ansible-freeipa/tests/group/test_group.yml

---
- name: Test group
  hosts: "{{ ipa_test_host | default('ipaserver') }}"
  become: true
  gather_facts: true

  tasks:
  # setup
  - name: Include tasks ../env_freeipa_facts.yml
    ansible.builtin.include_tasks: ../env_freeipa_facts.yml

  # GET FQDN_AT_DOMAIN

  - name: Get fqdn_at_domain
    ansible.builtin.set_fact:
      fqdn_at_domain: "{{ ansible_facts['fqdn'] + '@' + ipaserver_realm }}"

  # CLEANUP TEST ITEMS

  - name: Ensure users user1, user2 and user3 are absent
    ipauser:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: user1,user2,user3
      state: absent

  - name: Ensure group group3, group2 and group1 are absent
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group3,group2,group1
      state: absent

  # CREATE TEST ITEMS

  - name: Ensure users user1..user3 are present
    ipauser:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      users:
      - name: user1
        first: user1
        last: Last
      - name: user2
        first: user2
        last: Last
      - name: user3
        first: user3
        last: Last
    register: result
    failed_when: not result.changed or result.failed

  # TESTS

  - name: Ensure group1 is present
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group1 is present again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure group2 is present
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group2
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group2 is present again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group2
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure group3 is present
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group3
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group3 is present again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group3
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure groups group2 and group3 are present in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      group:
      - group2
      - group3
      action: member
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure groups group2 and group3 are present in group group1 again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      group:
      - group2
      - group3
      action: member
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure group3 ia present in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      group:
      - group3
      action: member
    register: result
    failed_when: result.changed or result.failed

    # service

  - name: Execute tests if ipa_verison >= 4.7.0
    block:

    - name: Ensure service "{{ 'HTTP/' + fqdn_at_domain }}" is present in group group1
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        action: member
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure service "{{ 'HTTP/' + fqdn_at_domain }}" is present in group group1, again
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        action: member
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure service "{{ 'ldap/' + fqdn_at_domain }}" is present in group group1
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure service "{{ 'ldap/' + fqdn_at_domain }}" is present in group group1, again
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure service "{{ 'HTTP/' + fqdn_at_domain }}" is absent in group group1
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        action: member
        state: absent
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure service "{{ 'HTTP/' + fqdn_at_domain }}" is absent in group group1, again
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        action: member
        state: absent
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure service "{{ 'ldap/' + fqdn_at_domain }}" is absent in group group1
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
        state: absent
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure service "{{ 'ldap/' + fqdn_at_domain }}" is absent in group group1, again
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
        state: absent
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure services are present in group group1
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure services are present in group group1, again
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'http/' + fqdn_at_domain }}"
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
      register: result
      failed_when: result.changed or result.failed

    - name: Ensure services are absent in group group1
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        - "{{ 'LDAP/' + fqdn_at_domain }}"
        action: member
        state: absent
      register: result
      failed_when: not result.changed or result.failed

    - name: Ensure services are absent in group group1, again
      ipagroup:
        ipaadmin_password: SomeADMINpassword
        ipaapi_context: "{{ ipa_context | default(omit) }}"
        name: group1
        service:
        - "{{ 'HTTP/' + fqdn_at_domain }}"
        - "{{ 'ldap/' + fqdn_at_domain }}"
        action: member
        state: absent
      register: result
      failed_when: result.changed or result.failed

    when: ipa_version is version('4.7.0', '>=')

    # user

  - name: Ensure users user1, user2 and user3 are present in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      - user3
      action: member
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure users user1, user2 and user3 are present in group group1 again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      - user3
      action: member
    register: result
    failed_when: result.changed or result.failed

  #- ipagroup:
  #    ipaadmin_password: SomeADMINpassword
  #    ipaapi_context: "{{ ipa_context | default(omit) }}"
  #    name: group1
  #    user:
  #    - user7
  #    action: member

  - name: Ensure user user7 is absent in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user7
      action: member
      state: absent
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure group group4 is absent
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group4
      state: absent
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure groups group3, group2, and group1 are absent
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group3,group2,group1
      state: absent
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group group1 is present
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure users user1, user2 are present in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      action: member
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure users user1, user2 and user3 are present in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      - user3
      action: member
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure users user1, user2 are present in group group1, again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      action: member
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure users user1, user2 and user3 are present in group group1, again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      - user3
      action: member
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure group group1 is absent
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      state: absent
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group group1 with users user1, user2 is present
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group group1 with users user1, user2 and user3 is present
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      - user3
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure group group1 with users user1, user2 and user3 is present, again
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
      - user3
      action: member
    register: result
    failed_when: result.changed or result.failed

  - name: Ensure only users user1, user2 are present in group group1
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group1
      user:
      - user1
      - user2
    register: result
    failed_when: not result.changed or result.failed

  # CLEANUP TEST ITEMS

  - name: Ensure group group3, group2 and group1 are absent
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: group3,group2,group1
      state: absent
    register: result
    failed_when: not result.changed or result.failed

  - name: Ensure users user1, user2 and user3 are absent
    ipauser:
      ipaadmin_password: SomeADMINpassword
      ipaapi_context: "{{ ipa_context | default(omit) }}"
      name: user1,user2,user3
      state: absent
    register: result
    failed_when: not result.changed or result.failed