mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-03-26 21:33:05 +00:00
ff084fbd96
The uri parameters auth_uri, dev_auth_uri, token_uri, userinfo_uri and keys_uri have not been validated before. Also the base_url was not normalized. The auth_uri, dev_auth_uri, token_uri and userinfo_uri need to be set for new entries, but might be empty or empty string for reset or updates. The ipaidpclientsecret needs to be decoded from binary string in find_idp result to not trigger no change ipd_mod calls. The code for validate_uri and base_url normalization has been copied from the ipaserver idp plugin. ansible_freeipa_module: urlparse from urllib.parse with a fallback to six.moves.urllib.parse is imported and also exported. urlparse is needed for validate_uri in ipaidp module. Resolves: RHEL-17954, RHEL-17955, RHEL-17957 and RHEL-17958
298 lines
9.3 KiB
YAML
298 lines
9.3 KiB
YAML
---
|
|
- name: Test idp
|
|
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
|
become: false
|
|
gather_facts: false
|
|
module_defaults:
|
|
ipaidp:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
|
|
tasks:
|
|
|
|
# CHECK IF WE HAVE IDP SUPPORT
|
|
|
|
- name: Verify if ipd management is supported
|
|
ansible.builtin.shell:
|
|
cmd: |
|
|
echo SomeADMINpassword | kinit -c {{ krb5ccname }} admin
|
|
RESULT=$(KRB5CCNAME={{ krb5ccname }} ipa command-show idp_add)
|
|
kdestroy -A -c {{ krb5ccname }}
|
|
echo $RESULT
|
|
vars:
|
|
krb5ccname: "__check_command_idp_add__"
|
|
register: check_command_idp_add
|
|
|
|
- name: Run tests for idp
|
|
when: not "idp_add" in check_command_idp_add.stderr
|
|
block:
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Ensure idps my-keycloak-idp, my-github-idp and my-google-idp are absent
|
|
ipaidp:
|
|
name:
|
|
- my-keycloak-idp
|
|
- my-github-idp
|
|
- my-google-idp
|
|
delete_continue: true
|
|
state: absent
|
|
|
|
# CREATE TEST ITEMS
|
|
|
|
# TESTS
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp is present
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
provider: keycloak
|
|
organization: main
|
|
base_url: keycloak.idm.example.com:8443/auth
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp is present, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
provider: keycloak
|
|
organization: main
|
|
base_url: keycloak.idm.example.com:8443/auth
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp is present with all params
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
organization: main
|
|
base_url: https://keycloak.idm.example.com:8443/auth
|
|
keys_uri: https://keycloak.idm.example.com:8443/certs
|
|
issuer_url: https://keycloak.idm.example.com:8443/issuer
|
|
secret: secret
|
|
scope: https://keycloak.idm.example.com:8443/scope
|
|
idp_user_id: testuser
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp is present with all params, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
organization: main
|
|
base_url: https://keycloak.idm.example.com:8443/auth
|
|
keys_uri: https://keycloak.idm.example.com:8443/certs
|
|
issuer_url: https://keycloak.idm.example.com:8443/issuer
|
|
secret: secret
|
|
scope: https://keycloak.idm.example.com:8443/scope
|
|
idp_user_id: testuser
|
|
client_id: my-client-id
|
|
register: result
|
|
# failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp auth_uri is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
auth_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp auth_uri is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
auth_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp dev_auth_uri is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
dev_auth_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp dev_auth_uri is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
dev_auth_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp token_uri is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
token_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp token_uri is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
token_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp userinfo_uri is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
userinfo_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp userinfo_uri is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
userinfo_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp keys_uri is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
keys_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp keys_uri is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
keys_uri: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp issuer_url is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
issuer_url: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp issuer_url is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
issuer_url: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp scope is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
scope: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp scope is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
scope: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp idp_user_id is empty
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
idp_user_id: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp idp_user_id is empty, again
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
idp_user_id: ""
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure idp my-keycloak-idp is absent
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
delete_continue: true
|
|
state: absent
|
|
|
|
- name: Ensure keycloak idp my-keycloak-idp is failing with missing parameters
|
|
ipaidp:
|
|
name: my-keycloak-idp
|
|
provider: keycloak
|
|
client_id: my-client-id
|
|
register: result
|
|
failed_when: result.changed or not result.failed or
|
|
" is missing" not in result.msg
|
|
|
|
- name: Ensure github idp my-github-idp is present
|
|
ipaidp:
|
|
name: my-github-idp
|
|
provider: github
|
|
client_id: my-github-client-id
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure github idp my-github-idp is present, again
|
|
ipaidp:
|
|
name: my-github-idp
|
|
provider: github
|
|
client_id: my-github-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure google idp my-google-idp is present using provider defaults without specifying provider
|
|
ipaidp:
|
|
name: my-google-idp
|
|
auth_uri: https://accounts.google.com/o/oauth2/auth
|
|
dev_auth_uri: https://oauth2.googleapis.com/device/code
|
|
token_uri: https://oauth2.googleapis.com/token
|
|
keys_uri: https://www.googleapis.com/oauth2/v3/certs
|
|
userinfo_uri: https://openidconnect.googleapis.com/v1/userinfo
|
|
client_id: my-google-client-id
|
|
scope: "openid email"
|
|
idp_user_id: email
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure google idp my-google-idp is present using provider defaults without specifying provider, again
|
|
ipaidp:
|
|
name: my-google-idp
|
|
auth_uri: https://accounts.google.com/o/oauth2/auth
|
|
dev_auth_uri: https://oauth2.googleapis.com/device/code
|
|
token_uri: https://oauth2.googleapis.com/token
|
|
keys_uri: https://www.googleapis.com/oauth2/v3/certs
|
|
userinfo_uri: https://openidconnect.googleapis.com/v1/userinfo
|
|
client_id: my-google-client-id
|
|
scope: "openid email"
|
|
idp_user_id: email
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure google idp my-google-idp is present without changes using provider
|
|
ipaidp:
|
|
name: my-google-idp
|
|
provider: google
|
|
client_id: my-google-client-id
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Ensure idps my-keycloak-idp, my-github-idp and my-google-idp are absent
|
|
ipaidp:
|
|
name:
|
|
- my-keycloak-idp
|
|
- my-github-idp
|
|
- my-google-idp
|
|
delete_continue: true
|
|
state: absent
|