Merge pull request #911 from t-woerner/update_spec_file

utils/ansible-freeipa.spec.in: Sync with Fedora rawhide spec file

.ansible-lint

@@ -10,6 +10,8 @@ exclude_paths:
   - molecule/
   - tests/azure/
   - meta/runtime.yml
+  - requirements-docker.yml
+  - requirements-podman.yml
 
 kinds:
   - playbook: '**/tests/**/test_*.yml'

README-config.md

@@ -65,6 +65,9 @@ Example playbook to read config options:
         maxusername: 64
 ```
 
+
+Example playbook to set global configuration options:
+
 ```yaml
 ---
 - name: Playbook to ensure some config options are set
@@ -79,6 +82,40 @@ Example playbook to read config options:
 ```
 
 
+Example playbook to enable SID and generate users and groups SIDs:
+
+```yaml
+---
+- name: Playbook to ensure SIDs are enabled and users and groups have SIDs
+  hosts: ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+    - name: Enable SID and generate users and groups SIDS
+      ipaconfig:
+        ipaadmin_password: SomeADMINpassword
+        enable_sid: yes
+        add_sids: yes
+```
+
+Example playbook to change IPA domain NetBIOS name:
+
+```yaml
+---
+- name: Playbook to change IPA domain netbios name
+  hosts: ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+    - name: Set IPA domain netbios name
+      ipaconfig:
+        ipaadmin_password: SomeADMINpassword
+        enable_sid: yes
+        netbios_name: IPADOM
+```
+
 Variables
 =========
 
@@ -111,6 +148,9 @@ Variable | Description | Required
 `user_auth_type` \| `ipauserauthtype` |  set default types of supported user authentication (choices: `password`, `radius`, `otp`, `disabled`). Use `""` to clear this variable. | no
 `domain_resolution_order` \| `ipadomainresolutionorder` | Set list of domains used for short name qualification | no
 `ca_renewal_master_server` \| `ipacarenewalmasterserver`| Renewal master for IPA certificate authority. | no
+`enable_sid` | New users and groups automatically get a SID assigned. Requires IPA 4.9.8+. (bool) | no
+`netbios_name` | NetBIOS name of the IPA domain. Requires IPA 4.9.8+ and 'enable_sid: yes'. | no
+`add_sids` | Add SIDs for existing users and groups. Requires IPA 4.9.8+ and 'enable_sid: yes'. (bool) | no
 
 
 Return Values
@@ -140,6 +180,8 @@ Variable | Description | Returned When
   | `user_auth_type` |  
   | `domain_resolution_order` |  
   | `ca_renewal_master_server` |  
+  | `enable_sid` |  
+  | `netbios_name` |  
 
 All returned fields take the same form as their namesake input parameters
 

README-user.md

@@ -381,8 +381,8 @@ Variable | Description | Required
 
 Variable | Description | Required
 -------- | ----------- | --------
-`first` \| `givenname` | The first name string. | no
-`last` \| `sn` | The last name string. | no
+`first` \| `givenname` | The first name string. Required if user does not exist. | no
+`last` \| `sn` | The last name string. Required if user does not exist. | no
 `fullname` \| `cn` | The full name string. | no
 `displayname` | The display name string. | no
 `homedir` | The home directory string. | no

playbooks/config/change-ipa-domain-netbios-name.yml

@@ -0,0 +1,12 @@
+---
+- name: Playbook to change IPA domain netbios name
+  hosts: ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+    - name: Set IPA domain netbios name
+      ipaconfig:
+        ipaadmin_password: SomeADMINpassword
+        enable_sid: yes
+        netbios_name: IPADOM

playbooks/config/generate-users-groups-sids.yml

@@ -0,0 +1,12 @@
+---
+- name: Playbook to ensure SIDs are enabled and users and groups have SIDs
+  hosts: ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+    - name: Enable SID and generate users and groups SIDS
+      ipaconfig:
+        ipaadmin_password: SomeADMINpassword
+        enable_sid: yes
+        add_sids: yes

playbooks/config/retrieve-config.yml

@@ -1,5 +1,5 @@
 ---
-- name: Playbook to handle global DNS configuration
+- name: Playbook to handle global IPA configuration
   hosts: ipaserver
   become: no
   gather_facts: no

playbooks/config/set-ca-renewal-master-server.yml

@@ -1,5 +1,5 @@
 ---
-- name: Playbook to handle global DNS configuration
+- name: Playbook to handle global IPA configuration
   hosts: ipaserver
   become: no
   gather_facts: no

plugins/modules/ipaautomember.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaautomember
-short description: Add and delete FreeIPA Auto Membership Rules.
+short_description: Add and delete FreeIPA Auto Membership Rules.
 description: Add, modify and delete an IPA Auto Membership Rules.
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaconfig.py

@@ -148,6 +148,24 @@ options:
         required: false
         type: list
         aliases: ["ipadomainresolutionorder"]
+    enable_sid:
+        description: >
+          New users and groups automatically get a SID assigned.
+          Requires IPA 4.9.8+.
+        required: false
+        type: bool
+    netbios_name:
+        description: >
+          NetBIOS name of the IPA domain.
+          Requires IPA 4.9.8+ and 'enable_sid: yes'.
+        required: false
+        type: string
+    add_sids:
+        description: >
+          Add SIDs for existing users and groups.
+          Requires IPA 4.9.8+ and 'enable_sid: yes'.
+        required: false
+        type: bool
 '''
 
 EXAMPLES = '''
@@ -169,6 +187,24 @@ EXAMPLES = '''
         ipaadmin_password: SomeADMINpassword
         defaultshell: /bin/bash
         maxusername: 64
+
+- name: Playbook to enable SID and generate users and groups SIDs
+  hosts: ipaserver
+  tasks:
+    - name: Enable SID and generate users and groups SIDS
+      ipaconfig:
+        ipaadmin_password: SomeADMINpassword
+        enable_sid: yes
+        add_sids: yes
+
+- name: Playbook to change IPA domain netbios name
+  hosts: ipaserver
+  tasks:
+    - name: Enable SID and generate users and groups SIDS
+      ipaconfig:
+        ipaadmin_password: SomeADMINpassword
+        enable_sid: yes
+        netbios_name: IPADOM
 '''
 
 RETURN = '''
@@ -247,6 +283,14 @@ config:
     domain_resolution_order:
         description: list of domains used for short name qualification
         returned: always
+    enable_sid:
+        description: >
+          new users and groups automatically get a SID assigned.
+          Requires IPA 4.9.8+.
+        returned: always
+    netbios_name:
+        description: NetBIOS name of the IPA domain. Requires IPA 4.9.8+.
+        returned: if enable_sid is True
 '''
 
 
@@ -260,6 +304,28 @@ def config_show(module):
     return _result["result"]
 
 
+def get_netbios_name(module):
+    try:
+        _result = module.ipa_command_no_name("trustconfig_show", {"all": True})
+    except Exception:  # pylint: disable=broad-except
+        return None
+    else:
+        return _result["result"]["ipantflatname"][0]
+
+
+def is_enable_sid(module):
+    """When 'enable-sid' is true admin user and admins group have SID set."""
+    _result = module.ipa_command("user_show", "admin", {"all": True})
+    sid = _result["result"].get("ipantsecurityidentifier", [""])
+    if not sid[0].endswith("-500"):
+        return False
+    _result = module.ipa_command("group_show", "admins", {"all": True})
+    sid = _result["result"].get("ipantsecurityidentifier", [""])
+    if not sid[0].endswith("-512"):
+        return False
+    return True
+
+
 def main():
     ansible_module = IPAAnsibleModule(
         argument_spec=dict(
@@ -313,7 +379,10 @@ def main():
                                 aliases=["ipauserauthtype"]),
             ca_renewal_master_server=dict(type="str", required=False),
             domain_resolution_order=dict(type="list", required=False,
-                                         aliases=["ipadomainresolutionorder"])
+                                         aliases=["ipadomainresolutionorder"]),
+            enable_sid=dict(type="bool", required=False),
+            add_sids=dict(type="bool", required=False),
+            netbios_name=dict(type="str", required=False),
         ),
         supports_check_mode=True,
     )
@@ -344,7 +413,10 @@ def main():
         "pac_type": "ipakrbauthzdata",
         "user_auth_type": "ipauserauthtype",
         "ca_renewal_master_server": "ca_renewal_master_server",
-        "domain_resolution_order": "ipadomainresolutionorder"
+        "domain_resolution_order": "ipadomainresolutionorder",
+        "enable_sid": "enable_sid",
+        "netbios_name": "netbios_name",
+        "add_sids": "add_sids",
     }
     allow_empty_string = ["pac_type", "user_auth_type", "configstring"]
     reverse_field_map = {v: k for k, v in field_map.items()}
@@ -394,11 +466,47 @@ def main():
     changed = False
     exit_args = {}
 
-    # Connect to IPA API
-    with ansible_module.ipa_connect():
+    # Connect to IPA API (enable-sid requires context == 'client')
+    with ansible_module.ipa_connect(context="client"):
+        has_enable_sid = ansible_module.ipa_command_param_exists(
+            "config_mod", "enable_sid")
 
         result = config_show(ansible_module)
+
         if params:
+            netbios_name = params.get("netbios_name")
+            if netbios_name:
+                netbios_name = netbios_name.upper()
+            add_sids = params.get("add_sids")
+            enable_sid = params.get("enable_sid")
+            required_sid = any([netbios_name, add_sids])
+            if required_sid and not enable_sid:
+                ansible_module.fail_json(
+                    "'enable-sid: yes' required for 'netbios_name' "
+                    "and 'add-sids'."
+                )
+            if enable_sid:
+                if not has_enable_sid:
+                    ansible_module.fail_json(
+                        "This version of IPA does not support 'enable-sid'.")
+                if (
+                    netbios_name
+                    and netbios_name == get_netbios_name(ansible_module)
+                ):
+                    del params["netbios_name"]
+                    netbios_name = None
+                if not add_sids and "add_sids" in params:
+                    del params["add_sids"]
+                if (
+                    not any([netbios_name, add_sids])
+                    and is_enable_sid(ansible_module)
+                ):
+                    del params["enable_sid"]
+            else:
+                for param in ["enable_sid", "netbios_name", "add_sids"]:
+                    if param in params:
+                        del params[params]
+
             params = {
                 k: v for k, v in params.items()
                 if k not in result or result[k] != v
@@ -458,6 +566,10 @@ def main():
             # Add empty domain_resolution_order if it is not set
             if "domain_resolution_order" not in exit_args:
                 exit_args["domain_resolution_order"] = []
+            # Set enable_sid
+            if has_enable_sid:
+                exit_args["enable_sid"] = is_enable_sid(ansible_module)
+                exit_args["netbios_name"] = get_netbios_name(ansible_module)
 
     # Done
     ansible_module.exit_json(changed=changed, config=exit_args)

plugins/modules/ipadelegation.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipadelegation
-short description: Manage FreeIPA delegations
+short_description: Manage FreeIPA delegations
 description: Manage FreeIPA delegations and delegation attributes
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipadnsconfig.py

@@ -33,7 +33,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipadnsconfig
-short description: Manage FreeIPA dnsconfig
+short_description: Manage FreeIPA dnsconfig
 description: Manage FreeIPA dnsconfig
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipadnsrecord.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipadnsrecord
-short description: Manage FreeIPA DNS records
+short_description: Manage FreeIPA DNS records
 description: Manage FreeIPA DNS records
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipadnszone.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipadnszone
-short description: Manage FreeIPA dnszone
+short_description: Manage FreeIPA dnszone
 description: Manage FreeIPA dnszone
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipagroup.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipagroup
-short description: Manage FreeIPA groups
+short_description: Manage FreeIPA groups
 description: Manage FreeIPA groups
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipahbacrule.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipahbacrule
-short description: Manage FreeIPA HBAC rules
+short_description: Manage FreeIPA HBAC rules
 description: Manage FreeIPA HBAC rules
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipahbacsvc.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipahbacsvc
-short description: Manage FreeIPA HBAC Services
+short_description: Manage FreeIPA HBAC Services
 description: Manage FreeIPA HBAC Services
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipahbacsvcgroup.py

@@ -33,7 +33,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipahbacsvcgroup
-short description: Manage FreeIPA hbacsvcgroups
+short_description: Manage FreeIPA hbacsvcgroups
 description: Manage FreeIPA hbacsvcgroups
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipahost.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipahost
-short description: Manage FreeIPA hosts
+short_description: Manage FreeIPA hosts
 description: Manage FreeIPA hosts
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipahostgroup.py

@@ -33,7 +33,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipahostgroup
-short description: Manage FreeIPA hostgroups
+short_description: Manage FreeIPA hostgroups
 description: Manage FreeIPA hostgroups
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaidrange.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaidrange
-short description: Manage FreeIPA idrange
+short_description: Manage FreeIPA idrange
 description: Manage FreeIPA idrange
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipalocation.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipalocation
-short description: Manage FreeIPA location
+short_description: Manage FreeIPA location
 description: Manage FreeIPA location
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipapermission.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipapermission
-short description: Manage FreeIPA permission
+short_description: Manage FreeIPA permission
 description: Manage FreeIPA permission and permission members
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaprivilege.py

@@ -35,7 +35,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaprivilege
-short description: Manage FreeIPA privilege
+short_description: Manage FreeIPA privilege
 description: Manage FreeIPA privilege and privilege members
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipapwpolicy.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipapwpolicy
-short description: Manage FreeIPA pwpolicies
+short_description: Manage FreeIPA pwpolicies
 description: Manage FreeIPA pwpolicies
 options:
   ipaadmin_principal:

plugins/modules/iparole.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: iparole
-short description: Manage FreeIPA role
+short_description: Manage FreeIPA role
 description: Manage FreeIPA role
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaselfservice.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaselfservice
-short description: Manage FreeIPA selfservices
+short_description: Manage FreeIPA selfservices
 description: Manage FreeIPA selfservices and selfservice attributes
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaserver.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaserver
-short description: Manage FreeIPA server
+short_description: Manage FreeIPA server
 description: Manage FreeIPA server
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaservice.py

@@ -33,7 +33,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaservice
-short description: Manage FreeIPA service
+short_description: Manage FreeIPA service
 description: Manage FreeIPA service
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipaservicedelegationrule.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaservicedelegationrule
-short description: Manage FreeIPA servicedelegationrule
+short_description: Manage FreeIPA servicedelegationrule
 description: |
   Manage FreeIPA servicedelegationrule and servicedelegationrule members
 extends_documentation_fragment:

plugins/modules/ipaservicedelegationtarget.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipaservicedelegationtarget
-short description: Manage FreeIPA servicedelegationtarget
+short_description: Manage FreeIPA servicedelegationtarget
 description: |
   Manage FreeIPA servicedelegationtarget and servicedelegationtarget members
 extends_documentation_fragment:

plugins/modules/ipasudocmd.py

@@ -33,7 +33,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipasudocmd
-short description: Manage FreeIPA sudo command
+short_description: Manage FreeIPA sudo command
 description: Manage FreeIPA sudo command
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipasudocmdgroup.py

@@ -33,7 +33,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipasudocmdgroup
-short description: Manage FreeIPA sudocmd groups
+short_description: Manage FreeIPA sudocmd groups
 description: Manage FreeIPA sudocmd groups
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipasudorule.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipasudorule
-short description: Manage FreeIPA sudo rules
+short_description: Manage FreeIPA sudo rules
 description: Manage FreeIPA sudo rules
 extends_documentation_fragment:
   - ipamodule_base_docs
@@ -162,19 +162,19 @@ EXAMPLES = """
     hostgroup: cluster
     action: member
 
-# Ensure sudo rule for usercategory "all"
+# Ensure sudo rule for usercategory "all" is enabled
 - ipasudorule:
     ipaadmin_password: SomeADMINpassword
     name: allusers
     usercategory: all
-    action: enabled
+    state: enabled
 
-# Ensure sudo rule for hostcategory "all"
+# Ensure sudo rule for hostcategory "all" is enabled
 - ipasudorule:
     ipaadmin_password: SomeADMINpassword
     name: allhosts
     hostcategory: all
-    action: enabled
+    state: enabled
 
 # Ensure Sudo Rule tesrule1 is absent
 - ipasudorule:

plugins/modules/ipatopologysegment.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipatopologysegment
-short description: Manage FreeIPA topology segments
+short_description: Manage FreeIPA topology segments
 description: Manage FreeIPA topology segments
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipatopologysuffix.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipatopologysuffix
-short description: Verify FreeIPA topology suffix
+short_description: Verify FreeIPA topology suffix
 description: Verify FreeIPA topology suffix
 extends_documentation_fragment:
   - ipamodule_base_docs

plugins/modules/ipauser.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipauser
-short description: Manage FreeIPA users
+short_description: Manage FreeIPA users
 description: Manage FreeIPA users
 extends_documentation_fragment:
   - ipamodule_base_docs
@@ -47,11 +47,11 @@ options:
         description: The user (internally uid).
         required: true
       first:
-        description: The first name
+        description: The first name. Required if user does not exist.
         required: false
         aliases: ["givenname"]
       last:
-        description: The last name
+        description: The last name. Required if user doesnot exst.
         required: false
         aliases: ["sn"]
       fullname:
@@ -212,11 +212,11 @@ options:
         type: bool
     required: false
   first:
-    description: The first name
+    description: The first name. Required if user does not exist.
     required: false
     aliases: ["givenname"]
   last:
-    description: The last name
+    description: The last name. Required if user does not exist.
     required: false
     aliases: ["sn"]
   fullname:

plugins/modules/ipavault.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = """
 ---
 module: ipavault
-short description: Manage vaults and secret vaults.
+short_description: Manage vaults and secret vaults.
 description: Manage vaults and secret vaults. KRA service must be enabled.
 extends_documentation_fragment:
   - ipamodule_base_docs
@@ -525,7 +525,7 @@ def check_encryption_params(  # pylint: disable=unused-argument
 
         if (
             salt is not None
-            and not(
+            and not (
                 any([password, password_file])
                 and any([new_password, new_password_file])
             )

requirements-docker.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - name: community.docker

requirements-podman.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - name: containers.podman

requirements-tests.txt

@@ -1,6 +1,7 @@
 -r requirements.txt
 pytest>=2.7
 pytest-sourceorder>=0.5
-pytest-split-tests>=1.0.3
+pytest-split>=0.8.0
+pytest-custom_exit_code>=0.3.0
 pytest-testinfra>=5.0
 pyyaml>=3

roles/ipabackup/library/ipabackup_get_backup_dir.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipabackup_get_backup_dir
-short description:
+short_description:
   Get IPA_BACKUP_DIR from ipaplatform
 description:
   Get IPA_BACKUP_DIR from ipaplatform

roles/ipabackup/tasks/main.yml

@@ -26,6 +26,12 @@
   fail: msg="ipabackup_from_controller and ipabackup_to_controller are set"
   when: ipabackup_from_controller | bool and ipabackup_to_controller | bool
 
+- name: Fail for given ipabackup_name if state is not copied, restored or absent
+  fail: msg="ipabackup_name is given and state is not copied, restored or absent"
+  when: state is not defined or
+        (state != "copied" and state != "restored" and state != "absent") and
+        ipabackup_name is defined
+
 - name: Get ipabackup_dir from IPA installation
   include_tasks: "{{ role_path }}/tasks/get_ipabackup_dir.yml"
 
@@ -33,12 +39,6 @@
   include_tasks: "{{ role_path }}/tasks/backup.yml"
   when: state|default("present") == "present"
 
-- name: Fail for given ipabackup_name if state is not copied, restored or absent
-  fail: msg="ipabackup_name is given and state is not copied, restored or absent"
-  when: state is not defined or
-        (state != "copied" and state != "restored" and state != "absent") and
-        ipabackup_name is defined
-
 - name: Fail on missing ipabackup_name
   fail: msg="ipabackup_name is not set"
   when: (ipabackup_name is not defined or not ipabackup_name) and

roles/ipaclient/library/ipaclient_api.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {'metadata_version': '1.0',
 DOCUMENTATION = '''
 ---
 module: ipaclient_api
-short description:
+short_description:
   Create temporary NSS database, call IPA API for remaining enrollment parts
 description:
   Create temporary NSS database, call IPA API for remaining enrollment parts

roles/ipaclient/library/ipaclient_fix_ca.py

@@ -32,7 +32,7 @@ ANSIBLE_METADATA = {'metadata_version': '1.0',
 DOCUMENTATION = '''
 ---
 module: ipaclient_fix_ca
-short description: Fix IPA ca certificate
+short_description: Fix IPA ca certificate
 description: Repair Fix IPA ca certificate
 options:
   servers:

roles/ipaclient/library/ipaclient_fstore.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_fstore
-short description: Backup files using IPA client sysrestore
+short_description: Backup files using IPA client sysrestore
 description: Backup files using IPA client sysrestore
 options:
   backup:

roles/ipaclient/library/ipaclient_get_facts.py

@@ -7,7 +7,7 @@ __metaclass__ = type
 DOCUMENTATION = """
 ---
 module: ipaclient_get_facts
-short description: Get facts about IPA client and server configuration.
+short_description: Get facts about IPA client and server configuration.
 description: Get facts about IPA client and server configuration.
 author:
     - Thomas Woerner

roles/ipaclient/library/ipaclient_get_otp.py

@@ -30,7 +30,7 @@ ANSIBLE_METADATA = {'metadata_version': '1.0',
 DOCUMENTATION = '''
 ---
 module: ipaclient_get_otp
-short description: Manage IPA hosts
+short_description: Manage IPA hosts
 description:
   Manage hosts in a IPA domain.
   The operation needs to be authenticated with Kerberos either by providing

roles/ipaclient/library/ipaclient_ipa_conf.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_ipa_conf
-short description: Configure ipa.conf
+short_description: Configure ipa.conf
 description:
   Configure ipa.conf
 options:

roles/ipaclient/library/ipaclient_join.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_join
-short description:
+short_description:
   Join a machine to an IPA realm and get a keytab for the host service
   principal
 description:

roles/ipaclient/library/ipaclient_set_hostname.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_set_hostname
-short description: Backup and set hostname
+short_description: Backup and set hostname
 description:
   Backup and set hostname
 options:

roles/ipaclient/library/ipaclient_setup_automount.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_automount
-short description: Setup automount for IPA client
+short_description: Setup automount for IPA client
 description:
   Setup automount for IPA client
 options:

roles/ipaclient/library/ipaclient_setup_firefox.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_firefox
-short description: Setup firefox for IPA client
+short_description: Setup firefox for IPA client
 description:
   Setup firefox for IPA client
 options:

roles/ipaclient/library/ipaclient_setup_krb5.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_krb5
-short description: Setup krb5 for IPA client
+short_description: Setup krb5 for IPA client
 description:
   Setup krb5 for IPA client
 options:

roles/ipaclient/library/ipaclient_setup_nis.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_nis
-short description: Setup NIS for IPA client
+short_description: Setup NIS for IPA client
 description:
   Setup NIS for IPA client
 options:

roles/ipaclient/library/ipaclient_setup_nss.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_nss
-short description: Create IPA client NSS database
+short_description: Create IPA client NSS database
 description: Create IPA NSS database
 options:
   servers:

roles/ipaclient/library/ipaclient_setup_ntp.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_ntp
-short description: Setup NTP for IPA client
+short_description: Setup NTP for IPA client
 description:
   Setup NTP for IPA client
 options:

roles/ipaclient/library/ipaclient_setup_ssh.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_ssh
-short description: Configure ssh and sshd for IPA client
+short_description: Configure ssh and sshd for IPA client
 description:
   Configure ssh and sshd for IPA client
 options:

roles/ipaclient/library/ipaclient_setup_sssd.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_setup_ssd
-short description: Setup sssd for IPA client
+short_description: Setup sssd for IPA client
 description:
   Setup sssd for IPA client
 options:

roles/ipaclient/library/ipaclient_test.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_test
-short description: Tries to discover IPA server
+short_description: Tries to discover IPA server
 description:
   Tries to discover IPA server using DNS or host name
 options:

roles/ipaclient/library/ipaclient_test_keytab.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaclient_test_keytab
-short description:
+short_description:
   Test if the krb5.keytab on the machine is valid and can be used.
 description:
   Test if the krb5.keytab on the machine is valid and can be used.

roles/ipareplica/library/ipareplica_add_to_ipaservers.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_add_to_ipaservers
-short description: Add to ipaservers
+short_description: Add to ipaservers
 description:
   Add to ipaservers
 options:

roles/ipareplica/library/ipareplica_create_ipa_conf.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_create_ipa_conf
-short description: Create ipa.conf
+short_description: Create ipa.conf
 description:
   Create ipa.conf
 options:

roles/ipareplica/library/ipareplica_custodia_import_dm_password.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_custodia_import_dm_password
-short description: Import dm password into custodia
+short_description: Import dm password into custodia
 description:
   Import dm password into custodia
 options:

roles/ipareplica/library/ipareplica_ds_apply_updates.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_ds_apply_updates
-short description: DS apply updates
+short_description: DS apply updates
 description:
   DS apply updates
 options:

roles/ipareplica/library/ipareplica_ds_enable_ssl.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_ds_enable_ssl
-short description: DS enable SSL
+short_description: DS enable SSL
 description:
   DS enable SSL
 options:

roles/ipareplica/library/ipareplica_enable_ipa.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_enable_ipa
-short description: Enable IPA
+short_description: Enable IPA
 description: Enable IPA
   Enable IPA
 options:

roles/ipareplica/library/ipareplica_install_ca_certs.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_install_ca_cert
-short description: Install CA certs
+short_description: Install CA certs
 description:
   Install CA certs
 options:

roles/ipareplica/library/ipareplica_krb_enable_ssl.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_krb_enable_ssl
-short description: KRB enable SSL
+short_description: KRB enable SSL
 description:
   KRB enable SSL
 options:

roles/ipareplica/library/ipareplica_master_password.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_master_password
-short description: Generate kerberos master password if not given
+short_description: Generate kerberos master password if not given
 description:
   Generate kerberos master password if not given
 options:

roles/ipareplica/library/ipareplica_prepare.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_prepare
-short description: Prepare ipa replica installation
+short_description: Prepare ipa replica installation
 description: |
   Prepare ipa replica installation: Create IPA configuration file, run install
   checks again and also update the host name and the hosts file if needed.

roles/ipareplica/library/ipareplica_promote_openldap_conf.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_promote_openldap_conf
-short description: Promote openldap.conf
+short_description: Promote openldap.conf
 description:
   Promote openldap.conf
 options:

roles/ipareplica/library/ipareplica_promote_sssd.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_promote_sssd
-short description: Promote sssd
+short_description: Promote sssd
 description:
   Promote sssd
 options:

roles/ipareplica/library/ipareplica_restart_kdc.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_restart_kdc
-short description: Restart KDC
+short_description: Restart KDC
 description:
   Restart KDC
 options:

roles/ipareplica/library/ipareplica_setup_adtrust.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_adtrust
-short description: Setup adtrust
+short_description: Setup adtrust
 description:
   Setup adtrust
 options:

roles/ipareplica/library/ipareplica_setup_ca.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_ca
-short description: Setup CA
+short_description: Setup CA
 description:
   Setup CA
 options:

roles/ipareplica/library/ipareplica_setup_certmonger.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_certmonger
-short description: Setup certmonger
+short_description: Setup certmonger
 description:
   Setup certmonger
 options:

roles/ipareplica/library/ipareplica_setup_custodia.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_custodia
-short description: Setup custodia
+short_description: Setup custodia
 description:
   Setup custodia
 options:

roles/ipareplica/library/ipareplica_setup_dns.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_dns
-short description: Setup DNS
+short_description: Setup DNS
 description:
   Setup DNS
 options:

roles/ipareplica/library/ipareplica_setup_ds.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_ds
-short description: Setup DS
+short_description: Setup DS
 description:
   Setup DS
 options:

roles/ipareplica/library/ipareplica_setup_http.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_http
-short description: Setup HTTP
+short_description: Setup HTTP
 description:
   Setup HTTP
 options:

roles/ipareplica/library/ipareplica_setup_kra.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_kra
-short description: Setup KRA
+short_description: Setup KRA
 description:
   Setup KRA
 options:

roles/ipareplica/library/ipareplica_setup_krb.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_krb
-short description: Setup KRB
+short_description: Setup KRB
 description:
   Setup KRB
 options:

roles/ipareplica/library/ipareplica_setup_otpd.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_setup_otpd
-short description: Setup OTPD
+short_description: Setup OTPD
 description:
   Setup OTPD
 options:

roles/ipareplica/library/ipareplica_test.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipareplica_test
-short description: IPA replica deployment tests
+short_description: IPA replica deployment tests
 description: IPA replica deployment tests
 options:
   ip_addresses:

roles/ipareplica/module_utils/ansible_ipa_replica.py

@@ -222,6 +222,10 @@ else:
         def info(self, msg):
             self.module.debug(msg)
 
+        @staticmethod
+        def isatty():
+            return False
+
         def write(self, msg):
             self.module.debug(msg)
             # self.module.warn(msg)

roles/ipareplica/tasks/install.yml

@@ -116,8 +116,6 @@
       ipaclient_realm: "{{ result_ipareplica_test.realm | default(omit) }}"
       ipaclient_servers: "{{ ipareplica_servers | default(omit) }}"
       ipaclient_hostname: "{{ result_ipareplica_test.hostname }}"
-      ipaclient_no_ntp: "{{ result_ipareplica_test.ipa_python_version
-                            < 40690 }}"
       ipaclient_install_packages: "{{ ipareplica_install_packages }}"
     when: not result_ipareplica_test.client_enrolled
 
@@ -201,6 +199,7 @@
       ### additional ###
       server: "{{ result_ipareplica_test.server }}"
       skip_conncheck: "{{ ipareplica_skip_conncheck }}"
+      sid_generation_always: "{{ result_ipareplica_test.sid_generation_always }}"
     register: result_ipareplica_prepare
 
   - name: Install - Add to ipaservers

roles/ipaserver/library/ipaserver_enable_ipa.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_enable_ipa
-short description: Enable IPA
+short_description: Enable IPA
 description: Enable IPA
 options:
   hostname:

roles/ipaserver/library/ipaserver_load_cache.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_load_cache
-short description: Load cache file
+short_description: Load cache file
 description: Load cache file
 options:
   dm_password:

roles/ipaserver/library/ipaserver_master_password.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_master_password
-short description: Generate kerberos master password if not given
+short_description: Generate kerberos master password if not given
 description:
   Generate kerberos master password if not given
 options:

roles/ipaserver/library/ipaserver_prepare.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_prepare
-short description: Prepare IPA server deployment
+short_description: Prepare IPA server deployment
 description: Prepare IPA server deployment
 options:
   force:

roles/ipaserver/library/ipaserver_set_ds_password.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_set_ds_password
-short description: Set DS password
+short_description: Set DS password
 description: Set DS password
 options:
   dm_password:

roles/ipaserver/library/ipaserver_setup_adtrust.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_adtrust
-short description: Setup trust ad
+short_description: Setup trust ad
 description: Setup trust ad
 options:
   hostname:

roles/ipaserver/library/ipaserver_setup_ca.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_ca
-short description: Setup CA
+short_description: Setup CA
 description: Setup CA
 options:
   dm_password:

roles/ipaserver/library/ipaserver_setup_custodia.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_custodia
-short description: Setup custodia
+short_description: Setup custodia
 description: Setup custodia
 options:
   realm:

roles/ipaserver/library/ipaserver_setup_dns.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_dns
-short description: Setup DNS
+short_description: Setup DNS
 description: Setup DNS
 options:
   ip_addresses:

roles/ipaserver/library/ipaserver_setup_ds.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_ds
-short description: Configure directory server
+short_description: Configure directory server
 description: Configure directory server
 options:
   dm_password:

roles/ipaserver/library/ipaserver_setup_http.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_http
-short description: Setup HTTP
+short_description: Setup HTTP
 description: Setup HTTP
 options:
   dm_password:

roles/ipaserver/library/ipaserver_setup_kra.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_kra
-short description: Setup KRA
+short_description: Setup KRA
 description: Setup KRA
 options:
   dm_password:

roles/ipaserver/library/ipaserver_setup_krb.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_krb
-short description: Setup KRB
+short_description: Setup KRB
 description: Setup KRB
 options:
   dm_password:

roles/ipaserver/library/ipaserver_setup_ntp.py

@@ -34,7 +34,7 @@ ANSIBLE_METADATA = {
 DOCUMENTATION = '''
 ---
 module: ipaserver_setup_ntp
-short description: Setup NTP
+short_description: Setup NTP
 description: Setup NTP
 options:
   ntp_servers: