mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-05-07 22:03:18 +00:00
638977e0b8
Update delegation README file and add tests for executing plugin with
`ipaapi_context` set to `client`.
A new test playbook can be found at:
tests/delegation/test_delegation_client_context.yml
The new test file can be executed in a FreeIPA client host that is
not a server. In this case, it should be defined in the `ipaclients`
group, in the inventory file.
284 lines
9.6 KiB
YAML
284 lines
9.6 KiB
YAML
---
|
|
- name: Test delegation
|
|
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
|
become: true
|
|
|
|
tasks:
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Ensure test groups are absent
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: managers,managers2,employees,employees2
|
|
state: absent
|
|
|
|
- name: Ensure delegation "basic manager attributes" is absent
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
state: absent
|
|
|
|
# CREATE TEST ITEMS
|
|
|
|
- name: Ensure test group managers is present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: managers
|
|
|
|
- name: Ensure test group managers2 is present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: managers2
|
|
|
|
- name: Ensure test group employees is present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: employees
|
|
|
|
- name: Ensure test group employees2 is present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: employees2
|
|
|
|
# TESTS
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read
|
|
attribute:
|
|
- businesscategory
|
|
group: managers
|
|
membergroup: employees
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read
|
|
attribute:
|
|
- businesscategory
|
|
group: managers
|
|
membergroup: employees
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different attribute employeetype
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read
|
|
attribute:
|
|
- employeetype
|
|
group: managers
|
|
membergroup: employees
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different attribute employeetype again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read
|
|
attribute:
|
|
- employeetype
|
|
group: managers
|
|
membergroup: employees
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- departmentnumber
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- departmentnumber
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" member attributes employeetype and employeenumber are present
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- employeetype
|
|
- employeenumber
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" member attributes employeetype and employeenumber are present again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- employeetype
|
|
- employeenumber
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- employeenumber
|
|
- employeetype
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- employeenumber
|
|
- employeetype
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
# TEST permission change
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different read,write permission
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read,write
|
|
attribute:
|
|
- businesscategory
|
|
group: managers
|
|
membergroup: employees
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different read,write permission again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read,write
|
|
attribute:
|
|
- businesscategory
|
|
group: managers
|
|
membergroup: employees
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different group managers2
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
group: managers2
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different group managers2 again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
group: managers2
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different membergroup employees2
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
membergroup: employees2
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" is present with different membergroup employees2 again
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
membergroup: employees2
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure delegation "basic manager attributes" fails with bad permission read,read
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read,read
|
|
register: result
|
|
failed_when: not result.failed or "Invalid permission" not in result.msg
|
|
|
|
- name: Ensure delegation "basic manager attributes" fails with bad permission read,write,write
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
permission: read,write,write
|
|
register: result
|
|
failed_when: not result.failed or "Invalid permission" not in result.msg
|
|
|
|
- name: Ensure delegation "basic manager attributes" fails with bad attribute businesscategory,businesscategory
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
attribute:
|
|
- businesscategory
|
|
- businesscategory
|
|
register: result
|
|
failed_when: not result.failed or "Invalid attribute" not in result.msg
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Ensure delegation "basic manager attributes" is absent
|
|
ipadelegation:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "basic manager attributes"
|
|
state: absent
|
|
|
|
- name: Ensure test groups are absent
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: managers,managers2,employees,employees2
|
|
state: absent
|