mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-03-26 21:33:05 +00:00
1fde1764af
On IPA CLI sudorule-add/del-runasuser accept 'group' as a parameter,
and this option was missing in ansible-freeipa ipasudorule module.
This patch adds a new parameter 'runasuser_group' to allow setting
Groups of RunAs Users, as allowed by CLI and WebUI.
New example playboks can be found at:
playbooks/sudorule/ensure-sudorule-runasusesr-group-is-absent.yml
playbooks/sudorule/ensure-sudorule-runasusesr-group-is-present.yml
1260 lines
38 KiB
YAML
1260 lines
38 KiB
YAML
---
|
|
|
|
- name: Test sudorule
|
|
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
|
|
# setup
|
|
- name: Ensure test user is present
|
|
ipauser:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: user01
|
|
first: user
|
|
last: zeroone
|
|
|
|
- name: Ensure group01 is present, with user01 on it.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: group01
|
|
user: user01
|
|
|
|
- name: Ensure group02 is present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: group02
|
|
|
|
- name: Ensure sudocmdgroup is absent
|
|
ipasudocmdgroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: test_sudorule
|
|
state: absent
|
|
|
|
- name: Ensure hostgroup is present, with a host.
|
|
ipahostgroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: cluster
|
|
host: "{{ ansible_facts['fqdn'] }}"
|
|
|
|
- name: Ensure some sudocmds are available
|
|
ipasudocmd:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- /sbin/ifconfig
|
|
- /usr/bin/vim
|
|
- /usr/bin/emacs
|
|
state: present
|
|
|
|
- name: Ensure sudocmdgroup is available
|
|
ipasudocmdgroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: test_sudorule
|
|
sudocmd: /usr/bin/vim
|
|
state: present
|
|
|
|
- name: Ensure sudocmdgroup is available
|
|
ipasudocmdgroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: test_sudorule2
|
|
sudocmd: /usr/bin/emacs
|
|
state: present
|
|
|
|
- name: Ensure sudorules are absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- test_upstream_issue_664
|
|
- testrule_hostmask
|
|
- testrule1
|
|
- allusers
|
|
- allhosts
|
|
- allcommands
|
|
state: absent
|
|
|
|
# tests
|
|
|
|
- name: Ensure sudorule is present
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure user01 is on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser:
|
|
- user01
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure user01 is on the list of users sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser:
|
|
- user01
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure user01 is not on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser:
|
|
- user01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure user01 is not on the list of users sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser:
|
|
- user01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group01 is on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group01
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group01 is on the list of users sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group01
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group01 and group2 are on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group01
|
|
- group02
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group01 and group2 are on the list of users sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group01
|
|
- group02
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Check if group02 is on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group02
|
|
action: member
|
|
register: result
|
|
check_mode: true
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group01 is not on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group01 is not on the list of users sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Check if group02 is on the list of users sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasuser_group:
|
|
- group02
|
|
action: member
|
|
register: result
|
|
check_mode: true
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group01 is on the list of group sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasgroup:
|
|
- group01
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group01 is on the list of group sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasgroup:
|
|
- group01
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group01 is not on the list of group sudorule execute as.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasgroup:
|
|
- group01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group01 is not on the list of groups sudorule execute as, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
runasgroup:
|
|
- group01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with usercategory 'all'
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
usercategory: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with usercategory 'all', again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
usercategory: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is with usercategory 'all' is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with runasusercategory 'all'.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
runasusercategory: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with runasusercategory 'all', again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
runasusercategory: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is with runasusercategory 'all' is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with runasgroupcategory 'all'.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
runasgroupcategory: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with runasgroupcategory 'all', again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
runasgroupcategory: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is with runasgroupcategory 'all' is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with usercategory 'all'.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
usercategory: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with usercategory 'all', again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
usercategory: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with hostategory 'all'
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allhosts
|
|
hostcategory: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with hostategory 'all', again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allhosts
|
|
hostcategory: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is disabled
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
state: disabled
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is disabled, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
state: disabled
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is enabled
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
state: enabled
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is enabled, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
state: enabled
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure user is present in sudorule.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
user: user01
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure user is present in sudorule, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
user: user01
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure user is absent from sudorule.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
user: user01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure user is absent from sudorule, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
user: user01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group is present in sudorule.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
group: group01
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group is present in sudorule, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
group: group01
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure group is absent from sudorule.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
group: group01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure group is absent from sudorule, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
group: group01
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule has a sudooption.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
sudooption: '!authenticate'
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule has a sudooption, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
sudooption: '!authenticate'
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule has an order.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
order: 1
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule has an order, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
order: 1
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule has another order.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
order: 10
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present and some sudocmd are allowed.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmd:
|
|
- /sbin/ifconfig
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present and some sudocmd are allowed, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmd:
|
|
- /sbin/ifconfig
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present and some sudocmd are denyed.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmd:
|
|
- /usr/bin/vim
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present and some sudocmd are denyed, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmd:
|
|
- /usr/bin/vim
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present and, sudocmds are absent.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmd: /sbin/ifconfig
|
|
deny_sudocmd: /usr/bin/vim
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present and, sudocmds are absent, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmd: /sbin/ifconfig
|
|
deny_sudocmd: /usr/bin/vim
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present with cmdcategory 'all'.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allcommands
|
|
cmdcategory: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present with cmdcategory 'all', again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allcommands
|
|
cmdcategory: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure host "{{ ansible_facts['fqdn'] }}" is present in sudorule.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
host: "{{ ansible_facts['fqdn'] }}"
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure host "{{ ansible_facts['fqdn'] }}" is present in sudorule, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
host: "{{ ansible_facts['fqdn'] }}"
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure hostgroup is present in sudorule.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
hostgroup: cluster
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure hostgroup is present in sudorule, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
hostgroup: cluster
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with an allow_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with an allow_sudocmdgroup, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: present
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, but allow_sudocmdgroup is absent.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, but allow_sudocmdgroup is absent.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with an deny_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with an deny_sudocmdgroup, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: present
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, but deny_sudocmdgroup is absent.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, but deny_sudocmdgroup is absent, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with `test_sudorule` sudocmdgroup in allow_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with `test_sudorule2` sudocmdgroup in allow_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule2
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with both sudocmdgroup in allow_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup:
|
|
- test_sudorule
|
|
- test_sudorule2
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with both sudocmdgroup, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup:
|
|
- test_sudorule
|
|
- test_sudorule2
|
|
state: present
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with only `test_sudorule` sudocmdgroup in allow_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
allow_sudocmdgroup: test_sudorule
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with `test_sudorule` sudocmdgroup in deny_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with `test_sudorule2` sudocmdgroup in deny_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule2
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with both sudocmdgroup in deny_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup:
|
|
- test_sudorule
|
|
- test_sudorule2
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with both sudocmdgroup, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup:
|
|
- test_sudorule
|
|
- test_sudorule2
|
|
state: present
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present, with only `test_sudorule` sudocmdgroup in deny_sudocmdgroup.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
deny_sudocmdgroup: test_sudorule
|
|
state: present
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is absent, again.
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule1
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule allhosts is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allhosts
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule allhosts is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allhosts
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule allusers is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule allusers is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allusers
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule allcommands is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allcommands
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule allcommands is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: allcommands
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule with external user in 'runasuser' is present
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasuser:
|
|
- apache
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule with external user in 'runasuser' is present, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasuser:
|
|
- apache
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external user in 'runasuser' is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasuser:
|
|
- apache
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external user in 'runasuser' is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasuser:
|
|
- apache
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external user in 'runasuser' is present
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasuser:
|
|
- apache
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external user in 'runasuser' is present, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasuser:
|
|
- apache
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule with external group in 'runasgroup' is present
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasgroup:
|
|
- wheel
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule with external group in 'runasgroup' user is present, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasgroup:
|
|
- wheel
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external group in 'runasgroup' is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasgroup:
|
|
- wheel
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external group in 'runasgroup' is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasgroup:
|
|
- wheel
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external group in 'runasgroup' is present
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasgroup:
|
|
- wheel
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule member external group in 'runasgroup' is present, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
runasgroup:
|
|
- wheel
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule 'test_upstream_issue_664' is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: test_upstream_issue_664
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present with hostmask
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: testrule_hostmask
|
|
hostmask:
|
|
- 192.168.122.1/24
|
|
- 192.168.120.1/24
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present with hostmask, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: testrule_hostmask
|
|
hostmask:
|
|
- 192.168.122.1/24
|
|
- 192.168.120.1/24
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule hostmask member is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.122.0/24
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule hostmask member is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.122.0/24
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present with another hostmask
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.122.0/24
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule is present with another hostmask, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.122.0/24
|
|
register: result
|
|
failed_when: result.changed
|
|
|
|
- name: Check sudorule with hostmask is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.120.0/24
|
|
action: member
|
|
register: result
|
|
check_mode: yes
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule hostmask member is present
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.120.0/24
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule hostmask member is present, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.120.0/24
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure sudorule hostmask member is absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.120.0/24
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure sudorule hostmask member is absent, again
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: testrule_hostmask
|
|
hostmask: 192.168.120.0/24
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
# cleanup
|
|
- name: Ensure sudocmdgroup is absent
|
|
ipasudocmdgroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- test_sudorule
|
|
- test_sudorule2
|
|
- testrule_hostmask
|
|
state: absent
|
|
|
|
- name: Ensure sudocmds are absent
|
|
ipasudocmd:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- /sbin/ifconfig
|
|
- /usr/bin/vim
|
|
- /usr/bin/emacs
|
|
state: absent
|
|
|
|
- name: Ensure sudorules are absent
|
|
ipasudorule:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- test_upstream_issue_664
|
|
- testrule1
|
|
- allusers
|
|
- allhosts
|
|
- allcommands
|
|
state: absent
|
|
|
|
- name: Ensure hostgroup is absent.
|
|
ipahostgroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: cluster
|
|
state: absent
|
|
|
|
- name: Ensure groups are absent
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- group01
|
|
- group02
|
|
state: absent
|
|
|
|
- name: Ensure user is absent
|
|
ipauser:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: user01
|
|
state: absent
|