mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-03-26 21:33:05 +00:00
6925503a10
When using AD objects, a user expects to use the more human readable form, like "user@ad.domain", but this impose some dificulties on evaluating which object is being referenced as AD has several forms to refer to the same object. Each object is AD is identified uniquely by its SID, and this is the identifier that IPA stores in its database. When managing AD objects, IPA finds its SID and works with that value. ansible-freeipa tried to process these objects using the human readable values, and it cause idempontence error when ensuring the values were present or modified, and, at least in some cases, prevented the objects to be made absent, as the object list created didn't match the SID to the value used as module parameter. By using SID to process the AD objects in ipagroup, the addition or removal of members works and idempotence of these members is ensured. The only issue with thils approach is that it only works no server nodes. In client nodes, the conversion to SID is not available and the same issues that existed before will still be present. Tests were updated to reflect these changes, a new test, specific to idempotence issues of AD objects was added: tests/group/test_group_ad_users.yml Resolves: https://issues.redhat.com/browse/RHEL-70023
107 lines
3.2 KiB
YAML
107 lines
3.2 KiB
YAML
---
|
|
- name: Test group idoverrideuser
|
|
hosts: ipaserver
|
|
become: false
|
|
gather_facts: false
|
|
module_defaults:
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaidoverrideuser:
|
|
ipaadmin_password: SomeADMINpassword
|
|
|
|
vars:
|
|
ad_user: "{{ test_ad_user | default('AD\\aduser') }}"
|
|
alt_user: "{{ test_alt_user | default('aduser@ad.ipa.test') }}"
|
|
|
|
tasks:
|
|
- name: Include tasks ../env_freeipa_facts.yml
|
|
ansible.builtin.include_tasks: ../env_freeipa_facts.yml
|
|
|
|
- name: Execute tests if ipa_verison >= 4.8.7 and trust test environment is supported
|
|
when: ipa_version is version("4.8.7", ">=") and trust_test_is_supported | default(false)
|
|
block:
|
|
- name: Ensure test idoverrideuser is present
|
|
ipaidoverrideuser:
|
|
idview: "Default Trust View"
|
|
anchor: "{{ ad_user }}"
|
|
register: result
|
|
failed_when: result.failed and "no modifications to be performed" not in result.msg
|
|
|
|
- name: Ensure test groups are absent
|
|
ipagroup:
|
|
name:
|
|
- idovergroup
|
|
state: absent
|
|
|
|
- name: Ensure group with idoverrideuser is present.
|
|
ipagroup:
|
|
name: idovergroup
|
|
idoverrideuser: "{{ ad_user }}"
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure group with idoverrideuser is present, again.
|
|
ipagroup:
|
|
name: idovergroup
|
|
idoverrideuser: "{{ ad_user }}"
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Ensure group with alternative idoverrideuser is present.
|
|
ipagroup:
|
|
name: idovergroup
|
|
idoverrideuser: "{{ alt_user }}"
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Ensure idoverrideuser member is absent.
|
|
ipagroup:
|
|
name: idovergroup
|
|
idoverrideuser: "{{ ad_user }}"
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure idoverrideuser member is absent, again.
|
|
ipagroup:
|
|
name: idovergroup
|
|
idoverrideuser: "{{ ad_user }}"
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
- name: Ensure idoverrideuser member is present.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: idovergroup
|
|
idoverrideuser: "{{ ad_user }}"
|
|
action: member
|
|
register: result
|
|
failed_when: result.failed or not result.changed
|
|
|
|
- name: Ensure idoverrideuser member is present, again.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name: idovergroup
|
|
idoverrideuser: "{{ ad_user }}"
|
|
action: member
|
|
register: result
|
|
failed_when: result.failed or result.changed
|
|
|
|
always:
|
|
- name: Remove testing groups.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
name:
|
|
- idovergroup
|
|
state: absent
|
|
|
|
- name: Remove idoverrideuser.
|
|
ipaidoverrideuser:
|
|
idview: "Default Trust View"
|
|
anchor: "{{ ad_user }}"
|
|
continue: true
|
|
state: absent
|