tests/azure: Deactivate NTP in prepare-build

In CentOS 8 and also Fedora the configuration and start of chrony
fails with

  Fatal error : adjtimex(0x8001) failed : Operation not permitted

For more information: https://bugzilla.redhat.com/show_bug.cgi?id=1772053

NTP will not be needed before a separate namespace is used for clocks.

.ansible-lint

@@ -1,40 +1,22 @@
----
 exclude_paths:
-  - .ansible-freeipa-tests/
-  - .cache/
-  - .github/
-  - .pre-commit-config.yaml
-  - .tox/
-  - .venv/
-  - .yamllint
-  - tests/azure/
-  - meta/runtime.yml
-  - requirements-docker.yml
-  - requirements-podman.yml
-
-kinds:
-  - playbook: '**/tests/**/test_*.yml'
-  - playbook: '**/playbooks/**/*.yml'
-  - playbook: '**/tests/ca-less/install_*_without_ca.yml'
-  - playbook: '**/tests/ca-less/clean_up_certificates.yml'
-  - playbook: '**/tests/external-signed-ca-with-automatic-copy/install-server-with-external-ca-with-automatic-copy.yml'
-  - playbook: '**/tests/external-signed-ca-with-manual-copy/install-server-with-external-ca-with-manual-copy.yml'
-  - playbook: '**/tests/user/create_users_json.yml'
-  - tasks: '**/tasks_*.yml'
-  - tasks: '**/env_*.yml'
+  - roles
+  - .tox
+  - .venv
 
 parseable: true
 
 quiet: false
 
 skip_list:
+  - '201'  # Trailing whitespace
+  - '204'  # Lines should be no longer than 160 chars
+  - '206'  # Variables should have spaces before and after: {{ var_name }}'
+  - '208'  # File permissions not mentioned
   - '301'  # Commands should not change things if nothing needs doing'
-  - '305'  # Use shell only when shell functionality is required
-  - '306'  # risky-shell-pipe
-  - yaml   # yamllint should be executed separately.
-  - experimental   # Do not run any experimental tests
-  - name[template] # Allow Jinja templating inside task names
-  - var-naming
+  - '305'  # Use shell only when shell functionality is required'
+  - '306'  # Shells that use pipes should set the pipefail option'
+  - '502'  # All tasks should be named
+  - '505'  # Referenced missing file
 
 use_default_rules: true
 

.github/workflows/ansible-test.yml

@@ -1,15 +0,0 @@
----
-name: ansible-test sanity
-on:
-  - push
-  - pull_request
-jobs:
-  ansible_test:
-    name: Verify ansible-test sanity
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 0
-      - name: Run ansible-test
-        run: bash tests/sanity/sanity.sh

.github/workflows/docs.yml

@@ -4,70 +4,13 @@ on:
   - push
   - pull_request
 jobs:
-  check_docs_oldest_supported:
-    name: Check Ansible Documentation with ansible-core 2.13.
+  check_docs:
+    name: Check Ansible Documentation.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v2
         with:
           python-version: '3.x'
-      - name: Install Ansible 2.13
-        run: |
-          python -m pip install "ansible-core >=2.13,<2.14"
       - name: Run ansible-doc-test
-        run: |
-          ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
-
-  check_docs_previous:
-    name: Check Ansible Documentation with ansible-core 2.14.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: '3.x'
-      - name: Install Ansible 2.14
-        run: |
-          python -m pip install "ansible-core >=2.14,<2.15"
-      - name: Run ansible-doc-test
-        run: |
-          ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
-
-  check_docs_current:
-    name: Check Ansible Documentation with ansible-core 2.15.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: '3.x'
-      - name: Install Ansible 2.15
-        run: |
-          python -m pip install "ansible-core >=2.15,<2.16"
-      - name: Run ansible-doc-test
-        run: |
-          ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
-
-  check_docs_ansible_latest:
-    name: Check Ansible Documentation with latest Ansible version.
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: '3.x'
-      - name: Install Ansible-latest
-        run: |
-          python -m pip install ansible
-      - name: Run ansible-doc-test
-        run: |
-          ANSIBLE_LIBRARY="." ANSIBLE_DOC_FRAGMENT_PLUGINS="." python utils/ansible-doc-test -v roles plugins
+        run: ANSIBLE_LIBRARY="." python utils/ansible-doc-test roles plugins

.github/workflows/lint.yml

@@ -4,74 +4,30 @@ on:
   - push
   - pull_request
 jobs:
-  ansible_lint:
-    name: Verify ansible-lint
+  linters:
+    name: Run Linters
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v2
         with:
-          fetch-depth: 0
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: "3.x"
+          python-version: "3.6"
+
       - name: Run ansible-lint
-        run: |
-          pip install "ansible-core>=2.16,<2.17" 'ansible-lint==6.22'
-          utils/build-galaxy-release.sh -ki
-          cd .galaxy-build
-          ansible-lint --profile production --exclude tests/integration/ --exclude tests/unit/ --parseable --nocolor
-
-  yamllint:
-    name: Verify yamllint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
+        uses: ansible/ansible-lint-action@master
         with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: "3.x"
-      - name: Run yaml-lint
-        uses: ibiqlik/action-yamllint@v3.1.1
-
-  flake8:
-    name: Verify flake8
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: "3.x"
-      - name: Run flake8
-        run: |
-            pip install flake8 flake8-bugbear
-            flake8
-
-  pylint:
-    name: Verify pylint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - uses: actions/setup-python@v5.1.0
-        with:
-          python-version: "3.x"
-      - name: Run pylint
-        run: |
-            pip install 'pylint>=3.0'
-            pylint plugins roles --disable=import-error
-
-  shellcheck:
-    name: Shellcheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
+          targets: |
+            tests/*.yml
+            tests/*/*.yml
+            tests/*/*/*.yml
+            playbooks/*.yml
+            playbooks/*/*.yml
         env:
-          SHELLCHECK_OPTS: -x
+          ANSIBLE_MODULE_UTILS: plugins/module_utils
+          ANSIBLE_LIBRARY: plugins/modules
+
+      - name: Run yaml-lint
+        uses: ibiqlik/action-yamllint@v1
+
+      - name: Run Python linters
+        uses: rjeffman/python-lint-action@v2

.github/workflows/readme.yml

@@ -1,18 +0,0 @@
----
-name: readme test
-on:
-  - push
-  - pull_request
-jobs:
-  ansible_test:
-    name: Verify readme
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.1.1
-        with:
-          fetch-depth: 1
-      - name: Run readme test
-        run: |
-          error=0
-          for i in roles/ipa*/README.md README-*.md; do grep -q $i README.md && echo "OK: $i" || { echo -e "\033[31;1mERROR: ${i} missing\033[0m"; error=1; } done
-          exit $error

.gitignore

@@ -1,15 +1,8 @@
 *.pyc
 *.retry
-*.swp
-
-# collection files
-freeipa-ansible_freeipa*.tar.gz
-redhat-rhel_idm*.tar.gz
-importer_result.json
 
 # ignore virtual environments
 /.tox/
 /.venv/
 
 tests/logs/
-TEST*.xml

.pre-commit-config.yaml

@@ -1,56 +1,31 @@
 ---
 repos:
 - repo: https://github.com/ansible/ansible-lint.git
-  rev: v24.5.0
+  rev: v4.3.5
   hooks:
   - id: ansible-lint
     always_run: false
     pass_filenames: true
     files: \.(yaml|yml)$
-    exclude: /env[^/]*.(yaml|yml)$
-    entry: |-
-        env
-        ANSIBLE_LIBRARY=./plugins/modules
-        ANSIBLE_MODULE_UTILS=./plugins/module_utils
-        ANSIBLE_DOC_FRAGMENT_PLUGINS=./plugins/doc_fragments
-        ansible-lint
-          --offline
-          --profile production
-          --exclude tests/integration/
-          --exclude tests/unit/
-          --parseable
-          --nocolor
+    entry: env ANSIBLE_LIBRARY=./plugins/modules ANSIBLE_MODULE_UTILS=./plugins/module_utils ansible-lint --force-color
 - repo: https://github.com/adrienverge/yamllint.git
-  rev: v1.35.1
+  rev: v1.25.0
   hooks:
   - id: yamllint
     files: \.(yaml|yml)$
-- repo: https://github.com/pycqa/flake8
-  rev: 7.0.0
+- repo: https://gitlab.com/pycqa/flake8
+  rev: 3.8.4
   hooks:
   - id: flake8
-- repo: https://github.com/pycqa/pylint
-  rev: v3.2.2
+- repo: https://gitlab.com/pycqa/pydocstyle
+  rev: 5.1.1
   hooks:
-  - id: pylint
-    args:
-    - --disable=import-error
-    files: \.py$
+  - id: pydocstyle
 - repo: local
   hooks:
   - id: ansible-doc-test
     name: Verify Ansible roles and module documentation.
-    language: python
+    language: script
     entry: utils/ansible-doc-test
     # args: ['-v', 'roles', 'plugins']
     files: ^.*.py$
-- repo: local
-  hooks:
-  - id: shellcheck
-    name: ShellCheck
-    language: system
-    entry: shellcheck
-    args: ['-x']
-    files: >
-      \.sh$
-      utils/sh*$

.yamllint

@@ -16,8 +16,13 @@ rules:
   truthy:
     allowed-values: ["yes", "no", "true", "false", "True", "False"]
     level: error
-  line-length:
-    max: 160
   # Disabled rules
+  document-start: disable
   indentation: disable
+  line-length: disable
+  colons: disable
+  empty-lines: disable
   comments: disable
+  comments-indentation: disable
+  trailing-spaces: disable
+  new-line-at-end-of-file: disable

README-automember.md

@@ -1,288 +0,0 @@
-Automember module
-===========
-
-Description
------------
-
-The automember module allows to ensure presence or absence of automember rules and manage automember rule conditions.
-
-Features
---------
-
-* Automember management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaautomember module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-Example playbook to make sure group automember rule is present with no conditions.
-
-```yaml
----
-- name: Playbook to ensure a group automember rule is present with no conditions
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        name: admins
-        description: "my automember rule"
-        automember_type: group
-```
-
-Example playbook to make sure group automember rule is present with conditions:
-
-```yaml
----
-- name: Playbook to add a group automember rule with two conditions
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-  - ipaautomember:
-      ipaadmin_password: SomeADMINpassword
-      name: admins
-      description: "my automember rule"
-      automember_type: group
-      inclusive:
-        - key: mail
-          expression: '@example.com$'
-      exclusive:
-        - key: uid
-          expression: "1234"
-```
-
-Example playbook to delete a group automember rule:
-
-```yaml
-- name: Playbook to delete a group automember rule
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        name: admins
-        description: "my automember rule"
-        automember_type: group
-        state: absent
-```
-
-Example playbook to add an inclusive condition to an existing rule
-
-```yaml
-- name: Playbook to add an inclusive condition to an existing rule
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        name: "My domain hosts"
-        description: "my automember condition"
-        automember_type: hostgroup
-        action: member
-        inclusive:
-          - key: fqdn
-            expression: ".*.mydomain.com"
-```
-
-Example playbook to ensure group membership for all users has been rebuilt
-
-```yaml
-- name: Playbook to ensure group membership for all users has been rebuilt
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: group
-        state: rebuilt
-```
-
-Example playbook to ensure group membership for given users has been rebuilt
-
-
-```yaml
-- name: Playbook to ensure group membership for given users has been rebuilt
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        users:
-        - user1
-        - user2
-        state: rebuilt
-```
-
-Example playbook to ensure hostgroup membership for all hosts has been rebuilt
-
-```yaml
-- name: Playbook to ensure hostgroup membership for all hosts has been rebuilt
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: hostgroup
-        state: rebuilt
-```
-
-Example playbook to ensure hostgroup membership for given hosts has been rebuilt
-
-```yaml
-- name: Playbook to ensure hostgroup membership for given hosts has been rebuilt
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        hosts:
-        - host1.mydomain.com
-        - host2.mydomain.com
-        state: rebuilt
-```
-
-Example playbook to ensure default group fallback_group for all unmatched group entries is set
-
-```yaml
-- name: Playbook to ensure default group fallback_group for all unmatched group entries is set
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: group
-        default_group: fallback_group
-```
-
-Example playbook to ensure default group for all unmatched group entries is not set
-
-```yaml
-- name: Playbook to ensure default group for all unmatched group entries is not set
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        default_group: ""
-        automember_type: group
-        state: absent
-```
-
-Example playbook to ensure default hostgroup fallback_hostgroup for all unmatched group entries
-
-```yaml
-- name: Playbook to ensure default hostgroup fallback_hostgroup for all unmatched group entries
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: hostgroup
-        default_group: fallback_hostgroup
-```
-
-Example playbook to ensure default hostgroup for all unmatched group entries is not set
-
-```yaml
-- name: Playbook to ensure default hostgroup for all unmatched group entries is not set
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: hostgroup
-        default_group: ""
-        state: absent
-```
-
-Example playbook to ensure all orphan automember group rules are removed:
-
-```yaml
-- name: Playbook to ensure all orphan automember group rules are removed
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: group
-        state: orphans_removed
-```
-
-Example playbook to ensure all orphan automember hostgroup rules are removed:
-
-```yaml
-- name: Playbook to ensure all orphan automember hostgroup rules are removed
-  hosts: ipaserver
-  become: yes
-  gather_facts: no
-  tasks:
-    - ipaautomember:
-        ipaadmin_password: SomeADMINpassword
-        automember_type: hostgroup
-        state: orphans_removed
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | Automember rule. | yes
-`description` | A description of this auto member rule. | no
-`automember_type` | Grouping to which the rule applies. It can be one of `group`, `hostgroup`. | yes
-`inclusive` | List of dictionaries in the format of `{'key': attribute, 'expression': inclusive_regex}` | no
-`exclusive` | List of dictionaries in the format of `{'key': attribute, 'expression': exclusive_regex}` | no
-`users` | Users to rebuild membership for. | no
-`hosts` | Hosts to rebuild membership for. | no
-`no_wait` | Don't wait for rebuilding membership. | no
-`default_group` | Default (fallback) group for all unmatched entries. Use the empty string "" for ensuring the default group is not set. | no
-`action` | Work on automember or member level. It can be one of `member` or `automember` and defaults to `automember`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, 'rebuilt'. 'orphans_removed' default: `present`. | no
-
-
-Authors
-=======
-
-Mark Hahl
-Thomas Woerner

README-automountkey.md

@@ -1,112 +0,0 @@
-Automountkey module
-=====================
-
-Description
------------
-
-The automountkey module allows management of keys within an automount map.
-
-It is desgined to follow the IPA api as closely as possible while ensuring ease of use.
-
-
-Features
---------
-* Automount key management
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaautomountkey module.
-
-Requirements
-------------
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to ensure presence of an automount key:
-
-```yaml
----
-- name: Playbook to manage automount key
-  hosts: ipaserver
-
-  tasks:
-  - name: ensure automount key TestKey is present
-    ipaautomountkey:
-      ipaadmin_password: SomeADMINpassword
-      location: TestLocation
-      mapname: TestMap
-      key: TestKey
-      info: 192.168.122.1:/exports
-      state: present
-```
-
-Example playbook to rename an automount map:
-
-```yaml
----
-- name: Playbook to add an automount map
-  hosts: ipaserver
-
-  tasks:
-  - name: ensure aumount key TestKey is renamed to NewKeyName
-    ipaautomountkey:
-      ipaadmin_password: password01
-      automountlocationcn: TestLocation
-      automountmapname: TestMap
-      automountkey: TestKey
-      newname: NewKeyName
-      state: renamed
-```
-
-Example playbook to ensure an automount key is absent:
-
-```yaml
----
-- name: Playbook to manage an automount key
-  hosts: ipaserver
-
-  tasks:
-  - name: ensure automount key TestKey is absent
-    ipaautomountkey:
-      ipaadmin_password: SomeADMINpassword
-      location: TestLocation
-      mapname: TestMap
-      key: TestKey
-      state: absent
-```
-
-
-Variables
-=========
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`location` \| `automountlocationcn` \| `automountlocation` | Location name. | yes
-`mapname` \|  `map` \| `automountmapname` \| `automountmap` | Map the key belongs to | yes
-`key` \| `name` \| `automountkey` | Automount key to manage | yes
-`rename` \| `new_name` \| `newautomountkey` | the name to change the key to if state is `renamed` | yes when state is `renamed`
-`info` \| `information` \| `automountinformation` | Mount information for the key | yes when state is `present`
-`state` | The state to ensure. It can be one of `present`, `absent` or `renamed`, default: `present`. | no
-
-Authors
-=======
-
-Chris Procter

README-automountlocation.md

@@ -1,113 +0,0 @@
-Automountlocation module
-=====================
-
-Description
------------
-
-The automountlocation module allows the addition and removal of locations for automount maps
-
-It is desgined to follow the IPA api as closely as possible while ensuring ease of use.
-
-
-Features
---------
-* Automount location management
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaautomountlocation module.
-
-Requirements
-------------
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to ensure presence of an automount location:
-
-```yaml
----
-- name: Playbook to add an automount location
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  - name: ensure a automount location named DMZ exists
-    ipaautomountlocation:
-      ipaadmin_password: SomeADMINpassword
-      name: DMZ
-      state: present
-
-```
-
-Example playbook to ensure presence of multiple automount locations:
-
-```yaml
----
-- name: Playbook to add an automount location
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  - name: ensure a automount location named DMZ exists
-    ipaautomountlocation:
-      ipaadmin_password: SomeADMINpassword
-      name:
-        - DMZ
-        - PROD
-        - development
-        - test
-      state: present
-```
-
-
-Example playbook to ensure absence of an automount location:
-
-```yaml
----
-- name: Playbook to ensure an automount location is absent
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  - name: ensure automount locations LOCATION1 and LOCATION2 do not exist
-    ipaautomountlocation:
-      ipaadmin_password: SomeADMINpassword
-      name:
-        - LOCATION1
-        - LOCATION2
-      state: absent
-```
-
-Variables
-=========
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` \| `location` | List of one or more automountlocation names. | yes
-`state` | The state to ensure. It can be one of `present`, or `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-Chris Procter

README-automountmap.md

@@ -1,109 +0,0 @@
-Automountmap module
-=====================
-
-Description
------------
-
-The automountmap module allows the addition and removal of maps within automount locations.
-
-It is desgined to follow the IPA api as closely as possible while ensuring ease of use.
-
-
-Features
---------
-* Automount map management
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaautomountmap module.
-
-Requirements
-------------
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-Example playbook to ensure presence of an automount map:
-
-```yaml
----
-- name: Playbook to add an automount map
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: ensure map named auto.DMZ in location DMZ is created
-    ipaautomountmap:
-      ipaadmin_password: SomeADMINpassword
-      name: auto.DMZ
-      location: DMZ
-      desc: "this is a map for servers in the DMZ"
-```
-
-Automount maps can contain a submount key, which defines a mount location within the map the references another map. On FreeIPA, this is known as an indirect map. An indirect automount map is equivalent to adding a proper automount key to a map, referencyng another map (this second map is the indirect map). Use `parent` and `mount` parameters to create an indirect automount map with ansible-freeipa, without the need to directly manage the automount keys.
-
-Example playbook to ensure an indirect automount map is present:
-
-```yaml
----
-- name: Playbook to add an indirect automount map
-  ipaautomountmap:
-    ipaadmin_password: SomeADMINpassword
-    name: auto.indirect
-    location: DMZ
-    parent: auto.DMZ
-    mount: dmz_indirect
-```
-
-Example playbook to ensure auto.DMZi is absent:
-
-```yaml
----
-- name: Playbook to remove an automount map
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: ensure map auto.DMZ has been removed
-    ipaautomountmap:
-      ipaadmin_password: SomeADMINpassword
-      name: auto.DMZ
-      location: DMZ
-      state: absent
-```
-
-
-Variables
-=========
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`name` \| `mapname` \| `map` \| `automountmapname` | Name of the map to manage | yes
-`location` \| `automountlocation` \| `automountlocationcn` | Location name. | yes
-`parentmap` | Parent map of the indirect map. Can only be used when creating new maps. Default: auto.master | no
-`mount` | Indirect map mount point, relative to parent map. | yes, if `parent` is used.
-`desc` \| `description` | Description of the map | yes
-`state` | The state to ensure. It can be one of `present`, or `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-- Chris Procter
-- Rafael Jeffman

README-cert.md

@@ -1,192 +0,0 @@
-Cert module
-============
-
-Description
------------
-
-The cert module makes it possible to request, revoke and retrieve SSL certificates for hosts, services and users.
-
-Features
---------
-
-* Certificate request
-* Certificate hold/release
-* Certificate revocation
-* Certificate retrieval
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipacert module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-* Some tool to generate a certificate signing request (CSR) might be needed, like `openssl`.
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-Example playbook to request a new certificate for a service:
-
-```yaml
----
-- name: Certificate request
-  hosts: ipaserver
-
-  tasks:
-  - name: Request a certificate for a web server
-    ipacert:
-      ipaadmin_password: SomeADMINpassword
-      state: requested
-      csr: |
-        -----BEGIN CERTIFICATE REQUEST-----
-        MIGYMEwCAQAwGTEXMBUGA1UEAwwOZnJlZWlwYSBydWxlcyEwKjAFBgMrZXADIQBs
-        HlqIr4b/XNK+K8QLJKIzfvuNK0buBhLz3LAzY7QDEqAAMAUGAytlcANBAF4oSCbA
-        5aIPukCidnZJdr491G4LBE+URecYXsPknwYb+V+ONnf5ycZHyaFv+jkUBFGFeDgU
-        SYaXm/gF8cDYjQI=
-        -----END CERTIFICATE REQUEST-----
-      principal: HTTP/www.example.com
-    register: cert
-```
-
-Example playbook to revoke an existing certificate:
-
-```yaml
----
-- name: Revoke certificate
-  hosts: ipaserver
-
-  tasks:
-  - name Revoke a certificate
-    ipacert:
-      ipaadmin_password: SomeADMINpassword
-      serial_number: 123456789
-      reason: 5
-      state: revoked
-```
-
-When revoking a certificate a mnemonic can also be used to set the revocation reason:
-
-```yaml
----
-- name: Revoke certificate
-  hosts: ipaserver
-
-  tasks:
-  - name Revoke a certificate
-    ipacert:
-      ipaadmin_password: SomeADMINpassword
-      serial_number: 123456789
-      reason: cessationOfOperation
-      state: revoked
-```
-
-Example to hold a certificate (alias for revoking a certificate with reason `certificateHold (6)`):
-
-```yaml
----
-- name: Hold a certificate
-  hosts: ipaserver
-
-  tasks:
-  - name: Hold certificate
-    ipacert:
-      ipaadmin_password: SomeADMINpassword
-      serial_number: 0xAB1234
-      state: held
-```
-
-Example playbook to release hold of certificate (may be used with any revoked certificates, despite of the rovoke reason):
-
-```yaml
----
-- name: Release hold
-  hosts: ipaserver
-
-  tasks:
-  - name: Take a revoked certificate off hold
-    ipacert:
-      ipaadmin_password: SomeADMINpassword
-      serial_number: 0xAB1234
-      state: released
-```
-
-Example playbook to retrieve a certificate and save it to a file in the target node:
-
-```yaml
----
-- name: Retriev certificate
-  hosts: ipaserver
-
-  tasks:
-  - name: Retrieve a certificate and save it to file 'cert.pem'
-    ipacert:
-      ipaadmin_password: SomeADMINpassword
-      certificate_out: cert.pem
-      state: retrieved
-```
-
-
-ipacert
--------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`csr` | X509 certificate signing request, in PEM format. | yes, if `state: requested`
-`principal` | Host/service/user principal for the certificate. | yes, if `state: requested`
-`add` \| `add_principal` | Automatically add the principal if it doesn't exist (service principals only). (bool) | no
-`profile_id` \| `profile` | Certificate Profile to use | no
-`ca` | Name of the issuing certificate authority. | no
-`chain` | Include certificate chain in output. (bool) | no
-`serial_number` | Certificate serial number. (int) | yes, if `state` is `retrieved`, `held`, `released` or `revoked`.
-`revocation_reason` \| `reason` | Reason for revoking the certificate. Use one of the reason strings, or the corresponding value: "unspecified" (0), "keyCompromise" (1), "cACompromise" (2), "affiliationChanged" (3), "superseded" (4), "cessationOfOperation" (5), "certificateHold" (6), "removeFromCRL" (8), "privilegeWithdrawn" (9), "aACompromise" (10) | yes, if `state: revoked`
-`certificate_out` | Write certificate (chain if `chain` is set) to this file, on the target node. | no
-`state` | The state to ensure. It can be one of `requested`, `held`, `released`, `revoked`, or `retrieved`. `held` is the same as revoke with reason "certificateHold" (6). `released` is the same as `cert-revoke-hold` on IPA CLI, releasing the hold status of a certificate. | yes
-
-
-Return Values
-=============
-
-Values are returned only if `state` is `requested` or `retrieved` and if `certificate_out` is not defined.
-
-Variable | Description | Returned When
--------- | ----------- | -------------
-`certificate` | Certificate fields and data. (dict) <br>Options: | if `state` is `requested` or `retrieved` and if `certificate_out` is not defined
-&nbsp; | `certificate` - Issued X509 certificate in PEM encoding. Will include certificate chain if `chain: true`. (list) | always 
-&nbsp; | `san_dnsname` - X509 Subject Alternative Name. | When DNSNames are present in the Subject Alternative Name extension of the issued certificate.
-&nbsp; | `issuer` - X509 distinguished name of issuer. | always
-&nbsp; | `subject` - X509 distinguished name of certificate subject. | always
-&nbsp; | `serial_number` - Serial number of the issued certificate. (int) | always
-&nbsp; | `revoked` - Revoked status of the certificate. (bool) | if certificate was revoked
-&nbsp; | `owner_user` - The username that owns the certificate. | if `state: retrieved` and certificate is owned by a user
-&nbsp; | `owner_host` - The host that owns the certificate. | if `state: retrieved` and certificate is owned by a host
-&nbsp; | `owner_service` - The service that owns the certificate. | if `state: retrieved` and certificate is owned by a service
-&nbsp; | `valid_not_before` - Time when issued certificate becomes valid, in GeneralizedTime format (YYYYMMDDHHMMSSZ) | always
-&nbsp; | `valid_not_after` - Time when issued certificate ceases to be valid, in GeneralizedTime format (YYYYMMDDHHMMSSZ) | always
-
-
-Authors
-=======
-
-Sam Morris
-Rafael Jeffman

README-config.md

@@ -25,7 +25,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -56,18 +56,15 @@ Example playbook to read config options:
       register: result
     - name: display default login shell
       debug:
-        msg: '{{ result.config.defaultshell }}'
+        msg: '{{result.config.defaultlogin }}'
 
     - name: ensure defaultloginshell and maxusernamelength are set as required
       ipaconfig:
         ipaadmin_password: password
-        defaultshell: /bin/bash
+        defaultlogin: /bin/bash
         maxusername: 64
 ```
 
-
-Example playbook to set global configuration options:
-
 ```yaml
 ---
 - name: Playbook to ensure some config options are set
@@ -82,51 +79,18 @@ Example playbook to set global configuration options:
 ```
 
 
-Example playbook to enable SID and generate users and groups SIDs:
-
-```yaml
----
-- name: Playbook to ensure SIDs are enabled and users and groups have SIDs
-  hosts: ipaserver
-  become: no
-  gather_facts: no
-
-  tasks:
-    - name: Enable SID and generate users and groups SIDS
-      ipaconfig:
-        ipaadmin_password: SomeADMINpassword
-        enable_sid: yes
-        add_sids: yes
-```
-
-Example playbook to change IPA domain NetBIOS name:
-
-```yaml
----
-- name: Playbook to change IPA domain netbios name
-  hosts: ipaserver
-  become: no
-  gather_facts: no
-
-  tasks:
-    - name: Set IPA domain netbios name
-      ipaconfig:
-        ipaadmin_password: SomeADMINpassword
-        enable_sid: yes
-        netbios_name: IPADOM
-```
-
 Variables
 =========
 
+ipauser
+-------
+
 **General Variables:**
 
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `maxusername` \| `ipamaxusernamelength` |  Set the maximum username length (1 to 255) | no
 `maxhostname` \| `ipamaxhostnamelength` |  Set the maximum hostname length between 64-255. Only usable with IPA versions 4.8.0 and up. | no
 `homedirectory` \| `ipahomesrootdir` |  Set the default location of home directories | no
@@ -145,12 +109,9 @@ Variable | Description | Required
 `selinuxusermaporder` \| `ipaselinuxusermaporder`| Set ordered list in increasing priority of SELinux users | no
 `selinuxusermapdefault`\| `ipaselinuxusermapdefault` |  Set default SELinux user when no match is found in SELinux map rule | no
 `pac_type` \| `ipakrbauthzdata` |  set default types of PAC supported for services (choices: `MS-PAC`, `PAD`, `nfs:NONE`). Use `""` to clear this variable. | no
-`user_auth_type` \| `ipauserauthtype` |  set default types of supported user authentication (choices: `password`, `radius`, `otp`, `pkinit`, `hardened`, `idp`, `disabled`, `""`). An additional check ensures that only types can be used that are supported by the IPA version. Use `""` to clear this variable. | no
+`user_auth_type` \| `ipauserauthtype` |  set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`). Use `""` to clear this variable. | no
 `domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | no
 `ca_renewal_master_server` \| `ipacarenewalmasterserver`| Renewal master for IPA certificate authority. | no
-`enable_sid` | New users and groups automatically get a SID assigned. Cannot be deactivated once activated. Requires IPA 4.9.8+. (bool) | no
-`netbios_name` | NetBIOS name of the IPA domain. Requires IPA 4.9.8+ and SID generation to be activated. | no
-`add_sids` | Add SIDs for existing users and groups. Requires IPA 4.9.8+ and SID generation to be activated. (bool) | no
 
 
 Return Values
@@ -180,8 +141,6 @@ Variable | Description | Returned When
   | `user_auth_type` |  
   | `domain_resolution_order` |  
   | `ca_renewal_master_server` |  
-  | `enable_sid` |  
-  | `netbios_name` |  
 
 All returned fields take the same form as their namesake input parameters
 

README-delegation.md

@@ -23,7 +23,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -135,12 +135,13 @@ Example playbook to make sure delegation "basic manager attributes" is absent:
 Variables
 ---------
 
+ipadelegation
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `aciname` | The list of delegation name strings. | yes
 `permission` \| `permissions` |  The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no
 `attribute` \| `attrs` | The attribute list to which the delegation applies. | no

README-dnsconfig.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -71,7 +71,6 @@ Example playbook to ensure a global forwarder, with a custom port, is absent:
       forwarders:
           - ip_address: 2001:4860:4860::8888
             port: 53
-      action: member
       state: absent
 ```
 
@@ -120,19 +119,19 @@ Example playbook to disallow synchronization of forward (A, AAAA) and reverse (P
 Variables
 =========
 
+ipadnsconfig
+------------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `forwarders` | The list of forwarders dicts. Each `forwarders` dict entry has:| no
   | `ip_address` - The IPv4 or IPv6 address of the DNS server. | yes
   | `port` - The custom port that should be used on this server. | no
-`forward_policy` \| `forwardpolicy` | The global forwarding policy. It can be one of `only`, `first`, or `none`.  | no
+`forward_policy` | The global forwarding policy. It can be one of `only`, `first`, or `none`.  | no
 `allow_sync_ptr` | Allow synchronization of forward (A, AAAA) and reverse (PTR) records (bool). | yes
-`action` | Work on dnsconfig or member level. It can be one of `member` or `dnsconfig` and defaults to `dnsconfig`. Only `forwarders` can be managed with `action: member`. | no
-`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. `absent` can only be used with `action: member` and `forwarders`. | yes
+`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes
 
 
 Authors

README-dnsforwardzone.md

@@ -21,7 +21,7 @@ FreeIPA versions 4.4.0 and up are supported by the ipadnsforwardzone module.
 Requirements
 ------------
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -100,17 +100,18 @@ Example playbook to ensure presence of a forwardzone to ipa DNS:
 Variables
 =========
 
+ipagroup
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | Zone name (FQDN). | yes if `state` == `present`
 `forwarders` \| `idnsforwarders` |  Per-zone forwarders. A custom port can be specified for each forwarder. Options | no
   | `ip_address`: The forwarder IP address. | yes
   | `port`: The forwarder IP port. | no
-`forwardpolicy` \| `idnsforwardpolicy` \| `forward_policy` | Per-zone conditional forwarding policy. Possible values are `only`, `first`, `none`. Set to "none" to disable forwarding to global forwarder for this zone. In that case, conditional zone forwarders are disregarded. | no
+`forwardpolicy` \| `idnsforwardpolicy` | Per-zone conditional forwarding policy. Possible values are `only`, `first`, `none`. Set to "none" to disable forwarding to global forwarder for this zone. In that case, conditional zone forwarders are disregarded. | no
 `skip_overlap_check` | Force DNS zone creation even if it will overlap with an existing zone. Defaults to False. | no
 `permission` | Allow DNS Forward Zone to be managed. (bool) | no
 `action` | Work on group or member level. It can be on of `member` or `dnsforwardzone` and defaults to `dnsforwardzone`. | no

README-dnsrecord.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -242,12 +242,13 @@ Example playbook to ensure multiple DNS records are absent:
 Variables
 =========
 
+ipadnsrecord
+------------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `zone_name` \| `dnszone` | The DNS zone name to which DNS record needs to be managed. You can use one global zone name for multiple records. | no
   required: true
 `records` | The list of dns records dicts. Each `records` dict entry can contain **record variables**. | no

README-dnszone.md

@@ -23,7 +23,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 
 **Node**
@@ -84,6 +84,7 @@ Example playbook to create a DNS zone with all currently supported variables:
         - ip_address: 8.8.8.8
         - ip_address: 8.8.4.4
           port: 52
+      serial: 1234
       refresh: 3600
       retry: 900
       expire: 1209600
@@ -133,22 +134,6 @@ Example playbook to enable a zone:
       state: enabled
 ```
 
-Example playbook to allow per-zone privilege delegation:
-
-```yaml
----
-- name: Playbook to enable per-zone privilege delegation
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  - name: Enable privilege delegation.
-    ipadnszone:
-      ipaadmin_password: SomeADMINpassword
-      name: testzone.local
-      permission: true
-```
-
 
 Example playbook to remove a zone:
 ```yaml
@@ -211,12 +196,13 @@ Example playbook to create a zone for reverse DNS lookup, from an IP address, gi
 Variables
 =========
 
+ipadnszone
+----------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `zone_name` | The zone name string or list of strings. | no
 `name_from_ip` | Derive zone name from reverse of IP (PTR). Can only be used with `state: present`. | no
 `forwarders` | The list of forwarders dicts. Each `forwarders` dict entry has:| no
@@ -232,6 +218,7 @@ Variable | Description | Required
 `dnssec`| Allow inline DNSSEC signing of records in the zone | no
 `allow_transfer`| List of IP addresses or networks which are allowed to transfer the zone | no
 `allow_query`| List of IP addresses or networks which are allowed to issue queries | no
+`serial`| SOA record serial number | no
 `refresh`| SOA record refresh time | no
 `retry`| SOA record retry time | no
 `expire`| SOA record expire time | no
@@ -239,7 +226,6 @@ Variable | Description | Required
 `ttl`| Time to live for records at zone apex | no
 `default_ttl`| Time to live for records without explicit TTL definition | no
 `nsec3param_rec`| NSEC3PARAM record for zone in format: hash_algorithm flags iterations salt | no
-`permission` \| `managedby` | Set per-zone access delegation permission. | no
 `skip_overlap_check`| Force DNS zone creation even if it will overlap with an existing zone | no
 `skip_nameserver_check` | Force DNS zone creation even if nameserver is not resolvable | no
 
@@ -247,6 +233,9 @@ Variable | Description | Required
 Return Values
 =============
 
+ipadnszone
+----------
+
 Variable | Description | Returned When
 -------- | ----------- | -------------
 `dnszone` | DNS Zone dict with zone name infered from `name_from_ip`. <br>Options: |  If `state` is `present`, `name_from_ip` is used, and a zone was created.
@@ -255,6 +244,4 @@ Variable | Description | Returned When
 Authors
 =======
 
-- Sergio Oliveira Campos
-- Thomas Woerner
-- Rafael Jeffman
+Sergio Oliveira Campos

README-group.md

@@ -8,9 +8,6 @@ The group module allows to ensure presence and absence of groups and members of
 
 The group module is as compatible as possible to the Ansible upstream `ipa_group` module, but additionally offers to add users to a group and also to remove users from a group.
 
-## Note
-Ensuring presence (adding) of several groups with mixed types (`external`, `nonposix` and `posix`) requires a fix in FreeIPA. The module implements a workaround to automatically use `client` context if the fix is not present in the target node FreeIPA and if more than one group is provided to the task using the `groups` parameter. If `ipaapi_context` is forced to be `server`, the module will fail in this case.
-
 
 Features
 --------
@@ -29,7 +26,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -74,101 +71,6 @@ Example playbook to add groups:
       name: appops
 ```
 
-These three `ipagroup` module calls can be combined into one with the `groups` variable:
-
-```yaml
----
-- name: Playbook to handle groups
-  hosts: ipaserver
-
-  tasks:
-  - name: Ensure groups ops, sysops and appops are present
-    ipagroup:
-      ipaadmin_password: SomeADMINpassword
-      groups:
-      - name: ops
-        gidnumber: 1234
-      - name: sysops
-        user:
-        - pinky
-      - name: appops
-```
-
-You can also alternatively use a json file containing the groups, here `groups_present.json`:
-
-```json
-{
-  "groups": [
-    {
-      "name": "group1",
-      "description": "description group1"
-    },
-    {
-      "name": "group2",
-      "description": "description group2"
-    }
-  ]
-}
-```
-
-And ensure the presence of the groups with this example playbook:
-
-```yaml
----
-- name: Tests
-  hosts: ipaserver
-  gather_facts: false
-
-  tasks:
-  - name: Include groups_present.json
-    include_vars:
-      file: groups_present.json
-
-  - name: Groups present
-    ipagroup:
-      ipaadmin_password: SomeADMINpassword
-      groups: "{{ groups }}"
-```
-
-Example playbook to rename a group:
-
-```yaml
----
-- name: Playbook to rename a single group
-  hosts: ipaserver
-  become: false
-  gather_facts: false
-
-  tasks:
-  - name: Rename group appops to webops
-    ipagroup:
-      ipaadmin_password: SomeADMINpassword
-      name: appops
-      rename: webops
-      state: renamed
-```
-
-Several groups can also be renamed with a single task, as in the example playbook:
-
-```yaml
----
-- name: Playbook to rename multiple groups
-  hosts: ipaserver
-  become: false
-  gather_facts: false
-
-  tasks:
-  - name: Rename group1 to newgroup1 and group2 to newgroup2
-    ipagroup:
-      ipaadmin_password: SomeADMINpassword
-      groups:
-      - name: group1
-        rename: newgroup1
-      - name: group2
-        rename: newgroup2
-      state: renamed
-```
-
 Example playbook to add users to a group:
 
 ```yaml
@@ -198,7 +100,7 @@ Example playbook to add group members to a group:
   become: true
 
   tasks:
-  # Add group members sysops and appops to group ops
+  # Add group members sysops and appops to group sysops
   - ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: ops
@@ -210,11 +112,11 @@ Example playbook to add group members to a group:
 Example playbook to add members from a trusted realm to an external group:
 
 ```yaml
----
+--
 - name: Playbook to handle groups.
   hosts: ipaserver
-  
-  tasks:
+  became: true
+
   - name: Create an external group and add members from a trust to it.
     ipagroup:
       ipaadmin_password: SomeADMINpassword
@@ -225,24 +127,6 @@ Example playbook to add members from a trusted realm to an external group:
       - WINIPA\\Developers
 ```
 
-Example playbook to add nonposix and external groups:
-
-```yaml
----
-- name: Playbook to add nonposix and external groups
-  hosts: ipaserver
-
-  tasks:
-  - name: Add nonposix group sysops and external group appops
-    ipagroup:
-      ipaadmin_password: SomeADMINpassword
-      groups:
-      - name: sysops
-        nonposix: true
-      - name: appops
-        external: true
-```
-
 Example playbook to remove groups:
 
 ```yaml
@@ -252,47 +136,30 @@ Example playbook to remove groups:
   become: true
 
   tasks:
-  # Remove groups sysops, appops and ops
+  # Remove goups sysops, appops and ops
   - ipagroup:
       ipaadmin_password: SomeADMINpassword
       name: sysops,appops,ops
       state: absent
 ```
 
-Example playbook to ensure groups are absent:
-
-```yaml
----
-- name: Playbook to handle groups
-  hosts: ipaserver
-
-  tasks:
-  - name: Ensure groups ops and sysops are absent
-    ipagroup:
-      ipaadmin_password: SomeADMINpassword
-      groups:
-      - name: ops
-      - name: sysops
-      state: absent
-```
 
 Variables
 =========
 
+ipagroup
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to <br/>. (bool) | no
 `name` \| `cn` | The list of group name strings. | no
-`groups` | The list of group dicts. Each `groups` dict entry can contain group variables.<br>There is one required option in the `groups` dict:| no
-&nbsp; | `name` - The group name string of the entry. | yes
 `description` | The group description string. | no
 `gid` \| `gidnumber` | The GID integer. | no
-`posix` | Create a non-POSIX group or change a non-POSIX to a posix group. `nonposix`, `posix` and `external` are mutually exclusive. (bool) | no
-`nonposix` | Create as a non-POSIX group. `nonposix`, `posix` and `external` are mutually exclusive. (bool) | no
-`external` | Allow adding external non-IPA members from trusted domains. `nonposix`, `posix` and `external` are mutually exclusive. (bool) | no
+`posix` | Create a non-POSIX group or change a non-POSIX to a posix group. (bool) | no
+`nonposix` | Create as a non-POSIX group. (bool) | no
+`external` | Allow adding external non-IPA members from trusted domains. (bool) | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no
 `user` | List of user name strings assigned to this group. | no
 `group` | List of group name strings assigned to this group. | no
@@ -300,14 +167,11 @@ Variable | Description | Required
 `membermanager_user` | List of member manager users assigned to this group. Only usable with IPA versions 4.8.4 and up. | no
 `membermanager_group` | List of member manager groups assigned to this group. Only usable with IPA versions 4.8.4 and up. | no
 `externalmember` \| `ipaexternalmember`  \| `external_member`| List of members of a trusted domain in DOM\\name or name@domain form. | no
-`idoverrideuser` | List of user ID overrides to manage. Only usable with IPA versions 4.8.7 and up.| no
-`rename` \| `new_name` | Rename the user object to the new name string. Only usable with `state: renamed`. | no
 `action` | Work on group or member level. It can be on of `member` or `group` and defaults to `group`. | no
-`state` | The state to ensure. It can be one of `present`, `absent` or `renamed`, default: `present`. | yes
+`state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes
 
 
 Authors
 =======
 
-- Thomas Woerner
-- Rafael Jeffman
+Thomas Woerner

README-hbacrule.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -44,7 +44,7 @@ Example playbook to make sure HBAC Rule login exists:
 ```yaml
 ---
 - name: Playbook to handle hbacrules
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -60,7 +60,7 @@ Example playbook to make sure HBAC Rule login exists with the only HBAC Service
 ```yaml
 ---
 - name: Playbook to handle hbacrules
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -77,7 +77,7 @@ Example playbook to make sure HBAC Service sshd is present in HBAC Rule login:
 ```yaml
 ---
 - name: Playbook to handle hbacrules
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -95,7 +95,7 @@ Example playbook to make sure HBAC Service sshd is absent in HBAC Rule login:
 ```yaml
 ---
 - name: Playbook to handle hbacrules
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -114,7 +114,7 @@ Example playbook to make sure HBAC Rule login is absent:
 ```yaml
 ---
 - name: Playbook to handle hbacrules
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -129,12 +129,13 @@ Example playbook to make sure HBAC Rule login is absent:
 Variables
 =========
 
+ipahbacrule
+---------------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of hbacrule name strings. | yes
 `description` | The hbacrule description string. | no
 `usercategory` \| `usercat` | User category the rule applies to. Choices: ["all", ""] | no

README-hbacsvc.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -91,12 +91,13 @@ Example playbook to make sure HBAC Services for http and tftp are absent
 Variables
 =========
 
+ipahbacsvc
+----------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` \| `service` | The list of hbacsvc name strings. | no
 `description` | The hbacsvc description string. | no
 `state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | no

README-hbacsvcgroup.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -44,7 +44,7 @@ Example playbook to make sure HBAC Service Group login exists:
 ```yaml
 ---
 - name: Playbook to handle hbacsvcgroups
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -60,7 +60,7 @@ Example playbook to make sure HBAC Service Group login exists with the only HBAC
 ```yaml
 ---
 - name: Playbook to handle hbacsvcgroups
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -77,7 +77,7 @@ Example playbook to make sure HBAC Service sshd is present in HBAC Service Group
 ```yaml
 ---
 - name: Playbook to handle hbacsvcgroups
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -95,7 +95,7 @@ Example playbook to make sure HBAC Service sshd is absent in HBAC Service Group
 ```yaml
 ---
 - name: Playbook to handle hbacsvcgroups
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -114,7 +114,7 @@ Example playbook to make sure HBAC Service Group login is absent:
 ```yaml
 ---
 - name: Playbook to handle hbacsvcgroups
-  hosts: ipaserver
+  hbacsvcs: ipaserver
   become: true
 
   tasks:
@@ -129,12 +129,13 @@ Example playbook to make sure HBAC Service Group login is absent:
 Variables
 =========
 
+ipahbacsvcgroup
+---------------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of hbacsvcgroup name strings. | no
 `description` | The hbacsvcgroup description string. | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no

README-host.md

@@ -24,7 +24,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -266,10 +266,10 @@ Example playbook to ensure presence of member managedby_host for serveral hosts:
     ipahost:
       ipaadmin_password: SomeADMINpassword
       hosts:
-      - name: host01.example.com
-        managedby_host: server.example.com
-      - name: host02.example.com
-        managedby_host: server.example.com
+      - name: host01.exmaple.com
+        managedby_host: server.exmaple.com
+      - name: host02.exmaple.com
+        managedby_host: server.exmaple.com
       action: member
 ```
 
@@ -313,12 +313,13 @@ Example playbook to ensure a host is absent:
 Variables
 =========
 
+ipahost
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `fqdn` | The list of host name strings. `name` with *host variables* or `hosts` containing *host variables* need to be used. | no
 **Host variables** | Only used with `name` variable in the first level. | no
 `hosts` | The list of host dicts. Each `hosts` dict entry can contain **host variables**.<br>There is one required option in the `hosts` dict:| no
@@ -335,13 +336,13 @@ Variable | Description | Required
 -------- | ----------- | --------
 `description` | The host description. | no
 `locality` | Host locality (e.g. "Baltimore, MD"). | no
-`location` \| `ns_host_location` | Host physical location hint (e.g. "Lab 2"). | no
+`location` \| `ns_host_location` | Host location (e.g. "Lab 2"). | no
 `platform` \| `ns_hardware_platform` | Host hardware platform (e.g. "Lenovo T61"). | no
 `os` \| `ns_os_version` | Host operating system and version (e.g. "Fedora 9"). | no
 `password` \| `user_password` \| `userpassword` | Password used in bulk enrollment for absent or not enrolled hosts. | no
 `random` \| `random_password` |  Initiate the generation of a random password to be used in bulk enrollment for absent or not enrolled hosts. | no
 `certificate` \| `usercertificate` | List of base-64 encoded host certificates | no
-`managedby_host` | List of hosts that can manage this host | no
+`managedby` \| `principalname` \| `krbprincipalname` | List of hosts that can manage this host | no
 `principal` \| `principalname` \| `krbprincipalname` | List of principal aliases for this host | no
 `allow_create_keytab_user` \| `ipaallowedtoperform_write_keys_user` | Users allowed to create a keytab of this host. | no
 `allow_create_keytab_group` \| `ipaallowedtoperform_write_keys_group` | Groups allowed to create a keytab of this host. | no
@@ -354,7 +355,7 @@ Variable | Description | Required
 `mac_address` \| `macaddress` | List of hardware MAC addresses. | no
 `sshpubkey` \| `ipasshpubkey` | List of SSH public keys | no
 `userclass` \| `class` | Host category (semantics placed on this attribute are for local interpretation) | no
-`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Use empty string to reset auth_ind to the initial value. Other values may be used for custom configurations. An additional check ensures that only types can be used that are supported by the IPA version. Choices: ["radius", "otp", "pkinit", "hardened", "idp", ""] | no
+`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. Use 'otp' to allow OTP-based 2FA authentications. Use 'radius' to allow RADIUS-based 2FA authentications. Use empty string to reset auth_ind to the initial value. Other values may be used for custom configurations. choices: ["radius", "otp", "pkinit", "hardened", ""] | no
 `requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service (bool) | no
 `ok_as_delegate` \| `ipakrbokasdelegate` | Client credentials may be delegated to the service (bool) | no
 `ok_to_auth_as_delegate` \| `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client (bool) | no
@@ -367,13 +368,16 @@ Variable | Description | Required
 Return Values
 =============
 
+ipahost
+-------
+
 There are only return values if one or more random passwords have been generated.
 
 Variable | Description | Returned When
 -------- | ----------- | -------------
 `host` | Host dict with random password. (dict) <br>Options: | If random is yes and host did not exist or update_password is yes
-&nbsp; | `randompassword` - The generated random password | If only one host is handled by the module without using the `hosts` parameter.
-&nbsp; | `name` - The host name of the host that got a new random password. (dict) <br> Options: <br> &nbsp; `randompassword` - The generated random password | If several hosts are handled by the module with the `hosts` parameter.
+&nbsp; | `randompassword` - The generated random password | If only one host is handled by the module
+&nbsp; | `name` - The host name of the host that got a new random password. (dict) <br> Options: <br> &nbsp; `randompassword` - The generated random password | If several hosts are handled by the module
 
 
 Authors

README-hostgroup.md

@@ -26,7 +26,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -143,12 +143,13 @@ Example playbook to make sure host-group databases is absent:
 Variables
 =========
 
+ipahostgroup
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of hostgroup name strings. | no
 `description` | The hostgroup description string. | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no

README-idoverridegroup.md

@@ -1,233 +0,0 @@
-Idoverridegroup module
-============
-
-Description
------------
-
-The idoverridegroup module allows to ensure presence and absence of idoverridegroups and idoverridegroup members.
-
-
-Use Cases
----------
-
-With idoverridegroup it is possible to manage group attributes within ID views. These attributes are for example the group name or gid.
-
-
-Features
---------
-
-* Idoverridegroup management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaidoverridegroup module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview.
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview with description
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview with description
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      description: "test_group description"
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview without description
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview without description
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      description: ""
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview with internal name test_123_group
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview with internal name test_123_group
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      name: test_123_group
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview without internal name
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-- name: Ensure test group test_group is present in idview test_idview without internal name
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      name: ""
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview with gid 20001
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview with gid 20001
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      gid: 20001
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview without gid
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview without gid
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      gid: ""
-```
-
-
-Example playbook to make sure test group test_group is present in idview test_idview with enabling falling back to AD DC LDAP when resolving AD trusted objects. (For two-way trusts only.)
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is present in idview test_idview with fallback_to_ldap enabled
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      fallback_to_ldap: true
-```
-
-
-Example playbook to make sure test group test_group is absent in idview test_idview
-
-```yaml
----
-- name: Playbook to manage idoverridegroup
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test group test_group is absent in idview test_idview
-    ipaidoverridegroup:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_group
-      continue: true
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to true. (bool) | no
-`idview` \| `idviewcn` | The doverridegroup idview string. | yes
-`anchor` \| `ipaanchoruuid` | The list of anchors to override. | yes
-`description` \| `desc` | Description | no
-`name` \| `group_name` \| `cn` | The group. | no
-`gid` \| `gidnumber` | Group ID Number (int or "") | no
-`fallback_to_ldap` | Allow falling back to AD DC LDAP when resolving AD trusted objects. For two-way trusts only. | no
-`delete_continue` \| `continue` | Continuous mode. Don't stop on errors. Valid only if `state` is `absent`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-idoverrideuser.md

@@ -1,503 +0,0 @@
-Idoverrideuser module
-============
-
-Description
------------
-
-The idoverrideuser module allows to ensure presence and absence of idoverrideusers and idoverrideuser members.
-
-
-Use Cases
----------
-
-With idoverrideuser it is possible to manage user attributes within ID views. These attributes are for example the login name, home directory, certificate for authentication or SSH keys.
-
-
-Features
---------
-
-* Idoverrideuser management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaidoverrideuser module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview.
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with description
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with description
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      description: "test_user description"
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without description
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without description
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      description: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with internal name test_123_user
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with internal name test_123_user
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      name: test_123_user
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without internal name
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without internal name
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      name: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with uid 20001
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with uid 20001
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      uid: 20001
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without uid
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without uid
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      uid: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with gecos "Gecos Test"
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with gecos "Gecos Test"
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      gecos: Gecos Test
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without gecos
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without gecos
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      gecos: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with gidnumber
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with gidnumber
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      gidnumber: 20001
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without gidnumber
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without gidnumber
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      gidnumber: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with homedir /Users
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with homedir /Users
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      homedir: /Users
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without homedir
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without homedir
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      homedir: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with shell
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with shell
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      shell: /bin/someshell
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without shell
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without shell
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      shell: ""
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with sshpubkey
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with sshpubkey
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      sshpubkey:
-      - ssh-rsa AAAAB3NzaC1yc2EAAADAQABAAABgQCqmVDpEX5gnSjKuv97Ay ...
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without sshpubkey
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without sshpubkey
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      sshpubkey: []
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with 1 certificate
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with 1 certificate
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      certificate:
-      - "{{ lookup('file', 'cert1.b64', rstrip=False) }}"
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with 3 certificate members
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with 3 certificate members
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      certificate:
-      - "{{ lookup('file', 'cert1.b64', rstrip=False) }}"
-      - "{{ lookup('file', 'cert2.b64', rstrip=False) }}"
-      - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
-      action: member
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without 2 certificate members
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without 2 certificate members
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      certificate:
-      - "{{ lookup('file', 'cert2.b64', rstrip=False) }}"
-      - "{{ lookup('file', 'cert3.b64', rstrip=False) }}"
-      action: member
-      state: absent
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview without certificates
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview without certificates
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      certificate: []
-```
-
-
-Example playbook to make sure test user test_user is present in idview test_idview with enabling falling back to AD DC LDAP when resolving AD trusted objects. (For two-way trusts only.)
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is present in idview test_idview with fallback_to_ldap enabled
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      fallback_to_ldap: true
-```
-
-
-Example playbook to make sure test user test_user is absent in idview test_idview
-
-```yaml
----
-- name: Playbook to manage idoverrideuser
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure test user test_user is absent in idview test_idview
-    ipaidoverrideuser:
-      ipaadmin_password: SomeADMINpassword
-      idview: test_idview
-      anchor: test_user
-      continue: true
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to true. (bool) | no
-`idview` \| `idviewcn` | The doverrideuser idview string. | yes
-`anchor` \| `ipaanchoruuid` | The list of anchors to override. | yes
-`description` \| `desc` | Description | no
-`name` \| `login` | The user (internally uid) | no
-`uid` \| `uidnumber` | User ID Number (int or "") | no
-`gecos` | GECOS | no
-`gidnumber` | Group ID Number (int or ""). | no
-`homedir` \| `homedirectory` | Home directory. | no
-`shell` \| `loginshell` | Login shell. | no
-`sshpubkey` \| `ipasshpubkey` | List of SSH public keys. | no
-`certificate` \| `usercertificate` | List of Base-64 encoded user certificates. This variable can also be used with `action: member`. | no
-`fallback_to_ldap` | Allow falling back to AD DC LDAP when resolving AD trusted objects. For two-way trusts only. | no
-`delete_continue` \| `continue` | Continuous mode. Don't stop on errors. Valid only if `state` is `absent`. | no
-`nomembers` \| `no_members` | Suppress processing of membership attributes. Valid only if `state` is `absent`. | no
-`action` | Work on idoverrideuser or member level. It can be on of `member` or `idoverrideuser` and defaults to `idoverrideuser`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-idp.md

@@ -1,192 +0,0 @@
-Idp module
-============
-
-Description
------------
-
-The idp module allows to ensure presence and absence of idps.
-
-Features
---------
-
-* Idp management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaidp module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure keycloak idp my-keycloak-idp is present:
-
-```yaml
----
-- name: Playbook to manage IPA idp.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure keycloak idp my-keycloak-idp is present
-    ipaidp:
-      ipaadmin_password: SomeADMINpassword
-      name: my-keycloak-idp
-      provider: keycloak
-      organization: main
-      base_url: keycloak.idm.example.com:8443/auth
-      client_id: my-client-id
-```
-
-
-Example playbook to make sure keycloak idp my-keycloak-idp is absent:
-
-```yaml
----
-- name: Playbook to manage IPA idp.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure keycloak idp my-keycloak-idp is absent
-    ipaidp:
-      ipaadmin_password: SomeADMINpassword
-      name: my-keycloak-idp
-      delete_continue: true
-      state: absent
-```
-
-
-Example playbook to make sure github idp my-github-idp is present:
-
-```yaml
----
-- name: Playbook to manage IPA idp.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure github idp my-github-idp is present
-    ipaidp:
-      ipaadmin_password: SomeADMINpassword
-      name: my-github-idp
-      provider: github
-      client_id: my-github-client-id
-```
-
-
-Example playbook to make sure google idp my-google-idp is present using provider defaults without specifying provider:
-
-```yaml
----
-- name: Playbook to manage IPA idp.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure google idp my-google-idp is present using provider defaults without specifying provider
-    ipaidp:
-      ipaadmin_password: SomeADMINpassword
-      name: my-google-idp
-      auth_uri: https://accounts.google.com/o/oauth2/auth
-      dev_auth_uri: https://oauth2.googleapis.com/device/code
-      token_uri: https://oauth2.googleapis.com/token
-      keys_uri: https://www.googleapis.com/oauth2/v3/certs
-      userinfo_uri: https://openidconnect.googleapis.com/v1/userinfo
-      client_id: my-google-client-id
-      scope: "openid email"
-      idp_user_id: email
-```
-
-
-Example playbook to make sure google idp my-google-idp is present using provider:
-
-```yaml
----
-- name: Playbook to manage IPA idp.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure google idp my-google-idp is present using provider
-    ipaidp:
-      ipaadmin_password: SomeADMINpassword
-      name: my-google-idp
-      provider: google
-      client_id: my-google-client-id
-```
-
-
-Example playbook to make sure idps my-keycloak-idp, my-github-idp and my-google-idp are absent:
-
-```yaml
----
-- name: Playbook to manage IPA idp.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure idps my-keycloak-idp, my-github-idp and my-google-idp are absent
-    ipaidp:
-      ipaadmin_password: SomeADMINpassword
-      name:
-      - my-keycloak-idp
-      - my-github-idp
-      - my-google-idp
-      delete_continue: true
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to true. (bool) | false
-`name` \| `cn` | The list of idp name strings. | yes
-auth_uri \| ipaidpauthendpoint | OAuth 2.0 authorization endpoint string. | no
-dev_auth_uri \| ipaidpdevauthendpoint | Device authorization endpoint string. | no
-token_uri \| ipaidptokenendpoint | Token endpoint string. | no
-userinfo_uri \| ipaidpuserinfoendpoint | User information endpoint string. | no
-keys_uri \| ipaidpkeysendpoint | JWKS endpoint string. | no
-issuer_url \| ipaidpissuerurl | The Identity Provider OIDC URL string. | no
-client_id \| ipaidpclientid | OAuth 2.0 client identifier string. | no
-secret \| ipaidpclientsecret | OAuth 2.0 client secret string. | no
-scope \| ipaidpscope | OAuth 2.0 scope string. Multiple scopes separated by space. | no
-idp_user_id \| ipaidpsub | Attribute string for user identity in OAuth 2.0 userinfo. | no
-provider \| ipaidpprovider | Pre-defined template string. This provides the provider defaults, which can be overridden with the other IdP options. Choices: ["google","github","microsoft","okta","keycloak"] | no
-organization \| ipaidporg | Organization ID string or Realm name for IdP provider templates. | no
-base_url \| ipaidpbaseurl | Base URL string for IdP provider templates. | no
-rename \| new_name | New name for the Identity Provider server object. Only with `state: renamed`. | no
-delete_continue \| continue | Continuous mode. Don't stop on errors. Valid only if `state` is `absent`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, `renamed`, default: `present`. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-idrange.md

@@ -1,196 +0,0 @@
-Idrange module
-============
-
-Description
------------
-
-The idrange module allows the management of ID ranges.
-
-In general it is not necessary to modify or delete ID ranges. If there is no other way to achieve a certain configuration than to modify or delete an ID range it should be done with great care. Because UIDs are stored in the file system and are used for access control it might be possible that users are allowed to access files of other users if an ID range got deleted and reused for a different domain.
-
-
-Use cases
----------
-
-* Add an ID range from a transitively trusted domain
-
-If the trusted domain (A) trusts another domain (B) as well and this trust is transitive 'ipa trust-add domain-A' will only create a range for domain A. The ID range for domain B must be added manually.
-
-* Add an additional ID range for the local domain
-
-If the ID range of the local domain is exhausted, i.e. no new IDs can be assigned to Posix users or groups by the DNA plugin, a new range has to be created to allow new users and groups to be added. (Currently there is no connection between this range CLI and the DNA plugin, but a future version might be able to modify the configuration of the DNS plugin as well).
-
-
-Features
---------
-
-* ID Range management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaidrange module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-Example playbook to ensure a local domain idrange is present:
-
-```yaml
----
-- name: Playbook to manage IPA idrange.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure an ID Range for the local domain is present.
-    ipaidrange:
-      ipaadmin_password: SomeADMINpassword
-      name: local_domain_id_range
-      base_id: 150000
-      range_size: 200000
-```
-
-Example playbook to ensure a local domain idrange is present, with RID and secondary RID base values:
-
-```yaml
----
-- name: Playbook to manage IPA idrange.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure local idrange is present
-    ipaidrange:
-      ipaadmin_password: SomeADMINpassword
-      name: local_domain_id_range
-      base_id: 150000000
-      range_size: 200000
-      rid_base: 1000000
-      secondary_rid_base: 200000000
-```
-
-Example playbook to ensure an AD-trust idrange is present, with range type 'trust-ad' and using domain SID:
-
-```yaml
----
-- name: Playbook to manage IPA idrange.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure AD-trust idrange is present
-    ipaidrange:
-      ipaadmin_password: SomeADMINpassword
-      name: ad_id_range
-      base_id: 150000000
-      range_size: 200000
-      idrange_type: ipa-ad-trust
-      dom_sid: S-1-5-21-2870384104-3340008087-3140804251
-```
-
-Example playbook to ensure an AD-trust idrange is present, with range type 'trust-ad-posix' and using domain SID:
-
-```yaml
----
-- name: Playbook to manage IPA idrange.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure AD-trust idrange is present
-    ipaidrange:
-      name: ad_posix_id_range
-      base_id: 150000000
-      range_size: 200000
-      idrange_type: ipa-ad-trust-posix
-      dom_name: ad.ipa.test
-```
-
-Example playbook to ensure an AD-trust idrange has auto creation of groups set to 'hybrid':
-
-```yaml
----
-- name: Playbook to manage IPA idrange.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Modify AD-trust idrange 'auto_private_groups'
-    ipaidrange:
-      ipaadmin_password: SomeADMINpassword
-      ipaapi_context: "{{ ipa_context | default(omit) }}"
-      name: ad_id_range
-      auto_private_groups: "hybrid"
-```
-
-Example playbook to make sure an idrange is absent:
-
-```yaml
----
-- name: Playbook to manage IPA idrange.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure ID range 'ad_id_range' is absent.
-    ipaidrange:
-      ipaadmin_password: SomeADMINpassword
-      name: ad_id_range
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | The list of idrange name strings. | yes
-`base_id` \| `ipabaseid` | First Posix ID of the range. (int) | yes, if `state: present`
-`range_size` \| `ipaidrangesize` | Number of IDs in the range. (int) | yes, if `state: present`
-`rid_base` \| `ipabaserid` | First RID of the corresponding RID range. (int) | no
-`secondary_rid_base` \| `ipasecondarybaserid` | First RID of the secondary RID range. (int) | no
-`dom_sid` \| `ipanttrusteddomainsid` | Domain SID of the trusted domain. | no
-`idrange_type` \| `iparangetype` | ID range type, one of `ipa-ad-trust`, `ipa-ad-trust-posix`, `ipa-local`. Only valid if idrange does not exist. | no
-`dom_name` \| `ipanttrusteddomainname` | Name of the trusted domain. Can only be used when `ipaapi_context: server`. | no
-`auto_private_groups` \| `ipaautoprivategroups` | Auto creation of private groups, one of `true`, `false`, `hybrid`. | no
-`delete_continue` \| `continue` | Continuous mode: don't stop on errors. Valid only if `state` is `absent`. Default: `no` (bool) | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
-
-
-Notes
-=====
-
-DNA plugin in 389-ds will allocate IDs based on the ranges configured for the local domain. Currently the DNA plugin *cannot* be reconfigured itself based on the local ranges set via this family of commands.
-
-Manual configuration change has to be done in the DNA plugin configuration for the new local range. Specifically, The dnaNextRange attribute of 'cn=Posix IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has to be modified to match the new range.
-
-
-Authors
-=======
-
-Rafael Guterres Jeffman

README-idview.md

@@ -1,153 +0,0 @@
-Idview module
-============
-
-Description
------------
-
-The idview module allows to ensure presence and absence of idviews and idview host members.
-
-Use Cases
----------
-
-With ID views it is possible to override user or group attributes for users stored in the LDAP server. For example the login name, home directory, certificate for authentication or SSH keys. An ID view is client-side and specifies new values for user or group attributes and also the client host or hosts on which the values apply.
-
-The ID view and the applied hosts are managed with idview, the user attributes are managed with idoverrideuser and the group attributes with idoverridegroup.
-
-Features
---------
-
-* Idview management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaidview module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure idview "test_idview" is present:
-
-```yaml
----
-- name: Playbook to manage IPA idview.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - ipaidview:
-      ipaadmin_password: SomeADMINpassword
-      name: test_idview
-```
-
-
-Example playbook to make sure idview "test_idview" member host "testhost.example.com" is present:
-
-```yaml
----
-- name: Playbook to manage IPA idview host member.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - ipaidview:
-      ipaadmin_password: SomeADMINpassword
-      name: test_idview
-      host: testhost.example.com
-      action: member
-```
-
-
-Example playbook to make sure idview "test_idview" member host "testhost.example.com" is absent:
-
-```yaml
----
-- name: Playbook to manage IPA idview host member.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - ipaidview:
-      ipaadmin_password: SomeADMINpassword
-      name: test_idview
-      host: testhost.example.com
-      action: member
-      state: absent
-```
-
-
-Example playbook to make sure idview "test_idview" is present with domain_resolution_order for "ad.example.com:ipa.example.com":
-
-```yaml
----
-- name: Playbook to manage IPA idview host member.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - ipaidview:
-      ipaadmin_password: SomeADMINpassword
-      name: test_idview
-      domain_resolution_order: "ad.example.com:ipa.example.com"
-```
-
-
-Example playbook to make sure idview "test_idview" is absent:
-
-```yaml
----
-- name: Playbook to manage IPA idview.
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - ipaidview:
-      ipaadmin_password: SomeADMINpassword
-      name: test_idview
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to true. (bool) | no
-`name` \| `cn` | The list of idview name strings. | yes
-`description` \| `desc` | The description string of the idview. | no
-`domain_resolution_order` \| `ipadomainresolutionorder` | Colon-separated list of domains used for short name qualification. | no
-`host` \| `hosts` | List of hosts to apply the ID View to. A host can only be applied to a single idview at any time. Applying a host that is already applied to a different idview will change the idview the host is applied to to the new one. | no
-`rename` \| `new_name` | Rename the ID view object to the new name string. Only usable with `state: renamed`. | no
-`delete_continue` \| `continue` | Continuous mode. Don't stop on errors. Valid only if `state` is `absent`. | no
-`action` | Work on idview or member level. It can be on of `member` or `idview` and defaults to `idview`. | no
-`state` | The state to ensure. It can be one of `present`, `absent` and `renamed`, default: `present`. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-inventory-plugin-freeipa.md

@@ -1,106 +0,0 @@
-Inventory plugin
-================
-
-Description
------------
-
-
-The inventory plugin compiles a dynamic inventory from IPA domain. The servers can be filtered by their role(s).
-
-This plugin is using the Python requests binding, that is only available for Python 3.7 and up.
-
-
-Features
---------
-* Dynamic inventory
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.6.0 and up are supported by the inventory plugin.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Configuration
-=============
-
-The inventory plugin is automatically enabled from the Ansible collection or from the top directory of the git repo if the `plugins` folder is linked to `~/.ansible`.
-
-If `ansible.cfg` was modified to point to the roles and modules with `roles_path`, `library` and `module_utils` tag, then it is needed to set `inventory_plugins` also:
-
-```
-inventory_plugins = /my/dir/ansible-freeipa/plugins/inventory
-```
-
-Usage
-=====
-
-Example inventory file "freeipa.yml":
-
-```yml
----
-plugin: freeipa
-server: server.ipa.local
-ipaadmin_password: SomeADMINpassword
-```
-
-Example inventory file "freeipa.yml" with server TLS certificate verification using local copy of `/etc/ipa/ca.crt` from the server:
-
-```yml
----
-plugin: freeipa
-server: server.ipa.local
-ipaadmin_password: SomeADMINpassword
-verify: ca.crt
-```
-
-
-How to use the plugin
----------------------
-
-With the `ansible-inventory` command it is possible to show the generated inventorey:
-
-```bash
-ansible-inventory -v -i freeipa.yml --graph
-```
-
-Example inventory file "freeipa.yml" for use with `playbooks/config/retrieve-config.yml`:
-
-```yml
----
-plugin: freeipa
-server: server.ipa.local
-ipaadmin_password: SomeADMINpassword
-inventory_group: ipaserver
-```
-
-```bash
-ansible-playbook -u root -i ipa.yml playbooks/config/retrieve-config.yml 
-```
-
-Variables
-=========
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`server` | The FQDN of server to start the scan. (string) | yes
-`verify` | The server TLS certificate file for verification (/etc/ipa/ca.crt). Turned off if not set. (string) | yes
-`role` | The role(s) of the server. If several roles are given, only servers that have all the roles are returned. (list of strings) (choices: "IPA master", "CA server", "KRA server", "DNS server", "AD trust controller", "AD trust agent") | no
-`inventory_group` | The inventory group to create. The default group name is "ipaservers". | no
-
-Authors
-=======
-
-- Thomas Woerner

README-location.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -74,12 +74,13 @@ Example playbook to make sure location "my_location1" is absent:
 Variables
 ---------
 
+ipalocation
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `idnsname` | The list of location name strings. | yes
 `description` | The IPA location string | false
 `state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no

README-netgroup.md

@@ -1,179 +0,0 @@
-Netgroup module
-============
-
-Description
------------
-
-The netgroup module allows to ensure presence and absence of netgroups.
-
-Features
---------
-
-* Netgroup management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipanetgroup module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure netgroup "my_netgroup1" is present:
-
-```yaml
----
-- name: Playbook to manage IPA netgroup.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure netgroup my_netgroup1 is present
-    ipanetgroup:
-      ipaadmin_password: SomeADMINpassword
-      name: my_netgroup1
-      description: My netgroup 1
-```
-
-
-Example playbook to make sure netgroup "my_netgroup1" is absent:
-
-```yaml
----
-- name: Playbook to manage IPA netgroup.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure netgroup my_netgroup1 is absent
-    ipanetgroup:
-      ipaadmin_password: SomeADMINpassword
-      name: my_netgroup1
-      state: absent
-```
-
-
-Example playbook to make sure netgroup is present with user "user1"
-
-```yaml
----
-- name: Playbook to manage IPA netgroup.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure netgroup is present with user "user1"
-    ipanetgroup:
-      ipaadmin_password: SomeADMINpassword
-      name: TestNetgroup1
-      user: user1
-      action: member
-```
-
-
-Example playbook to make sure netgroup user, "user1", is absent
-
-```yaml
----
-- name: Playbook to manage IPA netgroup.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure netgroup user, "user1", is absent
-    ipanetgroup:
-      ipaadmin_password: SomeADMINpassword
-      name: TestNetgroup1
-      user: "user1"
-      action: member
-      state: absent
-```
-
-
-Example playbook to make sure netgroup is present with members
-
-```yaml
----
-- name: Playbook to manage IPA netgroup.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure netgroup members are present
-    ipanetgroup:
-      ipaadmin_password: SomeADMINpassword
-      name: TestNetgroup1
-      user: user1,user2
-      group: group1
-      host: host1
-      hostgroup: ipaservers
-      netgroup: admins
-      action: member
-```
-
-
-Example playbook to make sure 2 netgroups TestNetgroup1, admins are absent
-
-```yaml
----
-- name: Playbook to manage IPA netgroup.
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure netgroups are absent
-    ipanetgroup:
-      ipaadmin_password: SomeADMINpassword
-      name:
-      - TestNetgroup1
-      - admins
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | The list of netgroup name strings. | yes
-`description` | Netgroup description | no
-`nisdomain` | NIS domain name | no
-`nomembers` | Suppress processing of membership attributes. (bool) | no
-`user` | List of user name strings assigned to this netgroup. | no
-`group` | List of group name strings assigned to this netgroup. | no
-`host` | List of host name strings assigned to this netgroup. | no
-`hostgroup` | List of hostgroup name strings assigned to this netgroup. | no
-`netgroup` | List of netgroup name strings assigned to this netgroup. | no
-`action` | Work on group or member level. It can be on of `member` or `netgroup` and defaults to `netgroup`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-Denis Karpelevich

README-permission.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -154,12 +154,13 @@ Example playbook to make sure permission "MyPermission" is renamed to "MyNewPerm
 Variables
 ---------
 
+ipapermission
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The permission name string. | yes
 `right` \| `ipapermright` | Rights to grant. It can be a list of one or more of `read`, `search`, `compare`, `write`, `add`, `delete`, and `all` default: `all` | no
 `attrs` | All attributes to which the permission applies. | no
@@ -174,7 +175,7 @@ Variable | Description | Required
 `targetgroup` | User group to apply permissions to (sets target) | no
 `object_type` | Type of IPA object (sets subtree and objectClass targetfilter) | no
 `no_members` | Suppress processing of membership | no
-`rename` \| `new_name` | Rename the permission object | no
+`rename` | Rename the permission object | no
 `action` | Work on permission or member level. It can be on of `member` or `permission` and defaults to `permission`. | no
 `state` | The state to ensure. It can be one of `present`, `absent`, or `renamed` default: `present`. | no
 

README-privilege.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -126,12 +126,13 @@ Example playbook to make sure privilege "DNS Special Privilege" is absent:
 Variables
 ---------
 
+ipaprivilege
+------------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin`. | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node. | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of privilege name strings. | yes
 `description` | Privilege description. | no
 `rename` \| `new_name` | Rename the privilege object. | no

README-pwpolicy.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -81,67 +81,33 @@ Example playbook to ensure maxlife is set to 49 in global policy:
   become: true
 
   tasks:
-  # Ensure maxlife is set to 49 in global policy
+  # Ensure absence of pwpolicies for group ops
   - ipapwpolicy:
       ipaadmin_password: SomeADMINpassword
       maxlife: 49
 ```
 
-Example playbook to ensure password grace period is set to 3 in global policy:
-
-```yaml
----
-- name: Playbook to handle pwpolicies
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  # Ensure maxlife is set to 49 in global policy
-  - ipapwpolicy:
-      ipaadmin_password: SomeADMINpassword
-      gracelimit: 3
-```
-
-Example playbook to ensure password grace period is set to unlimited in global policy:
-
-```yaml
----
-- name: Playbook to handle pwpolicies
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  # Ensure maxlife is set to 49 in global policy
-  - ipapwpolicy:
-      ipaadmin_password: SomeADMINpassword
-      gracelimit: -1
-```
-
 
 Variables
 =========
 
+ipapwpolicy
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of pwpolicy name strings. If name is not given, `global_policy` will be used automatically. | no
-`maxlife` \| `krbmaxpwdlife` | Maximum password lifetime in days. (int or "") | no
-`minlife` \| `krbminpwdlife` | Minimum password lifetime in hours. (int or "") | no
-`history` \| `krbpwdhistorylength` | Password history size. (int or "") | no
-`minclasses` \| `krbpwdmindiffchars` | Minimum number of character classes. (int or "") | no
-`minlength` \| `krbpwdminlength` | Minimum length of password. (int or "") | no
-`priority` \| `cospriority` | Priority of the policy, higher number means lower priority. (int or "") | no
-`maxfail` \| `krbpwdmaxfailure` | Consecutive failures before lockout. (int or "") | no
-`failinterval` \| `krbpwdfailurecountinterval` | Period after which failure count will be reset in seconds. (int or "") | no
-`lockouttime` \| `krbpwdlockoutduration` | Period for which lockout is enforced in seconds. (int or "") | no
-`maxrepeat` \| `ipapwdmaxrepeat` | Maximum number of same consecutive characters. Requires IPA 4.9+ (int or "") | no
-`maxsequence` \| `ipapwdmaxsequence` |  The maximum length of monotonic character sequences (abcd). Requires IPA 4.9+ (int or "") | no
-`dictcheck` \| `ipapwdictcheck` | Check if the password is a dictionary word. Requires IPA 4.9+. (bool or "") | no
-`usercheck` \| `ipapwdusercheck` | Check if the password contains the username. Requires IPA 4.9+. (bool or "") | no
-`gracelimit` \| `passwordgracelimit` |  Number of LDAP authentications allowed after expiration. Requires IPA 4.9.10 (int or "") | no
+`maxlife` \| `krbmaxpwdlife` | Maximum password lifetime in days. (int) | no
+`minlife` \| `krbminpwdlife` | Minimum password lifetime in hours. (int) | no
+`history` \| `krbpwdhistorylength` | Password history size. (int) | no
+`minclasses` \| `krbpwdmindiffchars` | Minimum number of character classes. (int) | no
+`minlength` \| `krbpwdminlength` | Minimum length of password. (int) | no
+`priority` \| `cospriority` | Priority of the policy, higher number means lower priority. (int) | no
+`maxfail` \| `krbpwdmaxfailure` | Consecutive failures before lockout. (int) | no
+`failinterval` \| `krbpwdfailurecountinterval` | Period after which failure count will be reset in seconds. (int) | no
+`lockouttime` \| `krbpwdlockoutduration` | Period for which lockout is enforced in seconds. (int) | no
 `state` | The state to ensure. It can be one of `present` or `absent`, default: `present`. | yes
 
 

README-role.md

@@ -25,7 +25,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -238,15 +238,16 @@ Example playbook to ensure that different members are not associated with a role
 Variables
 ---------
 
+iparole
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of role name strings. | yes
 `description` | A description for the role. | no
-`rename` \| `new_name` | Rename the role object. | no
+`rename` | Rename the role object. | no
 `privilege` | Privileges associated to this role. | no
 `user` | List of users to be assigned or not assigned to the role. | no
 `group` | List of groups to be assigned or not assigned to the role. | no

README-selfservice.md

@@ -23,7 +23,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -131,12 +131,13 @@ Example playbook to make sure selfservice "Users can manage their own name detai
 Variables
 ---------
 
+ipaselfservice
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `aciname` | The list of selfservice name strings. | yes
 `permission` \| `permissions` |  The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no
 `attribute` \| `attrs` | The attribute list to which the selfservice applies. | no

README-server.md

@@ -1,266 +0,0 @@
-Server module
-============
-
-Description
------------
-
-The server module allows to ensure presence and absence of servers. The module requires an existing server, the deployment of a new server can not be done with the module.
-
-Features
---------
-
-* Server management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaserver module.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure server "server.example.com" is already present in the topology:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-```
-
-This task is not deploying a new server, it is only checking if the server eists. It will therefore fail if the server does not exist.
-
-
-Example playbook to make sure server "server.example.com" has location mylocation:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      location: mylocation
-```
-
-
-Example playbook to make sure server "server.example.com" does not have a location:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      location: ""
-```
-
-
-Example playbook to make sure server "server.example.com" has service weight 1:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      service_weight: 1
-```
-
-
-Example playbook to make sure server "server.example.com" does not have a service weight:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      service_weight: -1
-```
-
-
-Example playbook to make sure server "server.example.com" is hidden:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      hidden: yes
-```
-
-
-Example playbook to make sure server "server.example.com" is not hidden:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      hidden: no
-```
-
-
-Example playbook to make sure server "server.example.com" is absent from the topology:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      state: absent
-```
-
-
-Example playbook to make sure server "server.example.com" is absent from the topology in continuous mode to ignore errors:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      continue: yes
-      state: absent
-```
-
-
-Example playbook to make sure server "server.example.com" is absent from the topology with skipping the last of role check:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      ignore_last_of_role: yes
-      state: absent
-```
-
-
-Example playbook to make sure server "server.example.com" is absent from the topology with skipping the topology disconnect check:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      ignore_topology_disconnect: yes
-      state: absent
-```
-
-
-Example playbook to make sure server "server.example.com" is absent from the domain in force mode even if it does not exist:
-
-```yaml
----
-- name: Playbook to manage IPA server.
-  hosts: ipaserver
-  become: yes
-
-  tasks:
-  - ipaserver:
-      ipaadmin_password: SomeADMINpassword
-      name: server.example.com
-      force: yes
-      state: absent
-```
-
-This task will always report a change.
-
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | The list of server name strings. | yes
-`location` \| `ipalocation_location` | The server DNS location. Only available with 'state: present'. Use "" for location reset. | no
-`service_weight` \| `ipaserviceweight` | Weight for server services. Type Values 0 to 65535, -1 for weight reset. Only available with 'state: present'. (int) | no
-`hidden` | Set hidden state of a server. Only available with 'state: present'. (bool) | no
-`no_members` | Suppress processing of membership attributes. Only avialable with 'state: present'. (bool) | no
-`delete_continue` \| `continue` | Continuous mode: Don't stop on errors. Only available with 'state: absent'. (bool) | no
-`ignore_last_of_role` | Skip a check whether the last CA master or DNS server is removed. Only available with 'state: absent'. (bool) | no
-`ignore_topology_disconnect` | Ignore topology connectivity problems after removal. Only available with 'state: absent'. (bool) | no
-`force` | Force server removal even if it does not exist. Will always result in changed. Only available with 'state: absent'. (bool) | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. `present` is only working with existing servers. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-service.md

@@ -25,7 +25,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FReeIPA version (see above)
@@ -282,86 +282,19 @@ Example playbook to allow users, groups, hosts or hostgroups to retrieve a keyta
 ```
 
 
-Example playbook to ensure presence of serveral services in a single task:
-
-```yaml
----
-- name: Playbook to manage IPA service.
-  hosts: ipaserver
-
-  tasks:
-  - name: Ensure services are present
-    ipaservice:
-      ipaadmin_password: SomeADMINpassword
-      services:
-      - name: HTTP/www.example.com
-        principal:
-        - host/host1.example.com
-      - name: mysvc/www.example.com
-        pac_type: NONE
-        ok_as_delegate: yes
-        ok_to_auth_as_delegate: yes
-      - name: HTTP/www.example.com
-        allow_create_keytab_user:
-        - user01
-        - user02
-        allow_create_keytab_group:
-        - group01
-        - group02
-        allow_create_keytab_host:
-        - host1.example.com
-        - host2.example.com
-        allow_create_keytab_hostgroup:
-        - hostgroup01
-        - hostgroup02
-      - name: mysvc/host2.example.com
-        auth_ind: otp,radius
-```
-
-
-Example playbook to ensure presence of serveral services in a single task with `member` `action`:
-
-```yaml
----
-- name: Playbook to manage IPA service.
-  hosts: ipaserver
-  become: true
-  gather_facts: false
-
-  tasks:
-    - name: Ensure service host members are present
-      ipaservice:
-        ipaadmin_password: SomeADMINpassword
-        services:
-        - name: HTTP/www1.example.com
-          host: host1.example.com
-        - name: HTTP/www2.example.com
-          host: host2.example.com
-        action: member
-```
-
-
 Variables
 ---------
 
+ipaservice
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `service` | The list of service name strings. `name` with *service variables* or `services` containing *service variables* need to be used. | no
-`action` | Work on service or member level. It can be on of `member` or `service` and defaults to `service`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, or `disabled`, default: `present`. | no
-
-
-**Service Variables:**
-
-Variable | Description | Required
--------- | ----------- | --------
+`name` \| `service` | The list of service name strings. | yes
 `certificate` \| `usercertificate` | Base-64 encoded service certificate. | no
-`pac_type` \| `ipakrbauthzdata` | Supported PAC type. It can be one of `MS-PAC`, `PAD`, or `NONE`. Use empty string to reset pac_type to the initial value. | no
-`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. It can be any of `otp`, `radius`, `pkinit`, `hardened`, `idp` or `""`.  An additional check ensures that only types can be used that are supported by the IPA version. Use empty string to reset auth_ind to the initial value. | no
+`pac_type` \| `ipakrbauthzdata` | Supported PAC type. It can be one of `MS-PAC`, `PAD`, or `NONE`. | no
+`auth_ind` \| `krbprincipalauthind` | Defines an allow list for Authentication Indicators. It can be any of `otp`, `radius`, `pkinit`, or `hardened`. | no
 `requires_pre_auth` \| `ipakrbrequirespreauth` | Pre-authentication is required for the service. Default to true. (bool) | no
 `ok_as_delegate` \|  `ipakrbokasdelegate` | Client credentials may be delegated to the service. Default to false. (bool) | no
 `ok_to_auth_as_delegate` \|  `ipakrboktoauthasdelegate` | The service is allowed to authenticate on behalf of a client. Default to false. (bool) | no
@@ -377,9 +310,9 @@ Variable | Description | Required
 `allow_retrieve_keytab_group` \| `ipaallowedtoperform_read_keys_group` | Groups allowed to retrieve a keytab of this host. | no
 `allow_retrieve_keytab_host` \| `ipaallowedtoperform_read_keys_host` | Hosts allowed to retrieve a keytab from of host. | no
 `allow_retrieve_keytab_hostgroup` \| `ipaallowedtoperform_read_keys_hostgroup` | Host groups allowed to retrieve a keytab of this host. | no
-`smb` | Service is an SMB service. If set, `cifs/` will be prefixed to the service name if needed. | no
-`netbiosname` | NETBIOS name for the SMB service. Only with `smb: yes`. | no
-`continue` \| `delete_continue` | Continuous mode: don't stop on errors. Valid only if `state` is `absent`. Default: `no` (bool) | no
+`continue` | Continuous mode: don't stop on errors. Valid only if `state` is `absent`. Default: `no` (bool) | no
+`action` | Work on service or member level. It can be on of `member` or `service` and defaults to `service`. | no
+`state` | The state to ensure. It can be one of `present`, `absent`, or `disabled`, default: `present`. | no
 
 
 Authors

README-servicedelegationrule.md

@@ -1,172 +0,0 @@
-Servicedelegationrule module
-============
-
-Description
------------
-
-The servicedelegationrule module allows to ensure presence and absence of servicedelegationrules and servicedelegationrule members.
-
-Features
---------
-
-* Servicedelegationrule management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaservicedelegationrule module.
-
-Host princpals are only usable with IPA versions 4.9.0 and up.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure servicedelegationrule delegation-rule is present:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationrule
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationrule delegation-rule is present
-    ipaservicedelegationrule:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-rule
-```
-
-
-Example playbook to make sure servicedelegationrule delegation-rule member principal test/example.com is present:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationrule
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationrule delegation-rule member principal test/example.com is present
-    ipaservicedelegationrule:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-rule
-      principal: test/example.com
-      action: member
-```
-
-
-Example playbook to make sure servicedelegationrule delegation-rule member principal test/example.com is absent:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationrule
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationrule delegation-rule member principal test/example.com is absent
-    ipaservicedelegationrule:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-rule
-      principal: test/example.com
-      action: member
-      state: absent
-    state: absent
-```
-
-
-Example playbook to make sure servicedelegationrule delegation-rule member target delegation-target is present:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationrule
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationrule delegation-rule member target delegation-target is present
-    ipaservicedelegationrule:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-rule
-      target: delegation-target
-      action: member
-```
-
-
-Example playbook to make sure servicedelegationrule delegation-rule member target delegation-target is absent:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationrule
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationrule delegation-rule member target delegation-target is absent
-    ipaservicedelegationrule:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-rule
-      target: delegation-target
-      action: member
-      state: absent
-    state: absent
-```
-
-
-Example playbook to make sure servicedelegationrule delegation-rule is absent:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationrule
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationrule delegation-rule is absent
-    ipaservicedelegationrule:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-rule
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | The list of servicedelegationrule name strings. | yes
-`principal` |  The list of principals. A principal can be of the format: fqdn, fqdn@REALM, service/fqdn, service/fqdn@REALM, host/fqdn, host/fqdn@REALM, alias$, alias$@REALM, where fqdn and fqdn@REALM are host principals and the same as host/fqdn and host/fqdn@REALM. Host princpals are only usable with IPA versions 4.9.0 and up. | no
-`target` \| `servicedelegationtarget` | The list of service delegation targets. | no
-`action` | Work on servicedelegationrule or member level. It can be on of `member` or `servicedelegationrule` and defaults to `servicedelegationrule`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-servicedelegationtarget.md

@@ -1,133 +0,0 @@
-Servicedelegationtarget module
-============
-
-Description
------------
-
-The servicedelegationtarget module allows to ensure presence and absence of servicedelegationtargets and servicedelegationtarget members.
-
-Features
---------
-
-* Servicedelegationtarget management
-
-
-Supported FreeIPA Versions
---------------------------
-
-FreeIPA versions 4.4.0 and up are supported by the ipaservicedelegationtarget module.
-
-Host princpals are only usable with IPA versions 4.9.0 and up.
-
-
-Requirements
-------------
-
-**Controller**
-* Ansible version: 2.14+
-
-**Node**
-* Supported FreeIPA version (see above)
-
-
-Usage
-=====
-
-Example inventory file
-
-```ini
-[ipaserver]
-ipaserver.test.local
-```
-
-
-Example playbook to make sure servicedelegationtarget delegation-target is present:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationtarget
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationtarget delegation-target is present
-    ipaservicedelegationtarget:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-target
-```
-
-
-Example playbook to make sure servicedelegationtarget delegation-target member principal test/example.com is present:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationtarget
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationtarget delegation-target member principal test/example.com is present
-    ipaservicedelegationtarget:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-target
-      principal: test/example.com
-      action: member
-```
-
-
-Example playbook to make sure servicedelegationtarget delegation-target member principal test/example.com is absent:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationtarget
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationtarget delegation-target member principal test/example.com is absent
-    ipaservicedelegationtarget:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-target
-      principal: test/example.com
-      action: member
-      state: absent
-    state: absent
-```
-
-
-Example playbook to make sure servicedelegationtarget delegation-target is absent:
-
-```yaml
----
-- name: Playbook to manage IPA servicedelegationtarget
-  hosts: ipaserver
-  become: no
-
-  tasks:
-  - name: Ensure servicedelegationtarget delegation-target is absent
-    ipaservicedelegationtarget:
-      ipaadmin_password: SomeADMINpassword
-      name: delegation-target
-      state: absent
-```
-
-
-Variables
----------
-
-Variable | Description | Required
--------- | ----------- | --------
-`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
-`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | The list of servicedelegationtarget name strings. | yes
-`principal` |  The list of principals. A principal can be of the format: fqdn, fqdn@REALM, service/fqdn, service/fqdn@REALM, host/fqdn, host/fqdn@REALM, alias$, alias$@REALM, where fqdn and fqdn@REALM are host principals and the same as host/fqdn and host/fqdn@REALM. Host princpals are only usable with IPA versions 4.9.0 and up. | no
-`action` | Work on servicedelegationtarget or member level. It can be on of `member` or `servicedelegationtarget` and defaults to `servicedelegationtarget`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, default: `present`. | no
-
-
-Authors
-=======
-
-Thomas Woerner

README-sudocmd.md

@@ -24,7 +24,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -67,7 +67,7 @@ Example playbook to make sure sudocmd is absent:
 
   tasks:
   # Ensure sudocmd are absent
-  - ipasudocmd:
+  - ipahostgroup:
       ipaadmin_password: SomeADMINpassword
       name: /usr/bin/su
       state: absent
@@ -76,12 +76,13 @@ Example playbook to make sure sudocmd is absent:
 Variables
 =========
 
+ipasudocmd
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `sudocmd` | The sudo command strings. | yes
 `description` | The command description string. | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no

README-sudocmdgroup.md

@@ -24,7 +24,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -116,12 +116,13 @@ Example playbook to make sure sudocmdgroup is absent:
 Variables
 =========
 
+ipasudocmdgroup
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of sudocmdgroup name strings. | no
 `description` | The sudocmdgroup description string. | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no

README-sudorule.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -93,26 +93,6 @@ Example playbook to make sure sudocmds are not present in Sudo Rule:
       state: absent
 ```
 
-
-Example playbook to ensure a Group of RunAs User is present in sudo rule:
-
-```yaml
----
-- name: Playbook to manage sudorule member
-  hosts: ipaserver
-  become: no
-  gather_facts: no
-
-  tasks:
-  - name: Ensure sudorule 'runasuser' has 'ipasuers' group as runas users.
-    ipasudorule:
-      ipaadmin_password: SomeADMINpassword
-      name: testrule1
-      runasuser_group: ipausers
-      action: member
-```
-
-
 Example playbook to make sure Sudo Rule is absent:
 
 ```yaml
@@ -129,80 +109,35 @@ Example playbook to make sure Sudo Rule is absent:
       state: absent
 ```
 
-Example playbook to ensure multiple Sudo Rule are present using batch mode:
-
-```yaml
----
-- name: Playbook to handle sudorules
-  hosts: ipaserver
-  become: true
-
-- name: Ensure multiple Sudo Rules are present using batch mode.
-  ipasudorule:
-    ipaadmin_password: SomeADMINpassword
-    sudorules:
-      - name: testrule1
-        hostmask:
-          - 192.168.122.1/24
-      - name: testrule2
-        hostcategory: all
-```
-
-Example playbook to ensure multiple Sudo Rule members are present using batch mode:
-
-```yaml
----
-- name: Playbook to handle sudorules
-  hosts: ipaserver
-  become: true
-
-- name: Ensure multiple Sudo Rules are present using batch mode.
-  ipasudorule:
-    ipaadmin_password: SomeADMINpassword
-    action: member
-    sudorules:
-      - name: testrule1
-        user:
-          - user01
-          - user02
-        group:
-          - group01
-      - name: testrule2
-        hostgroup:
-          - hostgroup01
-          - hostgroup02
-```
 
 Variables
 =========
 
+ipasudorule
+---------------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
-`name` \| `cn` | The list of sudorule name strings. | no
-`sudorules` | The list of sudorule dicts. Each `sudorule` dict entry can contain sudorule variables.<br>There is one required option in the `sudorule` dict:| no
-&nbsp; | `name` - The sudorule name string of the entry. | yes
+`name` \| `cn` | The list of sudorule name strings. | yes
 `description` | The sudorule description string. | no
 `usercategory` \| `usercat` | User category the rule applies to. Choices: ["all", ""] | no
 `hostcategory` \| `hostcat` | Host category the rule applies to. Choices: ["all", ""] | no
 `cmdcategory` \| `cmdcat` | Command category the rule applies to. Choices: ["all", ""] | no
-`runasusercategory` \| `runasusercat` | RunAs User category the rule applies to. Choices: ["all", ""] | no
+`runasusercategory` \| `rusasusercat` | RunAs User category the rule applies to. Choices: ["all", ""] | no
 `runasgroupcategory` \| `runasgroupcat` | RunAs Group category the rule applies to. Choices: ["all", ""] | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no
 `host` | List of host name strings assigned to this sudorule. | no
 `hostgroup` | List of host group name strings assigned to this sudorule. | no
-`hostmask` | List of host masks of allowed hosts | no
 `user` | List of user name strings assigned to this sudorule. | no
 `group` | List of user group name strings assigned to this sudorule. | no
 `allow_sudocmd` | List of sudocmd name strings assigned to the allow group of this sudorule. | no
 `deny_sudocmd` | List of sudocmd name strings assigned to the deny group of this sudorule. | no
 `allow_sudocmdgroup` | List of sudocmd groups name strings assigned to the allow group of this sudorule. | no
 `deny_sudocmdgroup` | List of sudocmd groups name strings assigned to the deny group of this sudorule. | no
-`sudooption` \| `options` | List of options to the sudorule | no
-`order` \| `sudoorder` | Integer to order the sudorule | no
+`sudooption` \| `option` | List of options to the sudorule | no
+`order` | Integer to order the sudorule | no
 `runasuser` | List of users for Sudo to execute as. | no
 `runasgroup` | List of groups for Sudo to execute as. | no
 `action` | Work on sudorule or member level. It can be on of `member` or `sudorule` and defaults to `sudorule`. | no

README-topology.md

@@ -22,7 +22,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -159,13 +159,11 @@ Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `suffix` | The topology suffix to be used, this can either be `domain`, `ca` or `domain+ca` | yes
 `name` \| `cn` | The topology segment name (cn) is the unique identifier for a segment. | no
 `left` \| `leftnode` | The left replication node string - an IPA server | no
 `right` \| `rightnode` | The right replication node string - an IPA server | no
-`direction` | The direction a segment will be reinitialized. It can either be `left-to-right` or `right-to-left` and only used with `state: reinitialized` | no
+`direction` | The direction a segment will be reinitialized. It can either be `left-to-right` or `right-to-left` and only used with `state: reinitialized` | 
 `state` | The state to ensure. It can be one of `present`, `absent`, `enabled`, `disabled`, `checked` or `reinitialized` | yes
 
 
@@ -178,8 +176,6 @@ Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `suffix` | The topology suffix to be used, this can either be `domain` or `ca` | yes
 `state` | The state to ensure. It can only be `verified` | yes
 

README-trust.md

@@ -21,7 +21,7 @@ Requirements
 
 **Controller**
 
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 
@@ -94,18 +94,18 @@ This will only delete the ipa-side of the trust and it does NOT delete the id-ra
 Variables
 =========
 
+ipatrust
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `realm` | The realm name string. | yes
 `admin` | Active Directory domain administrator string. | no
 `password` | Active Directory domain administrator's password string. | no
 `server` | Domain controller for the Active Directory domain string. | no
 `trust_secret` | Shared secret for the trust string. | no
-`trust_type` | Trust type. Currently, only 'ad' for Active Directory is supported. | no
 `base_id` | First posix id for the trusted domain integer. | no
 `range_size` | Size of the ID range reserved for the trusted domain integer. | no
 `range_type` | Type of trusted domain ID range, It can be one of `ipa-ad-trust` or `ipa-ad-trust-posix`and defaults to `ipa-ad-trust`. | no

README-user.md

@@ -24,7 +24,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -58,7 +58,6 @@ Example playbook to ensure a user is present:
       last: Acme
       uid: 10001
       gid: 100
-      gecos: "The Pinky"
       phone: "+555123457"
       email: pinky@acme.com
       passwordexpiration: "2023-01-19 23:59:59"
@@ -279,6 +278,7 @@ Example playbook to disable a user:
 
 This can also be done as an alternative with the `users` variable containing only names.
 
+
 Example playbook to enable users:
 
 ```yaml
@@ -297,22 +297,6 @@ Example playbook to enable users:
 
 This can also be done as an alternative with the `users` variable containing only names.
 
-Example playbook to rename users:
-
-```yaml
----
-- name: Playbook to handle users
-  hosts: ipaserver
-  become: true
-
-  tasks:
-  # Rename user pinky to reddy
-  - ipauser:
-      ipaadmin_password: SomeADMINpassword
-      name: pinky
-      rename: reddy
-      state: renamed
-```
 
 Example playbook to unlock users:
 
@@ -368,45 +352,19 @@ Example playbook to ensure users are absent:
       state: absent
 ```
 
-When using FreeIPA 4.8.0+, SMB logon script, profile, home directory and home drive can be set for users.
-
-In the example playbook to set SMB attributes note that `smb_profile_path` and `smb_home_dir` use paths in UNC format, which includes backslashes ('\\`). If the paths are quoted, the backslash needs to be escaped becoming "\\", so the path `\\server\dir` becomes `"\\\\server\\dir"`. If the paths are unquoted the slashes do not have to be escaped.
-
-The YAML specification states that a colon (':') is a key separator and a dash ('-') is an item marker, only  with a space after them, so using both unquoted as part of a path should not be a problem. If a space is needed after a colon or a dash, then a quoted string must be used as in `"user - home"`. For the `smb_home_drive` attribute is is recomended that a quoted string is used, to improve readability.
-
-Example playbook to set SMB attributes:
-
-```yaml
----
-- name: Plabook to handle users
-  hosts: ipaserver
-  become: false
-
-  tasks:
-  - name: Ensure user 'smbuser' is present with smb attributes
-    ipauser:
-      ipaadmin_password: SomeADMINpassword
-      name: smbuser
-      first: SMB
-      last: User
-      smb_logon_script: N:\logonscripts\startup
-      smb_profile_path: \\server\profiles\some_profile
-      smb_home_dir: \\users\home\smbuser
-      smb_home_drive: "U:"
-```
-
 
 Variables
 =========
 
+ipauser
+-------
+
 **General Variables:**
 
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` | The list of user name strings. `name` with *user variables* or `users` containing *user variables* need to be used. | no
 **User variables** | Only used with `name` variable in the first level. | no
 `users` | The list of user dicts. Each `users` dict entry can contain **user variables**.<br>There is one required option in the `users` dict:| no
@@ -416,7 +374,7 @@ Variable | Description | Required
 `update_password` | Set password for a user in present state only on creation or always. It can be one of `always` or `on_create` and defaults to `always`. | no
 `preserve` | Delete a user, keeping the entry available for future use. (bool)  | no
 `action` | Work on user or member level. It can be on of `member` or `user` and defaults to `user`. | no
-`state` | The state to ensure. It can be one of `present`, `absent`, `enabled`, `disabled`, `renamed`, `unlocked` or `undeleted`, default: `present`. Only `names` or `users` with only `name` set are allowed if state is not `present`. | yes
+`state` | The state to ensure. It can be one of `present`, `absent`, `enabled`, `disabled`, `unlocked` or `undeleted`, default: `present`. Only `names` or `users` with only `name` set are allowed if state is not `present`. | yes
 
 
 
@@ -424,8 +382,8 @@ Variable | Description | Required
 
 Variable | Description | Required
 -------- | ----------- | --------
-`first` \| `givenname` | The first name string. Required if user does not exist. | no
-`last` \| `sn` | The last name string. Required if user does not exist. | no
+`first` \| `givenname` | The first name string. | no
+`last` \| `sn` | The last name string. | no
 `fullname` \| `cn` | The full name string. | no
 `displayname` | The display name string. | no
 `homedir` | The home directory string. | no
@@ -436,10 +394,8 @@ Variable | Description | Required
 `passwordexpiration` \| `krbpasswordexpiration` | The kerberos password expiration date. Possible formats: `YYYYMMddHHmmssZ`, `YYYY-MM-ddTHH:mm:ssZ`, `YYYY-MM-ddTHH:mmZ`, `YYYY-MM-ddZ`, `YYYY-MM-dd HH:mm:ssZ` or `YYYY-MM-dd HH:mmZ`. The trailing 'Z' can be skipped. Only usable with IPA versions 4.7 and up. | no
 `password` | The user password string. | no
 `random` | Generate a random user password | no
-`uid` \| `uidnumber` | User ID Number (system will assign one if not provided). | no
-`gid` \| `gidnumber` | Group ID Number. | no
-`gecos` | GECOS | no
-`street` | Street address | no
+`uid` \| `uidnumber` | The UID integer. | no
+`gid` \| `gidnumber` | The GID integer. | no
 `city` | City | no
 `userstate` \| `st` | State/Province | no
 `postalcode` \| `zip` | Postalcode/ZIP | no
@@ -452,7 +408,7 @@ Variable | Description | Required
 `manager` | List of manager user names. | no
 `carlicense` | List of car licenses. | no
 `sshpubkey` \| `ipasshpubkey` | List of SSH public keys. | no
-`userauthtype` \| `ipauserauthtype` | List of supported user authentication types. Choices: `password`, `radius`, `otp`, `pkinit`, `hardened`, `idp` and `""`. An additional check ensures that only types can be used that are supported by the IPA version. Use empty string to reset userauthtype to the initial value. | no
+`userauthtype` | List of supported user authentication types. Choices: `password`, `radius`, `otp` and ``. Use empty string to reset userauthtype to the initial value. | no
 `userclass` | User category. (semantics placed on this attribute are for local interpretation). | no
 `radius` | RADIUS proxy configuration  | no
 `radiususer` | RADIUS proxy username | no
@@ -460,8 +416,6 @@ Variable | Description | Required
 `employeenumber` | Employee Number | no
 `employeetype` | Employee Type | no
 `preferredlanguage` | Preferred Language | no
-`idp` \| `ipaidpconfiglink` | External IdP configuration | no
-`idp_user_id` \| `ipaidpsub` | A string that identifies the user at external IdP | no
 `certificate` | List of base-64 encoded user certificates. | no
 `certmapdata` | List of certificate mappings. Either `data` or `certificate` or `issuer` together with `subject` need to be specified. Only usable with IPA versions 4.5 and up. <br>Options: | no
 &nbsp; | `certificate` - Base-64 encoded user certificate, not usable with other certmapdata options. | no
@@ -469,28 +423,26 @@ Variable | Description | Required
 &nbsp; | `subject` - Subject of the certificate, only usable together with `issuer` option. | no
 &nbsp; | `data` - Certmap data, not usable with other certmapdata options. | no
 `noprivate` | Do not create user private group. (bool) | no
-`smb_logon_script` \| `ipantlogonscript` | SMB logon script path. Requires FreeIPA version 4.8.0+. | no 
-`smb_profile_path:` \| `ipantprofilepath` | SMB profile path, in UNC format. Requires FreeIPA version 4.8.0+. | no 
-`smb_home_dir` \| `ipanthomedirectory` | SMB Home Directory, in UNC format. Requires FreeIPA version 4.8.0+.  | no 
-`smb_home_drive` \| `ipanthomedirectorydrive` | SMB Home Directory Drive, a single upercase letter (A-Z) followed by a colon (:), for example "U:". Requires FreeIPA version 4.8.0+. | no 
-`rename` \| `new_name` | Rename the user object to the new name string. Only usable with `state: renamed`. | no
 `nomembers` | Suppress processing of membership attributes. (bool) | no
 
 
+
 Return Values
 =============
 
+ipauser
+-------
+
 There are only return values if one or more random passwords have been generated.
 
 Variable | Description | Returned When
 -------- | ----------- | -------------
 `user` | User dict with random password. (dict) <br>Options: | If random is yes and user did not exist or update_password is yes
-&nbsp; | `randompassword` - The generated random password | If only one user is handled by the module without using the `users` parameter.
-&nbsp; | `name` - The user name of the user that got a new random password. (dict) <br> Options: <br> &nbsp; `randompassword` - The generated random password | If several users are handled by the module with the `users` parameter.
+&nbsp; | `randompassword` - The generated random password | If only one user is handled by the module
+&nbsp; | `name` - The user name of the user that got a new random password. (dict) <br> Options: <br> &nbsp; `randompassword` - The generated random password | If several users are handled by the module
 
 
 Authors
 =======
 
-- Thomas Woerner
-- Rafael Jeffman
+Thomas Woerner

README-vault.md

@@ -24,7 +24,7 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -210,33 +210,32 @@ Example playbook to make sure vault is absent:
 Variables
 =========
 
+ipavault
+-------
+
 Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
-`ipaapi_context` | The context in which the module will execute. Currently only `client` is supported by this module, and use of `server` will raise a failure. | no
-`ipaapi_ldap_cache` | Use LDAP cache for IPA connection. The bool setting defaults to yes. (bool) | no
 `name` \| `cn` | The list of vault name strings. | yes
 `description` | The vault description string. | no
+`nomembers` | Suppress processing of membership attributes. (bool) | no
 `password` \| `vault_password` \| `ipavaultpassword` \| `old_password`| Vault password. | no
 `password_file` \| `vault_password_file` \| `old_password_file`| File containing Base64 encoded Vault password. | no
 `new_password` | Vault new password. | no
 `new_password_file` | File containing Base64 encoded new Vault password. | no
-`public_key ` \| `vault_public_key` \| `ipavaultpublickey` \| `new_public_key` | Base64 encoded vault public key. | no
-`public_key_file` \| `vault_public_key_file` \| `new_public_key_file` | Path to file with public key. | no
-`private_key `\| `vault_private_key` \| `ipavaultprivatekey` | Base64 encoded vault private key. Used only to retrieve data. | no
+`public_key ` \| `vault_public_key` \| `old_password_file` | Base64 encoded vault public key. | no
+`public_key_file` \| `vault_public_key_file` | Path to file with public key. | no
+`private_key `\| `vault_private_key` | Base64 encoded vault private key. Used only to retrieve data. | no
 `private_key_file` \| `vault_private_key_file` | Path to file with private key. Used only to retrieve data. | no
 `salt` \| `vault_salt` \| `ipavaultsalt` | Vault salt. | no
 `vault_type` \| `ipavaulttype` | Vault types are based on security level. It can be one of `standard`, `symmetric` or `asymmetric`, default: `symmetric` | no
-`username` \| `user` | Any user can own one or more user vaults. | no
+`user` \| `username` | Any user can own one or more user vaults. | no
 `service` | Any service can own one or more service vaults. | no
 `shared` | Vault is shared. Default to false. (bool) | no
-`users` | List of users that are members of the vault. | no
-`groups` | List of groups that are member of the vault. | no
-`services` | List of services that are member of the vault. | no
-`owners` \| `ownerusers` | List of users that are owners of the vault. | no
-`ownergroups` | List of groups that are owners of the vault. | no
-`ownerservices` | List of services that are owners of the vault. | no
+`users` | Users that are members of the vault. | no
+`groups` | Groups that are member of the vault. | no
+`services` | Services that are member of the vault. | no
 `data` \|`vault_data` \| `ipavaultdata` | Data to be stored in the vault. | no
 `in` \| `datafile_in` | Path to file with data to be stored in the vault. | no
 `out` \| `datafile_out` | Path to file to store data retrieved from the vault. | no
@@ -247,6 +246,9 @@ Variable | Description | Required
 Return Values
 =============
 
+ipavault
+--------
+
 There is only a return value if `state` is `retrieved`.
 
 Variable | Description | Returned When

README.md

@@ -3,7 +3,7 @@ FreeIPA Ansible collection
 
 This repository contains [Ansible](https://www.ansible.com/) roles and playbooks to install and uninstall [FreeIPA](https://www.freeipa.org/) `servers`, `replicas` and `clients`. Also modules for group, host, topology and user management.
 
-**Note**: The Ansible playbooks and roles require a configured Ansible environment where the Ansible nodes are reachable and are properly set up to have an IP address and a working package manager.
+**Note**: The ansible playbooks and roles require a configured ansible environment where the ansible nodes are reachable and are properly set up to have an IP address and a working package manager.
 
 Features
 --------
@@ -12,13 +12,6 @@ Features
 * One-time-password (OTP) support for client installation
 * Repair mode for clients
 * Backup and restore, also to and from controller
-* Smartcard setup for servers and clients
-* Inventory plugin freeipa
-* Modules for automembership rule management
-* Modules for automount key management
-* Modules for automount location management
-* Modules for automount map management
-* Modules for certificate management
 * Modules for config management
 * Modules for delegation management
 * Modules for dns config management
@@ -31,27 +24,18 @@ Features
 * Modules for hbacsvcgroup management
 * Modules for host management
 * Modules for hostgroup management
-* Modules for idoverridegroup management
-* Modules for idoverrideuser management
-* Modules for idp management
-* Modules for idrange management
-* Modules for idview management
 * Modules for location management
-* Modules for netgroup management
 * Modules for permission management
 * Modules for privilege management
 * Modules for pwpolicy management
 * Modules for role management
 * Modules for self service management
-* Modules for server management
 * Modules for service management
-* Modules for service delegation rule management
-* Modules for service delegation target management
 * Modules for sudocmd management
 * Modules for sudocmdgroup management
 * Modules for sudorule management
 * Modules for topology management
-* Modules for trust management
+* Modules fot trust management
 * Modules for user management
 * Modules for vault management
 
@@ -74,7 +58,9 @@ Requirements
 ------------
 
 **Controller**
-* Ansible version: 2.14+
+* Ansible version: 2.8+ (ansible-freeipa is an Ansible Collection)
+* /usr/bin/kinit is required on the controller if a one time password (OTP) is used
+* python3-gssapi is required on the controller if a one time password (OTP) is used with keytab to install the client.
 
 **Node**
 * Supported FreeIPA version (see above)
@@ -109,10 +95,9 @@ You can use the roles directly within the top directory of the git repo, but to
 You can either adapt ansible.cfg:
 
 ```
-roles_path        = /my/dir/ansible-freeipa/roles
-library           = /my/dir/ansible-freeipa/plugins/modules
-module_utils      = /my/dir/ansible-freeipa/plugins/module_utils
-inventory_plugins = /my/dir/ansible-freeipa/plugins/inventory
+roles_path   = /my/dir/ansible-freeipa/roles
+library      = /my/dir/ansible-freeipa/plugins/modules
+module_utils = /my/dir/ansible-freeipa/plugins/module_utils
 ```
 
 Or you can link the directories:
@@ -127,7 +112,7 @@ ansible-freeipa/plugins/module_utils to ~/.ansible/plugins/
 
 There are RPM packages available for Fedora 29+. These are installing the roles and modules into the global Ansible directories for `roles`, `plugins/modules` and `plugins/module_utils` in the `/usr/share/ansible` directory. Therefore is it possible to use the roles and modules without adapting the names like it is done in the example playbooks.
 
-**Ansible Galaxy**
+**Ansible galaxy**
 
 This command will get the whole collection from galaxy:
 
@@ -135,13 +120,23 @@ This command will get the whole collection from galaxy:
 ansible-galaxy collection install freeipa.ansible_freeipa
 ```
 
+Installing collections using the ansible-galaxy command is only supported with ansible 2.9+.
+
+The mazer tool can be used for to install the collection for ansible 2.8:
+
+```bash
+mazer install freeipa.ansible_freeipa
+```
+
 Ansible galaxy does not support the use of dash ('-') in a name and is automatically replacing this with an underscore ('\_'). Therefore the name is `ansible_freeipa`. The ansible_freeipa collection will be placed in the directory `~/.ansible/collections/ansible_collections/freeipa/ansible_freeipa` where it will be automatically be found for this user.
 
+The needed adaptions of collection prefixes for `modules` and `module_utils` will be done with ansible-freeipa release `0.1.6` for galaxy.
+
 
 Ansible inventory file
 ----------------------
 
-The most important parts of the inventory file is the definition of the nodes, settings and the management modules. Please remember to use [Ansible Vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html) for passwords. The examples here are not using vault for better readability.
+The most important parts of the inventory file is the definition of the nodes, settings and the management modules. Please remember to use [Ansible vault](https://docs.ansible.com/ansible/latest/user_guide/vault.html) for passwords. The examples here are not using vault for better readability.
 
 **Master server**
 
@@ -285,8 +280,7 @@ ipaserver_domain=test.local
 ipaserver_realm=TEST.LOCAL
 ```
 
-For enhanced security it is possible to use a auto-generated one-time-password (OTP). This will be generated on the (first) server.
-
+For enhanced security it is possible to use a auto-generated one-time-password (OTP). This will be generated on the controller using the (first) server. It is needed to have the Python gssapi bindings installed on the controller for this.
 To enable the generation of the one-time-password:
 ```yaml
 [ipaclients:vars]
@@ -351,7 +345,7 @@ With this playbook it is possible to add a list of topology segments using the `
 Playbooks
 =========
 
-The playbooks needed to deploy or undeploy servers, replicas and clients are part of the repository and placed in the playbooks folder. There are also playbooks to deploy and undeploy clusters. With them it is only needed to add an inventory file:
+The playbooks needed to deploy or undeploy server, replicas and clients are part of the repository and placed in the playbooks folder. There are also playbooks to deploy and undeploy clusters. With them it is only needed to add an inventory file:
 ```
 playbooks\
         install-client.yml
@@ -372,7 +366,7 @@ ansible-playbook -v -i inventory/hosts install-server.yml
 ```
 This will deploy the master server defined in the inventory file.
 
-If Ansible Vault is used for passwords, then it is needed to adapt the playbooks in this way:
+If Ansible vault is used for passwords, then it is needed to adapt the playbooks in this way:
 ```yaml
 ---
 - name: Playbook to configure IPA servers
@@ -423,17 +417,10 @@ Roles
 * [Replica](roles/ipareplica/README.md)
 * [Client](roles/ipaclient/README.md)
 * [Backup](roles/ipabackup/README.md)
-* [SmartCard server](roles/ipasmartcard_server/README.md)
-* [SmartCard client](roles/ipasmartcard_client/README.md)
 
 Modules in plugin/modules
 =========================
 
-* [ipaautomember](README-automember.md)
-* [ipaautomountkey](README-automountkey.md)
-* [ipaautomountlocation](README-automountlocation.md)
-* [ipaautomountmap](README-automountmap.md)
-* [ipacert](README-cert.md)
 * [ipaconfig](README-config.md)
 * [ipadelegation](README-delegation.md)
 * [ipadnsconfig](README-dnsconfig.md)
@@ -443,25 +430,16 @@ Modules in plugin/modules
 * [ipagroup](README-group.md)
 * [ipahbacrule](README-hbacrule.md)
 * [ipahbacsvc](README-hbacsvc.md)
-* [ipahbacsvcgroup](README-hbacsvcgroup.md)
+* [ipahbacsvcgroup](README-hbacsvc.md)
 * [ipahost](README-host.md)
 * [ipahostgroup](README-hostgroup.md)
-* [idoverridegroup](README-idoverridegroup.md)
-* [idoverrideuser](README-idoverrideuser.md)
-* [idp](README-idp.md)
-* [idrange](README-idrange.md)
-* [idview](README-idview.md)
-* [ipalocation](README-location.md)
-* [ipanetgroup](README-netgroup.md)
-* [ipapermission](README-permission.md)
-* [ipaprivilege](README-privilege.md)
+* [ipalocation](README-ipalocation.md)
+* [ipapermission](README-ipapermission.md)
+* [ipaprivilege](README-ipaprivilege.md)
 * [ipapwpolicy](README-pwpolicy.md)
 * [iparole](README-role.md)
-* [ipaselfservice](README-selfservice.md)
-* [ipaserver](README-server.md)
+* [ipaselfservice](README-ipaselfservice.md)
 * [ipaservice](README-service.md)
-* [ipaservicedelegationrule](README-servicedelegationrule.md)
-* [ipaservicedelegationtarget](README-servicedelegationtarget.md)
 * [ipasudocmd](README-sudocmd.md)
 * [ipasudocmdgroup](README-sudocmdgroup.md)
 * [ipasudorule](README-sudorule.md)
@@ -472,8 +450,3 @@ Modules in plugin/modules
 * [ipavault](README-vault.md)
 
 If you want to write a new module please read [writing a new module](plugins/modules/README.md).
-
-Inventory plugins in plugin/inventory
-=====================================
-
-* [freeipa](README-inventory-plugin-freeipa.md)

galaxy.yml

@@ -1,4 +1,3 @@
----
 namespace: "freeipa"
 name: "ansible_freeipa"
 version: "A.B.C"
@@ -13,10 +12,11 @@ homepage: "https://github.com/freeipa/ansible-freeipa"
 issues: "https://github.com/freeipa/ansible-freeipa/issues"
 
 readme: "README.md"
-license:
-  - "GPL-3.0-or-later"
+license: "GPL-3.0-or-later"
+
+dependencies:
+
 tags:
-  - "linux"
   - "system"
   - "identity"
   - "ipa"

infra/azure/azure-pipelines.yml

@@ -1,73 +0,0 @@
----
-trigger:
-- master
-
-pool:
-  vmImage: 'ubuntu-20.04'
-
-variables:
-  ansible_version: "-core >=2.16,<2.17"
-  ansible_latest: "-core"
-  ansible_minimum: "-core <2.16"
-  distros: "fedora-latest,c9s,c10s,fedora-rawhide"
-
-stages:
-
-- stage: fedora_latest_ansible_latest
-  dependsOn: []
-  jobs:
-  - template: templates/group_tests.yml
-    parameters:
-      build_number: $(Build.BuildNumber)
-      distro: fedora-latest
-      ansible_version: ${{ variables.ansible_latest }}
-      skip_git_test: true
-
-- stage: fedora_latest_ansible_2_15
-  dependsOn: []
-  jobs:
-  - template: templates/group_tests.yml
-    parameters:
-      build_number: $(Build.BuildNumber)
-      distro: fedora-latest
-      ansible_version: ${{ variables.ansbile_minimum }}
-      skip_git_test: true
-
-# Supported distros
-
-- ${{ each distro in split(variables.distros, ',') }}:
-  - stage: ${{ replace(distro, '-', '_') }}_ansible_2_16
-    dependsOn: []
-    jobs:
-    - template: templates/group_tests.yml
-      parameters:
-        build_number: $(Build.BuildNumber)
-        distro: ${{ distro }}
-        ansible_version: ${{ variables.ansible_version }}
-        skip_git_test: true
-        test_galaxy: false
-
-# Galaxy on Fedora
-
-- stage: galaxy_fedora_latest_ansible_2_16
-  dependsOn: []
-  jobs:
-  - template: templates/group_tests.yml
-    parameters:
-      build_number: $(Build.BuildNumber)
-      distro: fedora-latest
-      ansible_version: ${{ variables.ansible_version }}
-      skip_git_test: true
-      test_galaxy: true
-
-# CentOS 8 Stream, latest supported Ansible version.
-
-- stage: c8s_ansible_2_16
-  dependsOn: []
-  jobs:
-  - template: templates/group_tests.yml
-    parameters:
-      build_number: $(Build.BuildNumber)
-      distro: c8s
-      ansible_version: "-core <2.17"
-      skip_git_test: true

infra/azure/build-containers.yml

@@ -1,35 +0,0 @@
----
-schedules:
-- cron: "0 0 * * 0"
-  displayName: Weekly Sunday midnight build
-  branches:
-    include:
-    - master
-  always: true
-
-trigger: none
-
-pool:
-  vmImage: 'ubuntu-24.04'
-
-variables: { distros: "fedora-latest,fedora-rawhide,c9s,c10s" }
-
-stages:
-
-- ${{ each distro in split(variables.distros, ',') }}:
-  - stage: build_${{ join('_', split(distro, '-')) }}
-    dependsOn: []
-    jobs:
-    - template: templates/build_container.yml
-      parameters:
-        distro: ${{ distro }}
-
-# Special case for CentOS 8 Stream
-- stage: CentOS_8_Stream
-  dependsOn: []
-  jobs:
-  - template: templates/build_container.yml
-    parameters:
-      distro: c8s
-      # ansible-core 2.17+ cannot be used to deploy on CentOS 8 Stream.
-      ansible_core_version: "<2.17"

infra/azure/nightly.yml

@@ -1,79 +0,0 @@
----
-schedules:
-- cron: "0 19 * * *"
-  displayName: Nightly Builds
-  branches:
-    include:
-    - master
-  always: true
-
-trigger: none
-
-pool:
-  vmImage: 'ubuntu-20.04'
-
-variables:
-  # We need to have two sets, as c8s is not supported by all ansible versions
-  recent_distros: "fedora-latest,fedora-rawhide,c10s,c9s"
-  distros: "fedora-latest,fedora-rawhide,c10s,c9s,c8s"
-  ansible_latest: "-core"
-  ansible_minimum: "-core <2.16"
-  ansible_version: "-core >=2.16,<2.17"
-
-stages:
-
-# Minimum ansible
-
-- ${{ each distro in split(variables.distros, ',') }}:
-  - stage: ${{ replace(distro, '-', '_') }}_ansible_2_15
-    dependsOn: []
-    jobs:
-    - template: templates/group_tests.yml
-      parameters:
-        build_number: $(Build.BuildNumber)
-        distro: fedora-latest
-        ansible_version: ${{ variables.ansible_minimum }}
-        skip_git_test: true
-        test_galaxy: false
-
-# Latest ansible
-
-- ${{ each distro in split(variables.recent_distros, ',') }}:
-  - stage: ${{ replace(distro, '-', '_') }}_ansible_latest
-    dependsOn: []
-    jobs:
-    - template: templates/group_tests.yml
-      parameters:
-        build_number: $(Build.BuildNumber)
-        distro: ${{ distro }}
-        ansible_version: ${{ variables.ansible_latest }}
-        skip_git_test: true
-        test_galaxy: false
-
-# Selected ansible-core version
-
-- ${{ each distro in split(variables.distros, ',') }}:
-  - stage: ${{ replace(distro, '-', '_') }}_ansible_2_16
-    dependsOn: []
-    jobs:
-    - template: templates/group_tests.yml
-      parameters:
-        build_number: $(Build.BuildNumber)
-        distro: ${{ distro }}
-        ansible_version: ${{ variables.ansible_version }}
-        skip_git_test: true
-        test_galaxy: false
-
-# Galaxy collection with selected ansible-core version
-
-- ${{ each distro in split(variables.distros, ',') }}:
-  - stage: galaxy_${{ replace(distro, '-', '_') }}_asible_2_16
-    dependsOn: []
-    jobs:
-    - template: templates/group_tests.yml
-      parameters:
-        build_number: $(Build.BuildNumber)
-        distro: ${{ distro }}
-        ansible_version: ${{ variables.ansible_version }}
-        skip_git_test: true
-        test_galaxy: true

infra/azure/pr-pipeline.yml

@@ -1,39 +0,0 @@
----
-trigger:
-- master
-
-pool:
-  vmImage: 'ubuntu-20.04'
-
-variables:
-  distros: "fedora-latest,c10s,c9s,c8s,fedora-rawhide"
-  ansible_version: "-core >=2.15,<2.16"
-
-stages:
-
-# Test with repository in all distros
-
-- ${{ each distro in split(variables.distros, ',') }}:
-  - stage: ${{ replace(distro, '-', '_') }}_ansible_2_16
-    dependsOn: []
-    jobs:
-    - template: templates/run_tests.yml
-      parameters:
-        build_number: $(Build.BuildNumber)
-        distro: ${{ distro }}
-        ansible_version: ${{ variables.ansible_version }}
-        skip_git_test: false
-        test_galaxy: false
-
-# Galaxy on Fedora
-
-- stage: galaxy_fedora_latest_ansible_2_16
-  dependsOn: []
-  jobs:
-  - template: templates/run_tests.yml
-    parameters:
-      build_number: $(Build.BuildNumber)
-      distro: fedora-latest
-      ansible_version: ${{ variables.ansible_version }}
-      skip_git_test: false
-      test_galaxy: true

infra/azure/scripts/get_test_modules.py

@@ -1,214 +0,0 @@
-"""Filter tests based on plugin modifications."""
-
-import sys
-import os
-from importlib.machinery import SourceFileLoader
-import types
-from unittest import mock
-import yaml
-
-
-PYTHON_IMPORT = __import__
-
-
-def get_plugins_from_playbook(playbook):
-    """Get all plugins called in the given playbook."""
-    def get_tasks(task_block):
-        """
-        Get all plugins used on tasks.
-
-        Recursively process "block", "include_tasks" and "import_tasks".
-        """
-        _result = set()
-        for tasks in task_block:
-            for task in tasks:
-                original_task = task
-                if task == "block":
-                    _result.update(get_tasks(tasks["block"]))
-                elif task in ["include_tasks", "import_tasks"
-                              "ansible.builtin.include_tasks",
-                              "ansible.builtin.import_tasks"]:
-                    parent = os.path.dirname(playbook)
-                    include_task = tasks[task]
-                    if isinstance(include_task, dict):
-                        include_file = os.path.join(
-                            parent, include_task["file"]
-                        )
-                    else:
-                        include_file = os.path.join(parent, include_task)
-                    _result.update(get_plugins_from_playbook(include_file))
-                elif task in ["include_role",
-                              "ansible.builtin.include_role"]:
-                    _result.add(f"_{tasks[original_task]['name']}")
-                elif task.startswith("ipa"):
-                    # assume we are only interested in 'ipa*' modules/roles
-                    _result.add(task)
-                elif task == "role":
-                    # not really a "task", but we'll handle the same way.
-                    _result.add(f"_{tasks[task]}")
-        return _result
-
-    def load_playbook(filename):
-        """Load playbook file using Python's YAML parser."""
-        if not (filename.endswith("yml") or filename.endswith("yaml")):
-            return []
-        # print("Processing:", playbook)
-        try:
-            with open(filename, "rt") as playbook_file:
-                data = yaml.safe_load(playbook_file)
-        except yaml.scanner.ScannerError:  # If not a YAML/JSON file.
-            return []
-        except yaml.parser.ParserError:  # If not a YAML/JSON file.
-            return []
-        return data if data else []
-
-    data = load_playbook(playbook)
-    task_blocks = [t.get("tasks", []) if "tasks" in t else [] for t in data]
-    role_blocks = [t.get("roles", []) if "roles" in t else [] for t in data]
-    # assume file is a list of tasks if no "tasks" entry found.
-    if not task_blocks:
-        task_blocks = [data]
-    _result = set()
-    for task_block in task_blocks:
-        _result.update(get_tasks(task_block))
-    # roles
-    for role_block in role_blocks:
-        _result.update(get_tasks(role_block))
-
-    return _result
-
-
-def import_mock(name, *args):
-    """Intercept 'import' calls and store module name."""
-    if not hasattr(import_mock, "call_list"):
-        setattr(import_mock, "call_list", set())  # noqa: B010
-    import_mock.call_list.add(name)  # pylint: disable=no-member
-    try:
-        # print("NAME:", name)
-        return PYTHON_IMPORT(name, *args)
-    except ModuleNotFoundError:
-        # We're not really interested in loading the module
-        # if it can't be imported, it is not something we really care.
-        return mock.Mock()
-    except Exception:  # pylint: disable=broad-except
-        print(
-            "An unexpected error occured. Do you have all requirements set?",
-            file=sys.stderr
-        )
-        sys.exit(1)
-
-
-def parse_playbooks(test_module):
-    """Load all playbooks for 'test_module' directory."""
-    if test_module.name[0] in [".", "_"] or test_module.name == "pytests":
-        return []
-    _files = set()
-    for arg in os.scandir(test_module):
-        if arg.is_dir():
-            _files.update(parse_playbooks(arg))
-        else:
-            for playbook in get_plugins_from_playbook(arg.path):
-                if playbook.startswith("_"):
-                    source = f"roles/{playbook[1:]}"
-                    if os.path.isdir(source):
-                        _files.add(source)
-                else:
-                    source = f"plugins/modules/{playbook}.py"
-                    if os.path.isfile(source):
-                        _files.add(source)
-                        # If a plugin imports a module from the repository,
-                        # we'l find it by patching the builtin __import__
-                        # function and importing the module from the source
-                        # file. The modules imported as a result of the import
-                        # will be added to the import_mock.call_list list.
-                        with mock.patch(
-                            "builtins.__import__", side_effect=import_mock
-                        ):
-                            # pylint: disable=no-value-for-parameter
-                            try:
-                                loader = SourceFileLoader(playbook, source)
-                                loader.exec_module(
-                                    types.ModuleType(loader.name)
-                                )
-                            except Exception:  # pylint: disable=broad-except
-                                # If import fails, we'll assume there's no
-                                # plugin to be loaded. This is of little risk
-                                # it is rare that a plugin includes another.
-                                pass
-                        # pylint: disable=no-member
-                        candidates = [
-                            f.split(".")[1:]
-                            for f in import_mock.call_list
-                            if f.startswith("ansible.")
-                        ]
-                        # pylint: enable=no-member
-                        files = [
-                            "plugins/" + "/".join(f) + ".py"
-                            for f in candidates
-                        ]
-                        _files.update([f for f in files if os.path.isfile(f)])
-                    else:
-                        source = f"roles/{playbook}"
-                        if os.path.isdir(source):
-                            _files.add(source)
-
-    return _files
-
-
-def map_test_module_sources(base):
-    """Create a map of 'test-modules' to 'plugin-sources', from 'base'."""
-    # Find root directory of playbook tests.
-    script_dir = os.path.dirname(__file__)
-    test_root = os.path.realpath(os.path.join(script_dir, f"../../../{base}"))
-    # create modules:source_files map
-    _result = {}
-    for test_module in [d for d in os.scandir(test_root) if d.is_dir()]:
-        _depends_on = parse_playbooks(test_module)
-        if _depends_on:
-            _result[test_module.name] = _depends_on
-    return _result
-
-
-def usage(err=0):
-    print("get_test_modules.py [-h|--help] [-p|--pytest] PY_SRC...")
-    print(
-        """
-Print a comma-separated list of modules that should be tested if
-PY_SRC is modified.
-
-Options:
-
-    -h, --help      Print this message and exit.
-    -p, --pytest    Evaluate pytest tests (playbooks only).
-"""
-    )
-    sys.exit(err)
-
-
-def main():
-    """Program entry point."""
-    if "-h" in sys.argv or "--help" in sys.argv:
-        usage()
-    _base = "tests"
-    if "-p" in sys.argv or "--pytest" in sys.argv:
-        _base = "tests/pytests"
-    call_args = [x for x in sys.argv[1:] if x not in ["-p", "--pytest"]]
-    _mapping = map_test_module_sources(_base)
-    _test_suits = (
-        [
-            _module for _module, _files in _mapping.items()
-            for _arg in call_args
-            for _file in _files
-            if _file.startswith(_arg)
-        ] + [
-            _role for _role in [x for x in _mapping if x.endswith("_role")]
-            for _arg in call_args
-            if _arg.startswith("roles/ipa" + _role[:-5])
-        ]
-    )
-    if _test_suits:
-        print(",".join(sorted(_test_suits)))
-
-
-if __name__ == "__main__":
-    main()

infra/azure/scripts/set_test_modules

@@ -1,67 +0,0 @@
-#!/bin/bash -eu
-# This file shoud be source'd (. set_test_modules) rather than executed.
-#
-# Set SKIP_GIT_TEST="True" or use -a to prevent git modification comparison.
-#
-
-RED="\033[31;1m"
-RST="\033[0m"
-
-die() {
-    echo -e "${RED}${*}${RST}" >&2
-}
-
-BASEDIR="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")")"
-TOPDIR="$(readlink -f "${BASEDIR}/../../..")"
-
-[ -n "$(command -v python3)" ] && python="$(command -v python3)" || python="$(command -v python2)"
-
-pushd "${TOPDIR}" >/dev/null 2>&1 || die "Failed to change directory."
-
-SKIP_GIT_TEST=${SKIP_GIT_TEST:-"False"}
-
-while getopts ":a" opt
-do
-    case "${opt}" in
-        a) SKIP_GIT_TEST="True" ;;
-        *) ;; # ignore other options
-    esac
-done
-
-files_list=$(mktemp)
-
-enabled_modules="None"
-enabled_tests="None"
-
-if [ "${SKIP_GIT_TEST}" != "True" ]
-then
-    remote="$(basename "$(mktemp -u remote_XXXXXX)")"
-    git remote add "${remote}" https://github.com/freeipa/ansible-freeipa
-    git fetch --prune --no-tags --quiet "${remote}"
-    git diff "${remote}/master" --name-only > "${files_list}"
-    git remote remove "${remote}"
-
-    # shellcheck disable=SC2046
-    enabled_modules="$(${python} "${BASEDIR}/get_test_modules.py" $(cat "${files_list}"))"
-    [ -z "${enabled_modules}" ] && enabled_modules="None"
-
-    # Get individual tests that should be executed
-    mapfile -t tests < <(sed -n 's#.*/\(test_[^/]*\).yml#\1#p' "${files_list}" | tr -d " ")
-    [ ${#tests[@]} -gt 0 ] && enabled_tests=$(IFS=, ; echo "${tests[*]}")
-    [ -z "${enabled_tests}" ] && enabled_tests="None"
-
-    [ -n "${enabled_tests}" ] && IPA_ENABLED_TESTS="${enabled_tests},${IPA_ENABLED_TESTS}"
-    [ -n "${enabled_modules}" ] && IPA_ENABLED_MODULES="${enabled_modules},${IPA_ENABLED_MODULES}"
-
-    rm -f "${files_list}"
-fi
-
-# Get all modules that should have tests executed
-
-export IPA_ENABLED_MODULES
-export IPA_ENABLED_TESTS
-
-echo "IPA_ENABLED_MODULES = [${IPA_ENABLED_MODULES}]"
-echo "IPA_ENABLED_TESTS = [${IPA_ENABLED_TESTS}]"
-
-popd >/dev/null 2>&1 || die "Failed to change back to original directory."

infra/azure/templates/build_container.yml

@@ -1,45 +0,0 @@
----
-parameters:
-  - name: distro
-    type: string
-  - name: python_version
-    type: string
-    default: 3.x
-  - name: ansible_core_version
-    default: ""
-
-jobs:
-- job: BuildTestImage_${{ join('_', split(parameters.distro, '-')) }}
-  displayName: Build ${{ parameters.distro }} test container
-  steps:
-  - task: UsePythonVersion@0
-    inputs:
-      versionSpec: '${{ parameters.python_version }}'
-
-  - script: python -m pip install --upgrade pip "ansible-core${{ parameters.ansible_core_version }}"
-    retryCountOnTaskFailure: 5
-    displayName: Install tools
-
-  - script: ansible-galaxy collection install containers.podman
-    displayName: Install Ansible Galaxy collections
-
-  - script: infra/image/build.sh -s ${{ parameters.distro }}
-    displayName: Build ${{ parameters.distro }} base image
-    env:
-      ANSIBLE_ROLES_PATH: "${PWD}/roles"
-      ANSIBLE_LIBRARY: "${PWD}/plugins/modules"
-      ANSIBLE_MODULE_UTILS: "${PWD}/plugins/module_utils"
-
-  - script: podman login -u="$QUAY_ROBOT_USERNAME" -p="$QUAY_ROBOT_TOKEN" quay.io
-    displayName: Registry login
-    env:
-      # Secrets needs to be mapped as env vars to work properly
-      QUAY_ROBOT_TOKEN: $(QUAY_ROBOT_TOKEN)
-
-  - script: |
-      podman push quay.io/ansible-freeipa/upstream-tests:${{parameters.distro}}-base quay.io/ansible-freeipa/upstream-tests:${{ parameters.distro }}-base
-    displayName: Push base image
-
-  - script: |
-      podman push quay.io/ansible-freeipa/upstream-tests:${{ parameters.distro }}-server quay.io/ansible-freeipa/upstream-tests:${{ parameters.distro }}-server
-    displayName: Push server image

infra/azure/templates/group_tests.yml

@@ -1,30 +0,0 @@
----
-parameters:
-  - name: distro
-    type: string
-    default: fedora-latest
-  - name: build_number
-    type: string
-  - name: ansible_version
-    type: string
-    default: ""
-  - name: skip_git_test
-    type: boolean
-    default: false
-  - name: test_galaxy
-    type: boolean
-    default: false
-
-jobs:
-
-- ${{ each group in split('1,2,3', ',') }}:
-  - template: run_tests.yml
-    parameters:
-      group_number: ${{ group }}
-      number_of_groups: 3
-      build_number: ${{ parameters.build_number }}
-      distro: ${{ parameters.distro }}
-      ansible_version: ${{ parameters.ansible_version }}
-      python_version: '< 3.12'
-      skip_git_test: ${{ parameters.skip_git_test }}
-      test_galaxy: ${{ parameters.test_galaxy }}

infra/azure/templates/prepare_environment.yaml

@@ -1,30 +0,0 @@
----
-parameters:
-  - name: distro
-    type: string
-    default: fedora-latest
-  - name: ansible_version
-    type: string
-    default: ""
-  - name: python_version
-    type: string
-    default: 3.x
-  - name: build_number
-    type: string
-
-steps:
-  - task: UsePythonVersion@0
-    inputs:
-      versionSpec: '${{ parameters.python_version }}'
-
-  - script: |
-      pip install "ansible${{ parameters.ansible_version }}" -r requirements-tests.txt
-    retryCountOnTaskFailure: 5
-    displayName: Install test dependencies
-
-  - script: ansible-galaxy collection install -r requirements-podman.yml
-    retryCountOnTaskFailure: 5
-    displayName: Install Ansible collections
-
-  - script: infra/image/start.sh ${{ parameters.distro }}-server
-    displayName: Setup target container for ${{ parameters.distro }}

infra/azure/templates/run_tests.yml

@@ -1,98 +0,0 @@
----
-parameters:
-  - name: group_number
-    type: number
-    default: 1
-  - name: number_of_groups
-    type: number
-    default: 1
-  - name: distro
-    type: string
-    default: fedora-latest
-  - name: ansible_version
-    type: string
-    default: ""
-  - name: python_version
-    type: string
-    default: 3.x
-  - name: build_number
-    type: string
-  - name: skip_git_test
-    type: boolean
-    default: true
-  - name: test_type
-    type: string
-    default: "playbook"
-  - name: test_galaxy
-    type: boolean
-    default: false
-
-jobs:
-- job: Test_Group${{ parameters.group_number }}
-  displayName: Run playbook tests ${{ parameters.distro }} (${{ parameters.group_number }}/${{ parameters.number_of_groups }})
-  timeoutInMinutes: 360
-  variables:
-  - template: variables.yaml
-  - template: variables_${{ parameters.distro }}.yaml
-  steps:
-  - template: prepare_environment.yaml
-    parameters:
-      build_number: ${{ parameters.build_number }}
-      distro: ${{ parameters.distro }}
-      ansible_version: ${{ parameters.ansible_version }}
-      python_version: ${{ parameters.python_version }}
-
-  - bash: echo "##vso[task.setvariable variable=TOPDIR]${PWD}"
-    displayName: Set repo rootdir
-
-  - script: |
-      . "${TOPDIR}/infra/azure/scripts/set_test_modules"
-      python3 utils/check_test_configuration.py ${{ parameters.distro }}
-    displayName: Check test configuration
-    env:
-       SKIP_GIT_TEST: ${{ parameters.skip_git_test }}
-
-  - script: |
-      git fetch --unshallow
-      utils/build-galaxy-release.sh -i
-    retryCountOnTaskFailure: 5
-    displayName: Build Galaxy release
-    condition: ${{ parameters.test_galaxy }}
-
-  - script: |
-      echo "PWD: ${PWD}"
-      echo "TOPDIR: ${TOPDIR}"
-      echo "ROLES: ${ANSIBLE_ROLES_PATH}"
-      echo "LIBRARY: ${ANSIBLE_LIBRARY}"
-      echo "MODULE_UTILS: ${ANSIBLE_MODULE_UTILS}"
-      . "${TOPDIR}/infra/azure/scripts/set_test_modules"
-      [ "${{ parameters.test_galaxy }}" == "True"  ] && cd ~/.ansible/collections/ansible_collections/freeipa/ansible_freeipa
-      pytest \
-          -m "${{ parameters.test_type }}" \
-          --verbose \
-          --color=yes \
-          --splits=${{ parameters.number_of_groups }} \
-          --group=${{ parameters.group_number }} \
-          --randomly-seed=$(date "+%Y%m%d") \
-          --suppress-no-test-exit-code \
-          --junit-xml=TEST-results-pr-check.xml
-    displayName: Run playbook tests
-    env:
-      SKIP_GIT_TEST: ${{ parameters.skip_git_test }}
-      ${{ if not(parameters.test_galaxy)  }}:
-        ANSIBLE_ROLES_PATH: "${PWD}/roles"
-        ANSIBLE_LIBRARY: "${PWD}/plugins"
-        ANSIBLE_MODULE_UTILS: "${PWD}/plugins/module_utils"
-      IPA_SERVER_HOST: ansible-freeipa-tests
-      RUN_TESTS_IN_DOCKER: podman
-      IPA_DISABLED_MODULES: ${{ variables.ipa_disabled_modules }}
-      IPA_DISABLED_TESTS: ${{ variables.ipa_disabled_tests }}
-      IPA_ENABLED_MODULES: ${{ variables.ipa_enabled_modules }}
-      IPA_ENABLED_TESTS: ${{ variables.ipa_enabled_tests }}
-      IPA_VERBOSITY: "-vvv"
-
-  - task: PublishTestResults@2
-    inputs:
-      mergeTestResults: true
-      testRunTitle: PlaybookTests-Build${{ parameters.build_number }}
-    condition: succeededOrFailed()

infra/azure/templates/variables.yaml

@@ -1,23 +0,0 @@
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# If no variable is to be set, add 'empty: true', as the
-# 'variables' dict cannot be empty.
-#
-# Example:
-#
-# disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
----
-variables:
-  # empty: true
-  # ipa_enabled_modules: >-
-  # ipa_enabled_tests: >-
-  ipa_disabled_modules: >-
-    config
-  # ipa_disabled_tests: >-

infra/azure/templates/variables_c10s.yaml

@@ -1,21 +0,0 @@
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# Example:
-#
-# ipa_disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
-# If no variables are set, set "empty: true" as at least
-# one item is needed in the set.
----
-variables:
-  empty: true
-#   ipa_enabled_modules: >-
-#   ipa_enabled_tests: >-
-#   ipa_disabled_modules: >-
-#   ipa_disabled_tests: >-

infra/azure/templates/variables_c8s.yaml

@@ -1,21 +0,0 @@
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# Example:
-#
-# ipa_disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
-# If no variables are set, set "empty: true" as at least
-# one item is needed in the set.
----
-variables:
-  empty: true
-#   ipa_enabled_modules: >-
-#   ipa_enabled_tests: >-
-#   ipa_disabled_modules: >-
-#   ipa_disabled_tests: >-

infra/azure/templates/variables_c9s.yaml

@@ -1,21 +0,0 @@
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# Example:
-#
-# ipa_disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
-# If no variables are set, set "empty: true" as at least
-# one item is needed in the set.
----
-variables:
-  empty: true
-#   ipa_enabled_modules: >-
-#   ipa_enabled_tests: >-
-#   ipa_disabled_modules: >-
-#   ipa_disabled_tests: >-

infra/azure/templates/variables_centos-7.yaml

@@ -1,20 +0,0 @@
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# Example:
-#
-# ipa_disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
-# If no variables are set, set "empty: true" as at least
-# one item is needed in the set.
----
-variables:
-  # ipa_enabled_modules: >-
-  # ipa_enabled_tests: >-
-  # ipa_disabled_modules: >-
-  ipa_disabled_tests: test_config_sid

infra/azure/templates/variables_fedora-latest.yaml

@@ -1,22 +0,0 @@
-#
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# Example:
-#
-# ipa_disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
-# If no variables are set, set "empty: true" as at least
-# one item is needed in the set.
----
-variables:
-  empty: true
-  # ipa_enabled_modules: >-
-  # ipa_enabled_tests: >-
-  # ipa_disabled_modules: >-
-  # ipa_disabled_tests: >-

infra/azure/templates/variables_fedora-rawhide.yaml

@@ -1,21 +0,0 @@
-#
-# Variables must be defined as comma separated lists.
-# For easier management of items to enable/disable,
-# use one test/module on each line, followed by a comma.
-#
-# Example:
-#
-# ipa_disabled_modules: >-
-#   dnsconfig,
-#   group,
-#   hostgroup
-#
-# If no variables are set, set "empty: true" as at least
-# one item is needed in the set.
----
-variables:
-  empty: true
-  # ipa_enabled_modules: >-
-  # ipa_enabled_tests: >-
-  # ipa_disabled_modules: >-
-  # ipa_disabled_tests: >-

infra/image/build-inventory

@@ -1,15 +0,0 @@
-[ipaserver]
-ansible-freeipa-image-builder ansible_connection=podman
-
-[ipaserver:vars]
-ipaadmin_password=SomeADMINpassword
-ipadm_password=SomeDMpassword
-ipaserver_domain=test.local
-ipaserver_realm=TEST.LOCAL
-ipaserver_setup_dns=true
-ipaserver_auto_forwarders=true
-ipaserver_no_dnssec_validation=true
-ipaserver_auto_reverse=true
-ipaserver_setup_kra=true
-ipaserver_setup_firewalld=false
-ipaclient_no_ntp=true

infra/image/build.sh

@@ -1,137 +0,0 @@
-#!/bin/bash -eu
-
-BASEDIR="$(readlink -f "$(dirname "$0")")"
-TOPDIR="$(readlink -f "${BASEDIR}/../..")"
-
-# shellcheck disable=SC1091
-. "${BASEDIR}/shcontainer"
-# shellcheck disable=SC1091
-. "${TOPDIR}/utils/shfun"
-
-valid_distro() {
-    find "${BASEDIR}/dockerfile" -type f -printf "%f\n" | tr "\n" " "
-}
-
-usage() {
-    local prog="${0##*/}"
-    cat << EOF
-usage: ${prog} [-h] [-n HOSTNAME] [-s] distro
-    ${prog} build a container image to test ansible-freeipa.
-EOF
-}
-
-help() {
-    cat << EOF
-positional arguments:
-
-    distro    The base distro to build the test container.
-              Availble distros: $(valid_distro)
-
-optional arguments:
-
-    -n HOSTNAME   Container hostname
-    -p            Give extended privileges to the container
-    -s            Deploy IPA server
-EOF
-}
-
-name="ansible-freeipa-image-builder"
-hostname="ipaserver.test.local"
-cpus="2"
-memory="3g"
-quayname="quay.io/ansible-freeipa/upstream-tests"
-deploy_server="N"
-deploy_capabilities="SYS_ADMIN,SYSLOG"
-capabilities=""
-
-while getopts ":hn:s" option
-do
-    case "${option}" in
-        h) help && exit 0 ;;
-        n) hostname="${OPTARG}" ;;
-        s) deploy_server="Y" ;;
-        *) die -u "Invalid option: ${option}" ;;
-    esac
-done
-
-shift $((OPTIND - 1))
-distro=${1:-}
-
-[ -n "${distro}" ] || die "Distro needs to be given.\nUse one of: $(valid_distro)"
-
-[ -f "${BASEDIR}/dockerfile/${distro}" ] \
-  || die "${distro} is not a valid distro target.\nUse one of: $(valid_distro)"
-
-container_check
-
-if [ "${deploy_server}" == "Y" ]
-then
-    capabilities="${deploy_capabilities}"
-
-    [ -n "$(command -v "ansible-playbook")" ] || die "ansible-playbook is required to install FreeIPA."
-
-    deploy_playbook="${TOPDIR}/playbooks/install-server.yml"
-    [ -f "${deploy_playbook}" ] || die "Can't find playbook '${deploy_playbook}'"
-
-    inventory_file="${BASEDIR}/build-inventory"
-    [ -f "${inventory_file}" ] || die "Can't find inventory '${inventory_file}'"
-fi
-
-container_state=$(container_get_state "${name}")
-
-tag="${distro}-base"
-server_tag="${distro}-server"
-
-container_remove_image_if_exists "${tag}"
-[ "${deploy_server}" == "Y" ] && \
-    container_remove_image_if_exists "${server_tag}"
-
-container_build "${tag}" "${BASEDIR}/dockerfile/${distro}" "${BASEDIR}"
-container_create "${name}" "${tag}" \
-    "hostname=${hostname}" \
-    "memory=${memory}" \
-    "cpus=${cpus}" \
-    "${capabilities:+capabilities=$capabilities}"
-container_commit "${name}" "${quayname}:${tag}"
-
-if [ "${deploy_server}" == "Y" ]
-then
-    deployed=false
-
-    # Set path to ansible-freeipa roles
-    [ -z "${ANSIBLE_ROLES_PATH:-""}" ] && export ANSIBLE_ROLES_PATH="${TOPDIR}/roles"
-
-    # Install collection containers.podman if not available
-    if [ -z "$(ansible-galaxy collection list containers.podman)" ]
-    then
-        tmpdir="$(mktemp -d)"
-        export ANSIBLE_COLLECTIONS_PATH="${tmpdir}"
-        ansible-galaxy collection install -p "${tmpdir}" containers.podman
-    fi
-
-    [ "${container_state}" != "running" ] && container_start "${name}"
-
-    container_wait_for_journald "${name}"
-
-    log info "= Deploying IPA ="
-    if ansible-playbook -u root -i "${inventory_file}" "${deploy_playbook}"
-    then
-        deployed=true
-    fi
-    echo
-
-    if $deployed; then
-        log info "= Enabling services ="
-        container_exec "${name}" systemctl enable fixnet
-        container_exec "${name}" systemctl enable fixipaip
-        echo
-    fi
-    
-    container_stop "${name}"
-
-    $deployed || die "Deployment failed"
-
-    container_commit "${name}" "${quayname}:${server_tag}"
-fi
-
-log info "= DONE: Image created. ="

infra/image/dockerfile/c10s

@@ -1,39 +0,0 @@
-FROM quay.io/centos/centos:stream10-development
-ENV container=podman
-
-RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
-dnf makecache; \
-dnf --assumeyes install \
-    /usr/bin/dnf-3 \
-    sudo \
-    bash \
-    systemd \
-    procps-ng \
-    iproute \
-    hostname; \
-rm -rf /var/cache/dnf/;
-
-RUN (cd /lib/systemd/system/; \
-    if [ -e dbus-broker.service ] && [ ! -e dbus.service ]; then \
-       ln -s dbus-broker.service dbus.service; \
-    fi \
-)
-COPY system-service/container-ipa.target /lib/systemd/system/
-RUN systemctl set-default container-ipa.target
-RUN (cd /etc/systemd/system/; \
-    rm -rf multi-user.target.wants \
-	&& mkdir container-ipa.target.wants \
-	&& ln -s container-ipa.target.wants multi-user.target.wants \
-)
-
-COPY system-service/fixnet.sh /root/
-COPY system-service/fixipaip.sh /root/
-COPY system-service/fixnet.service /etc/systemd/system/
-COPY system-service/fixipaip.service /etc/systemd/system/
-RUN chmod +x /root/fixnet.sh /root/fixipaip.sh
-
-STOPSIGNAL RTMIN+3
-
-VOLUME ["/sys/fs/cgroup"]
-
-CMD ["/usr/sbin/init"]

infra/image/dockerfile/c8s

@@ -1,43 +0,0 @@
-FROM quay.io/centos/centos:stream8
-ENV container=podman
-
-RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
-sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo; \
-sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo; \
-sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo; \
-dnf makecache; \
-dnf --assumeyes install \
-    /usr/bin/dnf-3 \
-    sudo \
-    bash \
-    systemd \
-    procps-ng \
-    iproute; \
-dnf clean all; \
-rm -rf /var/cache/dnf/;
-
-RUN (cd /lib/systemd/system/; \
-    if [ -e dbus-broker.service ] && [ ! -e dbus.service ]; then \
-       ln -s dbus-broker.service dbus.service; \
-    fi \
-)
-COPY system-service/container-ipa.target /lib/systemd/system/
-RUN systemctl set-default container-ipa.target
-RUN (cd /etc/systemd/system/; \
-    rm -rf multi-user.target.wants \
-	&& mkdir container-ipa.target.wants \
-	&& ln -s container-ipa.target.wants multi-user.target.wants \
-)
-
-COPY system-service/fixnet.sh /root/
-COPY system-service/fixipaip.sh /root/
-COPY system-service/fixnet.service /etc/systemd/system/
-COPY system-service/fixipaip.service /etc/systemd/system/
-RUN chmod +x /root/fixnet.sh /root/fixipaip.sh
-
-STOPSIGNAL RTMIN+3
-
-VOLUME ["/sys/fs/cgroup"]
-
-CMD ["/usr/sbin/init"]
-

infra/image/dockerfile/c9s

@@ -1,38 +0,0 @@
-FROM quay.io/centos/centos:stream9
-ENV container=podman
-
-RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
-dnf makecache; \
-dnf --assumeyes install \
-    /usr/bin/dnf-3 \
-    sudo \
-    bash \
-    systemd \
-    procps-ng \
-    iproute; \
-rm -rf /var/cache/dnf/;
-
-RUN (cd /lib/systemd/system/; \
-    if [ -e dbus-broker.service ] && [ ! -e dbus.service ]; then \
-       ln -s dbus-broker.service dbus.service; \
-    fi \
-)
-COPY system-service/container-ipa.target /lib/systemd/system/
-RUN systemctl set-default container-ipa.target
-RUN (cd /etc/systemd/system/; \
-    rm -rf multi-user.target.wants \
-	&& mkdir container-ipa.target.wants \
-	&& ln -s container-ipa.target.wants multi-user.target.wants \
-)
-
-COPY system-service/fixnet.sh /root/
-COPY system-service/fixipaip.sh /root/
-COPY system-service/fixnet.service /etc/systemd/system/
-COPY system-service/fixipaip.service /etc/systemd/system/
-RUN chmod +x /root/fixnet.sh /root/fixipaip.sh
-
-STOPSIGNAL RTMIN+3
-
-VOLUME ["/sys/fs/cgroup"]
-
-CMD ["/usr/sbin/init"]

infra/image/dockerfile/fedora-latest

@@ -1,41 +0,0 @@
-FROM fedora:latest
-ENV container=podman
-
-RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
-dnf makecache; \
-dnf --assumeyes install \
-    /usr/bin/python3 \
-    /usr/bin/python3-config \
-    python3-libdnf5 \
-    sudo \
-    bash \
-    systemd \
-    procps-ng \
-    iproute; \
-dnf clean all; \
-rm -rf /var/cache/dnf/;
-
-RUN (cd /lib/systemd/system/; \
-    if [ -e dbus-broker.service ] && [ ! -e dbus.service ]; then \
-       ln -s dbus-broker.service dbus.service; \
-    fi \
-)
-COPY system-service/container-ipa.target /lib/systemd/system/
-RUN systemctl set-default container-ipa.target
-RUN (cd /etc/systemd/system/; \
-    rm -rf multi-user.target.wants \
-	&& mkdir container-ipa.target.wants \
-	&& ln -s container-ipa.target.wants multi-user.target.wants \
-)
-
-COPY system-service/fixnet.sh /root/
-COPY system-service/fixipaip.sh /root/
-COPY system-service/fixnet.service /etc/systemd/system/
-COPY system-service/fixipaip.service /etc/systemd/system/
-RUN chmod +x /root/fixnet.sh /root/fixipaip.sh
-
-STOPSIGNAL RTMIN+3
-
-VOLUME ["/sys/fs/cgroup"]
-
-CMD ["/usr/sbin/init"]

infra/image/dockerfile/fedora-rawhide

@@ -1,41 +0,0 @@
-FROM fedora:rawhide
-ENV container=podman
-
-RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
-dnf makecache; \
-dnf --assumeyes install \
-    /usr/bin/python3 \
-    /usr/bin/python3-config \
-    python3-libdnf5 \
-    sudo \
-    bash \
-    systemd \
-    procps-ng \
-    iproute; \
-dnf clean all; \
-rm -rf /var/cache/dnf/;
-
-RUN (cd /lib/systemd/system/; \
-    if [ -e dbus-broker.service ] && [ ! -e dbus.service ]; then \
-       ln -s dbus-broker.service dbus.service; \
-    fi \
-)
-COPY system-service/container-ipa.target /lib/systemd/system/
-RUN systemctl set-default container-ipa.target
-RUN (cd /etc/systemd/system/; \
-    rm -rf multi-user.target.wants \
-	&& mkdir container-ipa.target.wants \
-	&& ln -s container-ipa.target.wants multi-user.target.wants \
-)
-
-COPY system-service/fixnet.sh /root/
-COPY system-service/fixipaip.sh /root/
-COPY system-service/fixnet.service /etc/systemd/system/
-COPY system-service/fixipaip.service /etc/systemd/system/
-RUN chmod +x /root/fixnet.sh /root/fixipaip.sh
-
-STOPSIGNAL RTMIN+3
-
-VOLUME ["/sys/fs/cgroup"]
-
-CMD ["/usr/sbin/init"]

infra/image/inventory

@@ -1,6 +0,0 @@
-[ipaserver]
-ansible-freeipa-tests ansible_connection=podman
-
-[ipaserver:vars]
-ipaadmin_password=SomeADMINpassword
-ipadm_password=SomeDMpassword

infra/image/shcontainer

@@ -1,197 +0,0 @@
-#!/bin/bash -eu
-# This file is meant to be source'd by other scripts
-
-SCRIPTDIR="$(dirname -- "$(readlink -f "${BASH_SOURCE[0]}")")"
-TOPDIR="$(readlink -f "${SCRIPTDIR}/../..")"
-
-. "${TOPDIR}/utils/shfun"
-
-container_create() {
-    local name=${1}
-    local image=${2}
-    shift 2
-    declare -a extra_opts=()
-    for opt in "$@"
-    do
-        [ -z "${opt}" ] && continue
-        case "${opt}" in
-            hostname=*) extra_opts+=("--${opt}") ;;
-            cpus=*) extra_opts+=("--${opt}") ;;
-            memory=*) extra_opts+=("--${opt}") ;;
-            capabilities=*) extra_opts+=("--cap-add=${opt##*=}") ;;
-            *) log error "container_create: Invalid option: ${opt}" ;;
-        esac
-    done
-
-    # ensure default values are set
-    [[ " ${extra_opts[*]} " =~ " --cpus=" ]] || extra_opts+=("--cpus=2")
-    [[ " ${extra_opts[*]} " =~ " --hostname=" ]] \
-        || extra_opts+=("--hostname=ipaserver.test.local")
-
-    log info "= Creating ${name} ="
-    podman create \
-           --security-opt label=disable \
-           --network bridge:interface_name=eth0 \
-           --systemd true \
-           --name "${name}" \
-           --memory-swap -1 \
-           --no-hosts \
-           --replace \
-           "${extra_opts[@]}" \
-           "${image}"
-    echo
-}
-
-container_start() {
-    local name="${1}"
-
-    log info "= Starting ${name} ="
-    podman start "${name}"
-    echo
-}
-
-container_stop() {
-    local name="${1}"
-
-    log info "= Stopping ${name} ="
-    podman stop "${name}"
-    echo
-}
-
-container_wait_for_journald() {
-    local name=${1}
-
-    log info "= Waiting till systemd-journald is running ="
-    max=20
-    wait=2
-    count=0
-    while ! podman exec "${name}" ps -x | grep -q "systemd-journald"
-    do
-        if [ $count -ge $max ]; then
-            die "Timeout: systemd-journald is not starting up"
-        fi
-        count=$((count+1))
-        log info "Waiting ${wait} seconds .."
-        sleep ${wait}
-    done
-    log info "done"
-    echo
-}
-
-container_wait_up() {
-    local name="${1}"
-
-    log info "= Waiting till all services are started ="
-    max=20
-    wait=15
-    count=0
-    while podman exec "${name}" systemctl list-jobs | \
-        grep -qvi "no jobs running"
-    do
-        if [ $count -ge $max ]; then
-            die "Timeout: Services are not starting up"
-        fi
-        count=$((count+1))
-        log info "Waiting ${wait} seconds .."
-        sleep ${wait}
-    done
-    log info "done"
-    echo
-}
-
-container_build() {
-    local tag="${1}"
-    local file="${2}"
-    local dir="${3}"
-
-    log info "= Building ${tag} ="
-    podman build -t "${tag}" -f "${file}" "${dir}"
-    echo
-}
-
-container_commit() {
-    local name="${1}"
-    local image="${2}"
-
-    log info "= Committing \"${image}\" ="
-    podman commit "${name}" "${image}"
-    echo
-}
-
-container_exec() {
-    local name="${1}"
-    shift 1
-
-    # "@Q" is only needed for the log output, the exec command is properly
-    # working without also for args containing spaces.
-    log info "= Executing \"${*@Q}\" ="
-    podman exec -t "${name}" "${@}"
-    echo
-}
-
-container_remove_image_if_exists()
-{
-    # In older (as in Ubuntu 22.04) podman versions,
-    # 'podman image rm --force' fails if the image
-    # does not exist.
-    local tag_to_remove="${1}"
-
-    if podman image exists "${tag_to_remove}"
-    then
-        log info "= Cleanup ${tag_to_remove} ="
-        podman image rm "${tag_to_remove}" --force
-        echo
-    fi
-}
-
-container_get_state()
-{
-    local name="${1}"
-
-    state=$(podman ps -q --all --format "{{.State}}" --filter "name=${name}")
-    echo "${state}"
-}
-
-container_pull() {
-    local source="${1}"
-
-    image=$(podman pull "${source}")
-    echo "${image}"
-}
-
-container_image_list() {
-    local source="${1}"
-
-    # Append "$" for an exact match if the source does not end with ":" to
-    # search for the repo only.
-    if [[ ${source} != *: ]]; then
-        source="${source}$"
-    fi
-    image=$(podman image list --format "{{ .Repository }}:{{ .Tag }}" | \
-                grep "^${source}")
-    echo "${image}"
-}
-
-container_check() {
-    [ -n "$(command -v "podman")" ] || die "podman is required."
-}
-
-container_copy() {
-    local name="${1}"
-    local source="${2}"
-    local destination="${3}"
-
-    log info "= Copying ${source} to ${name}:${destination} ="
-    podman cp "${source}" "${name}:${destination}"
-    echo
-}
-
-container_fetch() {
-    local name="${1}"
-    local source="${2}"
-    local destination="${3}"
-
-    log info "= Copying ${name}:${source} to ${destination} ="
-    podman cp "${name}:${source}" "${destination}"
-    echo
-}

infra/image/start.sh

@@ -1,95 +0,0 @@
-#!/bin/bash -eu
-
-BASEDIR="$(readlink -f "$(dirname "$0")")"
-TOPDIR="$(readlink -f "${BASEDIR}/../..")"
-
-# shellcheck disable=SC1091
-. "${BASEDIR}/shcontainer"
-# shellcheck disable=SC1091
-. "${TOPDIR}/utils/shfun"
-
-usage() {
-    local prog="${0##*/}"
-    cat << EOF
-usage: ${prog} [-h] [-l] [-n HOSTNAME ] image
-    ${prog} start a prebuilt ansible-freeipa test container image.
-EOF
-}
-
-help() {
-    cat << EOF
-positional arguments:
-
-    image    The image to start, leave empty to get list of images
-
-optional arguments:
-
-    -h            Show this message
-    -l            Try to use local image first, if not found download.
-    -n HOSTNAME   Set container hostname
-
-NOTE:
-    - The hostname must be the same as the hostname of the container
-      when FreeIPA was deployed. Use only if you built the image and
-      defined its hostname.
-
-EOF
-}
-
-list_images() {
-    local quay_api="https://quay.io/api/v1/repository/ansible-freeipa/upstream-tests/tag"
-    log info "Available images on quay:"
-    curl --silent -L "${quay_api}" | jq '.tags[]|.name' | tr -d '"'| sort | uniq | sed "s/.*/    &/"
-    echo
-    log info "Local images (use -l):"
-    local_image=$(container_image_list "${repo}:")
-    echo "${local_image}" | sed -e "s/.*://" | sed "s/.*/    &/"
-    echo
-}
-
-repo="quay.io/ansible-freeipa/upstream-tests"
-name="ansible-freeipa-tests"
-hostname="ipaserver.test.local"
-try_local_first="N"
-
-while getopts ":hln:" option
-do
-    case "${option}" in
-        h) help && exit 0 ;;
-        l) try_local_first="Y" ;;
-        n) hostname="${OPTARG}" ;;
-        *) die -u "Invalid option: ${option}" ;;
-    esac
-done
-
-shift $((OPTIND - 1))
-image=${1:-}
-
-container_check
-
-if [ -z "${image}" ]; then
-    list_images
-    exit 0
-fi
-
-local_image=
-if [ "${try_local_first}" == "Y" ]; then
-    log info "= Trying to use local image first ="
-    local_image=$(container_image_list "${repo}:${image}")
-    [ -n "${local_image}" ] && log info "Found ${local_image}"
-    echo
-fi
-if [ -z "${local_image}" ]; then
-    log info "= Downloading from quay ="
-    local_image=$(container_pull "${repo}:${image}")
-    echo
-fi
-
-[ -z "${local_image}" ] && die "Image '${image}' is not valid"
-
-container_create "${name}" "${local_image}" "hostname=${hostname}"
-container_start "${name}"
-container_wait_for_journald "${name}"
-container_wait_up "${name}"
-
-log info "Container ${name} is ready to be used."

infra/image/system-service/container-ipa.target

@@ -1,6 +0,0 @@
-[Unit]
-Description=Minimal target for containerized FreeIPA server
-DefaultDependencies=false
-AllowIsolate=yes
-Requires=systemd-tmpfiles-setup.service systemd-journald.service dbus.service
-After=systemd-tmpfiles-setup.service systemd-journald.service dbus.service

infra/image/system-service/fixipaip.service

@@ -1,12 +0,0 @@
-[Unit]
-Description=Fix IPA server IP in IPA Server
-After=ipa.service
-
-[Service]
-Type=oneshot
-ExecStart=/root/fixipaip.sh
-StandardOutput=journal
-StandardError=journal
-
-[Install]
-WantedBy=default.target

infra/image/system-service/fixipaip.sh

@@ -1,85 +0,0 @@
-#!/bin/bash -eu
-
-function valid_fqdn()
-{
-    local name="${1}"
-
-    [[ "${name}" =~ [[:space:]] ]] && return 1
-    [[ "${name}" =~ \. ]] || return 1
-    [[ "${name}" =~ \.\. ]] && return 1
-    for i in ${name//./ }; do
-        [[ "${i}" =~ ^[a-z0-9_/]+$ ]] || return 1
-    done
-    [[ "${name}" == "localhost.localdomain" ]] && return 1
-    return 0
-}
-
-function valid_ipv4()
-{
-    local ip="${1}"
-    local rematch="^([0-9]{1,3}\.){3}[0-9]{1,3}$"
-
-    [[ "${ip}" =~ ${rematch} ]] || return 1
-    for i in ${ip//./ }; do
-        [[ ${i} -le 255 ]] || return 1
-    done
-
-    return 0
-}
-
-HOSTNAME=$(hostname)
-IP=$(hostname -I | cut -d " " -f 1)
-export KRB5CCNAME=ansible_freeipa_cache
-
-if [ -z "${HOSTNAME}" ] || ! valid_fqdn "${HOSTNAME}" ; then
-    echo "ERROR: Got invalid hostname: '${HOSTNAME}'"
-    exit 1
-fi
-if [ -z "${IP}" ] || ! valid_ipv4 "${IP}" ; then
-    echo "ERROR: Got invalid IPv4 address: '${IP}'"
-    exit 1
-fi
-PTR=$(echo "${IP}" | awk -F"." '{print $4}')
-if [ -z "${PTR}" ] || [ -n "${PTR//[0-9]}" ]; then
-    echo "ERROR: Failed to get PTR from IPv4 address: '${PTR}'"
-    exit 1
-fi
-FORWARDER=$(grep -s -m 1 ^nameserver /etc/resolv.conf.fixnet | cut -d" " -f 2)
-if [ -z "${FORWARDER}" ] || [ "${FORWARDER}" == "127.0.0.1" ]; then
-    FORWARDER="8.8.8.8"
-fi
-
-echo "Fix IPA:"
-echo "  HOSTNAME: '${HOSTNAME}'"
-echo "  IP: '${IP}'"
-echo "  PTR: '${PTR}'"
-echo "  FORWARDER: '${FORWARDER}'"
-
-ZONES=$(ipa -e in_server=true dnszone-find --name-from-ip="${HOSTNAME}." \
-            --raw --pkey-only | grep "idnsname:" | awk -F": " '{print $2}')
-for zone in ${ZONES}; do
-    echo
-    if [[ "${zone}" == *".in-addr.arpa."* ]]; then
-        echo "Fixing reverse zone ${zone}:"
-        OLD_PTR=$(ipa -e in_server=true dnsrecord-find "${zone}" \
-                      --ptr-rec="${HOSTNAME}." --raw | grep "idnsname:" | \
-                      awk -F": " '{print $2}')
-        if [ -z "${OLD_PTR}" ] || [ -n "${OLD_PTR//[0-9]}" ]; then
-            echo "ERROR: Failed to get old PTR from '${zone}': '${OLD_PTR}'"
-        else
-            ipa -e in_server=true dnsrecord-mod "${zone}" "${OLD_PTR}" \
-                --ptr-rec="${HOSTNAME}." --rename="${PTR}" || true
-        fi
-    else
-        echo "Fixing forward zone ${zone}:"
-        ipa -e in_server=true dnsrecord-mod test.local "${HOSTNAME%%.*}" \
-            --a-rec="$IP" || true
-        ipa -e in_server=true dnsrecord-mod test.local ipa-ca \
-            --a-rec="$IP" || true
-    fi
-done
-
-ipa -e in_server=true dnsserver-mod "${HOSTNAME}" \
-    --forwarder="${FORWARDER}" || true
-
-exit 0

infra/image/system-service/fixnet.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=Fix server IP in IPA Server
-Wants=network.target
-After=network.target
-Before=ipa.service
-
-[Service]
-Type=oneshot
-ExecStart=/root/fixnet.sh
-StandardOutput=journal
-StandardError=journal
-
-[Install]
-WantedBy=ipa.service

infra/image/system-service/fixnet.sh

@@ -1,66 +0,0 @@
-#!/bin/bash -eu
-
-function valid_fqdn()
-{
-    local name="${1}"
-
-    [[ "${name}" =~ [[:space:]] ]] && return 1
-    [[ "${name}" =~ \. ]] || return 1
-    [[ "${name}" =~ \.\. ]] && return 1
-    for i in ${name//./ }; do
-        [[ "${i}" =~ ^[a-z0-9_/]+$ ]] || return 1
-    done
-    [[ "${name}" == "localhost.localdomain" ]] && return 1
-    return 0
-}
-
-function valid_ipv4()
-{
-    local ip="${1}"
-    local rematch="^([0-9]{1,3}\.){3}[0-9]{1,3}$"
-
-    [[ "${ip}" =~ ${rematch} ]] || return 1
-    for i in ${ip//./ }; do
-        [[ ${i} -le 255 ]] || return 1
-    done
-
-    return 0
-}
-
-HOSTNAME=$(hostname)
-IP=$(hostname -I | cut -d " " -f 1)
-
-if [ -z "${HOSTNAME}" ] || ! valid_fqdn "${HOSTNAME}" ; then
-    echo "ERROR: Failed to retrieve hostname."
-    exit 1
-fi
-if [ -z "${IP}" ] || ! valid_ipv4 "${IP}" ; then
-    echo "ERROR: Got invalid IPv4 address: '${IP}'"
-    exit 1
-fi
-
-echo "Fix NET:"
-echo "  HOSTNAME: '${HOSTNAME}'"
-echo "  IP: '${IP}'"
-echo
-
-if grep -qE "^[^(#\s*)][0-9\.]+\s$HOSTNAME(\s|$)" /etc/hosts
-then
-    sed -i.bak -e "s/.*${HOSTNAME}/${IP}\t${HOSTNAME}/" /etc/hosts
-else
-    echo -e "$IP\t${HOSTNAME} ${HOSTNAME%%.*}" >> /etc/hosts
-fi
-
-cp -a /etc/resolv.conf /etc/resolv.conf.fixnet
-cat > /etc/resolv.conf <<EOF
-search ${HOSTNAME#*.}
-nameserver 127.0.0.1
-EOF
-
-echo "/etc/hosts:"
-cat "/etc/hosts"
-echo
-echo "/etc/resolv.conf:"
-cat "/etc/resolv.conf"
-
-exit 0

meta/runtime.yml

@@ -1,2 +0,0 @@
----
-requires_ansible: ">=2.14.0"

molecule/centos-7-build/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: centos-7-build
+    image: centos/systemd
+    pre_build_image: true
+    hostname: ipaserver.test.local
+    dns_servers:
+      - 8.8.8.8
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /usr/sbin/init
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: ../resources/playbooks/prepare-build.yml

molecule/centos-7/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: centos-7
+    image: quay.io/ansible-freeipa/upstream-tests:centos-7
+    pre_build_image: true
+    hostname: ipaserver.test.local
+    dns_servers:
+      - 127.0.0.1
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /usr/sbin/init
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: ../resources/playbooks/prepare.yml

molecule/centos-8-build/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: centos-8-build
+    image: "centos:centos8"
+    pre_build_image: true
+    hostname: ipaserver.test.local
+    dns_servers:
+      - 8.8.8.8
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /usr/sbin/init
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: ../resources/playbooks/prepare-build.yml

molecule/centos-8/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: centos-8
+    image: quay.io/ansible-freeipa/upstream-tests:centos-8
+    pre_build_image: true
+    hostname: ipaserver.test.local
+    dns_servers:
+      - 127.0.0.1
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /usr/sbin/init
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: ../resources/playbooks/prepare.yml

molecule/default

@@ -0,0 +1 @@
+centos-8

molecule/fedora-latest-build/Dockerfile

@@ -0,0 +1,30 @@
+FROM fedora:latest
+ENV container=docker
+
+RUN rm -fv /var/cache/dnf/metadata_lock.pid; \
+dnf makecache; \
+dnf --assumeyes install \
+    /usr/bin/python3 \
+    /usr/bin/python3-config \
+    /usr/bin/dnf-3 \
+    sudo \
+    bash \
+    systemd \
+    procps-ng \
+    iproute && \
+dnf clean all; \
+(cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done); \
+rm -f /lib/systemd/system/multi-user.target.wants/*;\
+rm -f /etc/systemd/system/*.wants/*;\
+rm -f /lib/systemd/system/local-fs.target.wants/*; \
+rm -f /lib/systemd/system/sockets.target.wants/*udev*; \
+rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \
+rm -f /lib/systemd/system/basic.target.wants/*;\
+rm -f /lib/systemd/system/anaconda.target.wants/*; \
+rm -rf /var/cache/dnf/;
+
+STOPSIGNAL RTMIN+3
+
+VOLUME ["/sys/fs/cgroup"]
+
+CMD ["/usr/sbin/init"]

molecule/fedora-latest-build/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: fedora-latest-build
+    image: "fedora:latest"
+    dockerfile: Dockerfile
+    hostname: ipaserver.test.local
+    dns_servers:
+      - 8.8.8.8
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /usr/sbin/init
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: ../resources/playbooks/prepare-build.yml

molecule/fedora-latest/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: fedora-latest
+    image: quay.io/ansible-freeipa/upstream-tests:fedora-latest
+    pre_build_image: true
+    hostname: ipaserver.test.local
+    dns_servers:
+      - 127.0.0.1
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /usr/sbin/init
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: ../resources/playbooks/prepare.yml

molecule/resources/playbooks/library

@@ -0,0 +1 @@
+../../../plugins/modules/

molecule/resources/playbooks/module_utils

@@ -0,0 +1 @@
+../../../plugins/module_utils/

molecule/resources/playbooks/prepare-build.yml

@@ -0,0 +1,28 @@
+---
+- name: Converge
+  hosts: all
+  tasks:
+  - include_tasks: prepare-common.yml
+
+  - name: Ensure sudo package is installed
+    package:
+      name: sudo
+
+  - name: Ensure nss package is updated
+    package:
+      name: nss
+      state: latest  # noqa 403
+
+  - include_role:
+      name: ipaserver
+    vars:
+      ipaserver_setup_dns: yes
+      ipaserver_setup_kra: yes
+      ipaserver_auto_forwarders: yes
+      ipaserver_no_dnssec_validation: yes
+      ipaserver_auto_reverse: yes
+      ipaadmin_password: SomeADMINpassword
+      ipadm_password: SomeDMpassword
+      ipaserver_domain: test.local
+      ipaserver_realm: TEST.LOCAL
+      ipaclient_no_ntp: yes

molecule/resources/playbooks/prepare-common.yml

@@ -0,0 +1,33 @@
+# IPA depends on IPv6 and without it dirsrv service won't start.
+- name: Ensure IPv6 is ENABLED
+  sysctl:
+    name: "{{ item.name }}"
+    value: "{{ item.value }}"
+    sysctl_set: yes
+    state: present
+    reload: yes
+  with_items :
+    - name: net.ipv6.conf.all.disable_ipv6
+      value: 0
+    - name: net.ipv6.conf.lo.disable_ipv6
+      value: 0
+    - name: net.ipv6.conf.eth0.disable_ipv6
+      value: 1
+
+# Set fs.protected_regular to 0
+#   This is needed in some IPA versions in order to get KRA enabled.
+#   See https://pagure.io/freeipa/issue/7906 for more information.
+- name: stat protected_regular
+  stat:
+    path: /proc/sys/fs/protected_regular
+  register: result
+
+- name: Ensure fs.protected_regular is disabled
+  sysctl:
+    name: fs.protected_regular
+    value: 0
+    sysctl_set: yes
+    state: present
+    reload: yes
+  when: result.stat.exists
+

molecule/resources/playbooks/prepare.yml

@@ -0,0 +1,26 @@
+---
+- name: Converge
+  hosts: all
+  tasks:
+  - include_tasks: prepare-common.yml
+
+  # In some distros DS won't start up after reboot
+  #   This is due to a problem in 389-ds. See tickets:
+  #   * https://pagure.io/389-ds-base/issue/47429
+  #   * https://pagure.io/389-ds-base/issue/51039
+  #
+  # To avoid this problem we create the directories before starting IPA.
+  - name: Ensure lock dirs for DS exists
+    file:
+      state: directory
+      owner: dirsrv
+      group: dirsrv
+      path: "{{ item }}"
+    loop:
+      - /var/lock/dirsrv/
+      - /var/lock/dirsrv/slapd-TEST-LOCAL/
+
+  - name: Ensure IPA server is up an running
+    service:
+      name: ipa
+      state: started

molecule/resources/playbooks/roles

@@ -0,0 +1 @@
+../../../roles/

playbooks/automember/automember-default-group-not-set.yml

@@ -1,10 +0,0 @@
----
-- name: Automember default group not set
-  hosts: ipaserver
-  become: true
-  tasks:
-  - name: Ensure automember default group is not set
-    ipaautomember:
-      ipaadmin_password: SomeADMINpassword
-      automember_type: group
-      default_group: ""

playbooks/automember/automember-default-group-set.yml

@@ -1,10 +0,0 @@
----
-- name: Automember default group set
-  hosts: ipaserver
-  become: true
-  tasks:
-  - name: Ensure automember default group is set
-    ipaautomember:
-      ipaadmin_password: SomeADMINpassword
-      automember_type: group
-      default_group: fallback_group