mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-07-25 00:44:42 +00:00
0e2e6a6653
The ipagroup module has been reworked to use the new PARAM_MAPPING
added to ansible_freeipa_module.
The member handling for user, group, service and membermanager has
been simplified by using gen_member_add_del_lists. The member entries
in PARAM_MAPPING are now marked with "member": True. This replaces the
manual calls to gen_add_del_lists, gen_add_list and
gen_intersection_list across separate action/state branches with a
single unified call. externalmember and idoverrideuser are still
handled manually since they need SID-based comparison.
The new query state allows to retrieve group information from IPA.
The query_param option controls which fields are returned: BASE for
essential fields, ALL for all fields, PKEY_ONLY for group names only,
or a list of specific field names.
Here is the updated documentation of the module:
README-group.md
New tests for the query state can be found at:
tests/group/test_group_query.yml
187 lines
4.9 KiB
YAML
187 lines
4.9 KiB
YAML
---
|
|
- name: Test groups
|
|
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
# setup
|
|
- name: Include tasks ../env_freeipa_facts.yml
|
|
ansible.builtin.include_tasks: ../env_freeipa_facts.yml
|
|
|
|
# GET FQDN_AT_DOMAIN
|
|
|
|
- name: Get fqdn_at_domain
|
|
ansible.builtin.set_fact:
|
|
fqdn_at_domain: "{{ ansible_facts['fqdn'] + '@' + ipaserver_realm }}"
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Remove test groups
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: group1,group2,group3,group4,group5,group6,group7,group8,group9,group10,newgroup1,newgroup2
|
|
state: absent
|
|
|
|
- name: Remove test users
|
|
ipauser:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: user1,user2,user3
|
|
state: absent
|
|
|
|
# CREATE TEST ITEMS
|
|
|
|
- name: Users user1..3 present
|
|
ipauser:
|
|
ipaadmin_password: SomeADMINpassword
|
|
users:
|
|
- name: user1
|
|
first: user1
|
|
last: Last
|
|
- name: user2
|
|
first: user2
|
|
last: Last
|
|
- name: user3
|
|
first: user3
|
|
last: Last
|
|
|
|
# TESTS
|
|
|
|
- name: Groups group1..10 present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: group1
|
|
- name: group2
|
|
user:
|
|
- user1
|
|
- user2
|
|
- user3
|
|
- name: group3
|
|
group:
|
|
- group1
|
|
- group2
|
|
- name: group4
|
|
- name: group5
|
|
- name: group6
|
|
- name: group7
|
|
- name: group8
|
|
- name: group9
|
|
- name: group10
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Groups group1..10 present again
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: group1
|
|
- name: group2
|
|
- name: group3
|
|
- name: group4
|
|
- name: group5
|
|
- name: group6
|
|
- name: group7
|
|
- name: group8
|
|
- name: group9
|
|
- name: group10
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
# failed_when: not result.failed has been added as this test needs to
|
|
# fail because two groups with the same name should be added in the same
|
|
# task.
|
|
- name: Duplicate names in groups failure test
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: group1
|
|
- name: group2
|
|
- name: group3
|
|
- name: group3
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "is used more than once" not in result.msg
|
|
|
|
- name: Groups/name and name group11 present
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: group11
|
|
groups:
|
|
- name: group11
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "parameters are mutually exclusive" not in result.msg
|
|
|
|
- name: Groups/name and name are absent
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "At least one name or groups is required" not in result.msg
|
|
|
|
- name: Name is absent
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name:
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "At least one name or groups is required" not in result.msg
|
|
|
|
- name: Only one group can be added at a time using name.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: group11,group12
|
|
register: result
|
|
failed_when: result.changed or not result.failed or "Only one group can be added at a time using 'name'." not in result.msg
|
|
|
|
- name: Ensure group1 and group2 exist
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: group1
|
|
- name: group2
|
|
|
|
- name: Rename group1 and group2 to newgroup1 and newgroup2, respectively
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: group1
|
|
rename: newgroup1
|
|
- name: group2
|
|
rename: newgroup2
|
|
state: renamed
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Rename newgroup1 and newgroup2 to the same name
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: newgroup1
|
|
rename: newgroup1
|
|
- name: newgroup2
|
|
rename: newgroup2
|
|
state: renamed
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Rename newgroup1 and newgroup2 back to group1 and group2, respectively
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
groups:
|
|
- name: newgroup1
|
|
rename: group1
|
|
- name: newgroup2
|
|
rename: group2
|
|
state: renamed
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Remove test groups
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: group1,group2,group3,group4,group5,group6,group7,group8,group9,group10,newgroup1,newgroup2
|
|
state: absent
|
|
|
|
- name: Remove test users
|
|
ipauser:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: user1,user2,user3
|
|
state: absent
|