None:
        if len(options.servers) > 0:
            options.domain_name = options.servers[0][
-                options.servers[0].find(".")+1:]
+                options.servers[0].find(".") + 1:]

    try:
        self = options
@@ -701,7 +704,7 @@ def main():
                cli_domain_source = ds.domain_source
                logger.debug("will use discovered domain: %s", cli_domain)

-        client_domain = hostname[hostname.find(".")+1:]
+        client_domain = hostname[hostname.find(".") + 1:]

        if ret in (ipadiscovery.NO_LDAP_SERVER, ipadiscovery.NOT_IPA_SERVER) \
                or not ds.server:
--- a/roles/ipaclient/library/ipaclient_test_keytab.py
+++ b/roles/ipaclient/library/ipaclient_test_keytab.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -131,7 +134,7 @@ def main():
    kdc = module.params.get('kdc')
    kinit_attempts = module.params.get('kinit_attempts')

-    client_domain = hostname[hostname.find(".")+1:]
+    client_domain = hostname[hostname.find(".") + 1:]
    host_principal = 'host/%s@%s' % (hostname, realm)
    sssd = True

--- a/roles/ipaclient/module_utils/ansible_ipa_client.py
+++ b/roles/ipaclient/module_utils/ansible_ipa_client.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 __all__ = ["gssapi", "version", "ipadiscovery", "api", "errors", "x509",
           "constants", "sysrestore", "certmonger", "certstore",
           "delete_persistent_client_session_data", "ScriptError",
@@ -60,7 +63,7 @@ else:
        # See ipapython/version.py
        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in
                                             VERSION.split(".", 2)]
-        IPA_PYTHON_VERSION = IPA_MAJOR*10000 + IPA_MINOR*100 + IPA_RELEASE
+        IPA_PYTHON_VERSION = IPA_MAJOR * 10000 + IPA_MINOR * 100 + IPA_RELEASE
    else:
        IPA_PYTHON_VERSION = NUM_VERSION

--- a/roles/ipareplica/library/ipareplica_add_to_ipaservers.py
+++ b/roles/ipareplica/library/ipareplica_add_to_ipaservers.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
@@ -63,7 +64,6 @@ RETURN = '''
 '''

 import os
-import six

 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils.ansible_ipa_replica import (
@@ -72,6 +72,8 @@ from ansible.module_utils.ansible_ipa_replica import (
    gen_remote_api, api
 )

+from ansible.module_utils import six
+
 if six.PY3:
    unicode = str

--- a/roles/ipareplica/library/ipareplica_create_ipa_conf.py
+++ b/roles/ipareplica/library/ipareplica_create_ipa_conf.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_custodia_import_dm_password.py
+++ b/roles/ipareplica/library/ipareplica_custodia_import_dm_password.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_ds_apply_updates.py
+++ b/roles/ipareplica/library/ipareplica_ds_apply_updates.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_ds_enable_ssl.py
+++ b/roles/ipareplica/library/ipareplica_ds_enable_ssl.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_enable_ipa.py
+++ b/roles/ipareplica/library/ipareplica_enable_ipa.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_install_ca_certs.py
+++ b/roles/ipareplica/library/ipareplica_install_ca_certs.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_krb_enable_ssl.py
+++ b/roles/ipareplica/library/ipareplica_krb_enable_ssl.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_master_password.py
+++ b/roles/ipareplica/library/ipareplica_master_password.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipareplica/library/ipareplica_prepare.py
+++ b/roles/ipareplica/library/ipareplica_prepare.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
@@ -194,7 +195,6 @@ RETURN = '''
 import os
 import tempfile
 import traceback
-import six
 from shutil import copyfile

 from ansible.module_utils.basic import AnsibleModule
@@ -209,6 +209,7 @@ from ansible.module_utils.ansible_ipa_replica import (
    dns, no_matching_interface_for_ip_address_warning, adtrust,
    constants, api, redirect_stdout, replica_conn_check, tasks
 )
+from ansible.module_utils import six

 if six.PY3:
    unicode = str
--- a/roles/ipareplica/library/ipareplica_promote_openldap_conf.py
+++ b/roles/ipareplica/library/ipareplica_promote_openldap_conf.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_promote_sssd.py
+++ b/roles/ipareplica/library/ipareplica_promote_sssd.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_restart_kdc.py
+++ b/roles/ipareplica/library/ipareplica_restart_kdc.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_adtrust.py
+++ b/roles/ipareplica/library/ipareplica_setup_adtrust.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_ca.py
+++ b/roles/ipareplica/library/ipareplica_setup_ca.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_certmonger.py
+++ b/roles/ipareplica/library/ipareplica_setup_certmonger.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_custodia.py
+++ b/roles/ipareplica/library/ipareplica_setup_custodia.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_dns.py
+++ b/roles/ipareplica/library/ipareplica_setup_dns.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_ds.py
+++ b/roles/ipareplica/library/ipareplica_setup_ds.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_http.py
+++ b/roles/ipareplica/library/ipareplica_setup_http.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_kra.py
+++ b/roles/ipareplica/library/ipareplica_setup_kra.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_krb.py
+++ b/roles/ipareplica/library/ipareplica_setup_krb.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_setup_otpd.py
+++ b/roles/ipareplica/library/ipareplica_setup_otpd.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipareplica/library/ipareplica_test.py
+++ b/roles/ipareplica/library/ipareplica_test.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -249,7 +252,8 @@ def main():

    # If not defined, set domain from server name
    if installer.domain_name is None and installer.server is not None:
-        installer.domain_name = installer.server[installer.server.find(".")+1:]
+        installer.domain_name = \
+            installer.server[installer.server.find(".") + 1:]
    # If not defined, set realm from domain name
    if installer.realm_name is None and installer.domain_name is not None:
        installer.realm_name = installer.domain_name.upper()
--- a/roles/ipareplica/module_utils/ansible_ipa_replica.py
+++ b/roles/ipareplica/module_utils/ansible_ipa_replica.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 __all__ = ["contextlib", "dnsexception", "dnsresolver", "dnsreversename",
           "parse_version", "IPAChangeConf",
           "certstore", "sysrestore", "ipa_generate_password", "kinit_keytab",
@@ -62,7 +65,7 @@ else:
        # See ipapython/version.py
        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in
                                             VERSION.split(".", 2)]
-        IPA_PYTHON_VERSION = IPA_MAJOR*10000 + IPA_MINOR*100 + IPA_RELEASE
+        IPA_PYTHON_VERSION = IPA_MAJOR * 10000 + IPA_MINOR * 100 + IPA_RELEASE
    else:
        IPA_PYTHON_VERSION = NUM_VERSION

--- a/roles/ipaserver/library/ipaserver_enable_ipa.py
+++ b/roles/ipaserver/library/ipaserver_enable_ipa.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_load_cache.py
+++ b/roles/ipaserver/library/ipaserver_load_cache.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_master_password.py
+++ b/roles/ipaserver/library/ipaserver_master_password.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
--- a/roles/ipaserver/library/ipaserver_prepare.py
+++ b/roles/ipaserver/library/ipaserver_prepare.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_set_ds_password.py
+++ b/roles/ipaserver/library/ipaserver_set_ds_password.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_adtrust.py
+++ b/roles/ipaserver/library/ipaserver_setup_adtrust.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_ca.py
+++ b/roles/ipaserver/library/ipaserver_setup_ca.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_custodia.py
+++ b/roles/ipaserver/library/ipaserver_setup_custodia.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_dns.py
+++ b/roles/ipaserver/library/ipaserver_setup_dns.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_ds.py
+++ b/roles/ipaserver/library/ipaserver_setup_ds.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_http.py
+++ b/roles/ipaserver/library/ipaserver_setup_http.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_kra.py
+++ b/roles/ipaserver/library/ipaserver_setup_kra.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_krb.py
+++ b/roles/ipaserver/library/ipaserver_setup_krb.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_ntp.py
+++ b/roles/ipaserver/library/ipaserver_setup_ntp.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_setup_otpd.py
+++ b/roles/ipaserver/library/ipaserver_setup_otpd.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,7 +21,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-from __future__ import print_function
+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type

 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
--- a/roles/ipaserver/library/ipaserver_test.py
+++ b/roles/ipaserver/library/ipaserver_test.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 ANSIBLE_METADATA = {
    'metadata_version': '1.0',
    'supported_by': 'community',
@@ -209,7 +212,6 @@ RETURN = '''

 import os
 import sys
-import six
 import inspect
 import random
 from shutil import copyfile
@@ -226,6 +228,7 @@ from ansible.module_utils.ansible_ipa_server import (
    validate_domain_name, load_pkcs12, IPA_PYTHON_VERSION,
    encode_certificate, check_available_memory
 )
+from ansible.module_utils import six

 if six.PY3:
    unicode = str
@@ -923,7 +926,7 @@ def main():
    host_name = host_name.lower()

    if not options.domain_name:
-        domain_name = host_name[host_name.find(".")+1:]
+        domain_name = host_name[host_name.find(".") + 1:]
        try:
            validate_domain_name(domain_name)
        except ValueError as e:
--- a/roles/ipaserver/module_utils/ansible_ipa_server.py
+++ b/roles/ipaserver/module_utils/ansible_ipa_server.py
@@ -1,4 +1,3 @@
-#!/usr/bin/python
 # -*- coding: utf-8 -*-

 # Authors:
@@ -22,6 +21,10 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

+from __future__ import (absolute_import, division, print_function)
+
+__metaclass__ = type
+
 __all__ = ["IPAChangeConf", "certmonger", "sysrestore", "root_logger",
           "ipa_generate_password", "run", "ScriptError", "services",
           "tasks", "errors", "x509", "DOMAIN_LEVEL_0", "MIN_DOMAIN_LEVEL",
@@ -52,7 +55,7 @@ else:

    import logging
    from contextlib import contextmanager as contextlib_contextmanager
-    import six
+    from ansible.module_utils import six
    import base64

    from ipapython.version import NUM_VERSION, VERSION
@@ -61,7 +64,7 @@ else:
        # See ipapython/version.py
        IPA_MAJOR, IPA_MINOR, IPA_RELEASE = [int(x) for x in
                                             VERSION.split(".", 2)]
-        IPA_PYTHON_VERSION = IPA_MAJOR*10000 + IPA_MINOR*100 + IPA_RELEASE
+        IPA_PYTHON_VERSION = IPA_MAJOR * 10000 + IPA_MINOR * 100 + IPA_RELEASE
    else:
        IPA_PYTHON_VERSION = NUM_VERSION

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Thomas Woerner	9252284504	Merge pull request #668 from rjeffman/ipaservice_use_default_error_handler ipaservice: Use IPAAnsibleModule member result handler.	2021-11-29 15:38:08 +01:00
Thomas Woerner	9665769cfc	Merge pull request #683 from rjeffman/module_utils_lowercase_get ansible_module_utils: Add method to get parameters as lowercase.	2021-11-29 13:39:37 +01:00
Rafael Guterres Jeffman	7d02d4d409	ipaservice: Remove custom error handler. Use IPAAnsibleModule default error handler for member arguments instead of a custom one.	2021-11-26 10:55:57 -03:00
Rafael Guterres Jeffman	fb5f59db23	ipaservice: Use gen_*_lists to avoid unneded API calls. When managing ipaservice members, gen_add_del_lists, gen_add_list and get_intersection_list should be used and the result tested for empty sets so already existing or missing members are not added or removed again. This changes fixes this behavior, by applying these functions to all ipaservice members.	2021-11-25 15:16:44 -03:00
Thomas Woerner	90e8098bf4	Merge pull request #690 from rjeffman/shellcheck CI: Add supoprt for Shellcheck	2021-11-25 13:53:26 +01:00
Thomas Woerner	d615d3d4ed	Merge pull request #675 from rjeffman/automember_idempotence_issue automember: Fix behavior of unused parameters.	2021-11-25 13:50:04 +01:00
Rafael Guterres Jeffman	8ba665213f	linters: Fix shellcheck warnings in 'utils' scripts.	2021-11-24 21:01:29 -03:00
Rafael Guterres Jeffman	036891d09a	shellcheck: Run shellcheck as a Github action. Add shellcheck as an action to be executed on every PR.	2021-11-24 20:20:19 -03:00
Rafael Guterres Jeffman	93a441494d	pre-commit: Add shellcheck to pre-commit configuration. `Shellcheck` is a linter tool for shell scripts that is also used in Automation Hub. This change adds a pre-commit hook to run shellcheck on shell scripts. The hook uses a Docker image, which needs to be downloaded on the first run. It works well with `podman`.	2021-11-24 20:20:19 -03:00
Rafael Guterres Jeffman	77b72af1a2	Merge pull request #692 from t-woerner/add_backup_cleanup_to_build_galaxy_release build-galaxy-release: Cleanup of ipabackup_get_backup_dir.py link	2021-11-24 20:20:13 -03:00
Thomas Woerner	4bfde9b61a	Merge pull request #612 from rjeffman/ci_use_ansible_core CI: Test modules against Ansible core 2.11 and latest Ansible	2021-11-24 14:14:49 +01:00
Thomas Woerner	f113e7071e	build-galaxy-release: Cleanup of ipabackup_get_backup_dir.py link The link for plugins/modules/ipabackup_get_backup_dir.py from roles/ipabackup/library/ipabackup_get_backup_dir.py was left over after the script finished.	2021-11-24 13:02:24 +01:00
Rafael Guterres Jeffman	ef9f7fcb84	Merge pull request #691 from t-woerner/master_automationhub_fixes Changes needed to pass Automation Hub tests	2021-11-24 08:50:37 -03:00
Thomas Woerner	5c5b05a74f	pylint upstream: Ignore __metaclass__ __metaclass__ is required for all plugins to be able to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	fa94b14e91	yamllint: Fix EXAMPLE issues This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	cd3646ad67	shellcheck: Double quote to prevent globbing and word splitting This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	2e8c2f881f	Use `ansible.module_utils.six` instead of `six` This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	b88cab07ff	Add missing whitespace around arithmetic operator This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	f406de14e8	ipaclient_get_facts: Fix closing bracket does not match indentation This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	a86970efe1	Remove "’" from yaml files This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	0af208d271	Replace asserts with raise AssertionError This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	10b16a3bbf	Remove non-module shebang This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Thomas Woerner	5c871242a7	Add __future__ imports and __metaclass__ for automationhub This patch is needed to pass Automation Hub tests.	2021-11-24 10:07:02 +01:00
Rafael Guterres Jeffman	612b60766e	CI: Test modules against different Ansible versions. Currently, upstream CI test documentation against different Ansible versions, but playbook tests are only executed with Ansible 2.9 series. This patch add support for running playbook tests against Ansible 2.9, ansible-core 2.11, and against latest version of Ansible. As running all the tests for every PR would take too long, the tests for every PR use only Anisble 2.9, and are executed on Fedora-latest and CentOS 7 and 8. A new pipeline for nightly tests was added, which runs the tests in the same distros, using Ansible 2.9, latest and Ansible-core 2.11.	2021-11-16 12:03:08 -03:00
Thomas Woerner	d6eaf91225	Merge pull request #670 from rjeffman/ipapermission_fixes ipaprivilege: Fix permissions handling.	2021-11-12 13:19:41 +01:00
Thomas Woerner	cb95248ef5	Merge pull request #665 from rjeffman/fix_sudorule_idempotency sudorule: Fix runas with external users and groups.	2021-11-12 13:09:58 +01:00
Rafael Guterres Jeffman	ca0aed54b0	ansible_module_utils: Add method to get parameters as lowercase. Many module member attributes must be handled in a case insensitive manner. To ease handling these cases, a function and a method to get the module parameters converted to lowercase is provided.	2021-11-11 16:58:48 -03:00
Rafael Guterres Jeffman	17bba27abf	automember: Fix behavior of unused parameters. If a task with 'action: automember' tried to modify an automember rule and did not provide either 'inclusive' or 'exclusive' parameters, the regex for the missing arguments would be removed. This patch fixes this behavior to only modify those parameters that were set on the task, and leave the missing parameters in the state they were before the task. Tests have been updated to verify expected behavior. Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1976922	2021-11-03 18:01:40 -03:00
Rafael Guterres Jeffman	22f31d02f2	sudorule: Fix runas with external users and groups. When setting 'runasuser' or 'runasgroup' for a sudorule, either IPA or external users and groups can be used, but only IPA users and groups were being searched for when modifying the attributes, making this task not idempotent if an external group or user was used.. This patch fixes this issue by comparing users and groups to the IPA and external setting. The IPA CLI commands are slightly confusing, as the sudorule-add and sudorule-mod display separate options for internal and external users and groups, but these options are deprecated and do not work anymore, in favor of sudorule-add-runasuser and sudorule-add-runasgroup, which don't diferentiate between internal and external users, from the CLI user perspective.	2021-11-03 15:49:09 -03:00
Thomas Woerner	5e9a2e8c2e	Merge pull request #667 from rjeffman/fix_service_principal_idempotent_issue ipaservice: Fix idempotent behavior for principal aliases.	2021-11-03 15:52:07 +01:00
Rafael Guterres Jeffman	0757bfee0a	ipaprivilege: Fix module execution in check_mode. This patch removes the custom command result handler in favor of the IPAAnsibleModule default member handler and fixes creation of add and del lists of permissions, fixing the behavior of the moudule execution when 'check_mode: yes'.	2021-10-26 11:37:07 -03:00
Rafael Guterres Jeffman	1eff04a09a	ipaprivilege: fix creation of add/del lists for permissions. A wrong parameter 'member_permission' was being used to obtain the existing permissions, and was changed to 'memberof_permission'.	2021-10-26 09:43:13 -03:00
Rafael Guterres Jeffman	f43831407b	ipaservice: Fix idempotent behavior for principal aliases. When creating the lists to add/remove principal aliases, if the realm was not specified, the alias would be used as it did not matched the existing one, which has the realm part. This patch fixes the add/del list creation by adding the current API realm to each alias that does not have the realm part and then use this modified list to be compared against the existing principal list. This change also allows the use of the whole list in a single call to the IPA API to add/remove the principals, instead of a call for every one item in the list.	2021-10-25 16:15:16 -03:00