mirror of
https://github.com/freeipa/ansible-freeipa.git
synced 2026-03-26 21:33:05 +00:00
d2f9fe6325
This replaces double spaces by single spaces, fixes spaces in slices, adds spaces before brackets and fixes bracket placing in when clauses.
405 lines
13 KiB
YAML
405 lines
13 KiB
YAML
---
|
|
- name: Test permission
|
|
hosts: "{{ ipa_test_host | default('ipaserver') }}"
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Include task ../env_freeipa_facts.yml
|
|
ansible.builtin.include_tasks: ../env_freeipa_facts.yml
|
|
|
|
- name: Ensure testing groups are present.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "{{ item }}"
|
|
state: present
|
|
with_items:
|
|
- rbacgroup1
|
|
- rbacgroup2
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Ensure permission perm-test-1 is absent
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- perm-test-1
|
|
- perm-test-bindtype-test
|
|
- perm-test-renamed
|
|
state: absent
|
|
|
|
# TESTS
|
|
|
|
- name: Ensure permission perm-test-1 is present
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
object_type: host
|
|
memberof: rbacgroup1
|
|
filter: '(cn=*.ipa.*)'
|
|
right: all
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 is present again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
object_type: host
|
|
memberof: rbacgroup1
|
|
filter: '(cn=*.ipa.*)'
|
|
right: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 has an extra filter '(cn=*.internal.*)'
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
filter: '(cn=*.internal.*)'
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 has an extra filter '(cn=*.internal.*)', again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
filter: '(cn=*.internal.*)'
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `right` has `write`
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
right: write
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `right` has `write`, again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
right: write
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `right` has no `write`
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
right: write
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `right` has no `write`, again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
right: write
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `memberof` has `rbackgroup2`
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
memberof: rbacgroup2
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `memberof` has `rbackgroup2`, again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
memberof: rbacgroup2
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `memberof` item `rbackgroup1` is absent
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
memberof: rbacgroup1
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 `memberof` item `rbackgroup1` is absent, again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
memberof: rbacgroup1
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 is present with attr carlicense
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- carlicense
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 is present with attr carlicense again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- carlicense
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 is present with attr carlicense and displayname
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- carlicense
|
|
- displayname
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 is present with attr carlicense and displayname again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- carlicense
|
|
- displayname
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure attr gecos is present in permission perm-test-1
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- gecos
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure attr gecos is present in permission perm-test-1 again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- gecos
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure attr gecos is absent in permission perm-test-1
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- gecos
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure attr gecos is absent in permission perm-test-1 again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
attrs:
|
|
- gecos
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure attributes carlicense and displayname are present in permission "System{{ ':' }} Update DNS Entries"
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "System: Update DNS Entries"
|
|
attrs:
|
|
- carlicense
|
|
- displayname
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure attributes carlicense and displayname are present in permission "System{{ ':' }} Update DNS Entries" again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "System: Update DNS Entries"
|
|
attrs:
|
|
- carlicense
|
|
- displayname
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure attributes carlicense and displayname are present in permission "System{{ ':' }} Update DNS Entries"
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "System: Update DNS Entries"
|
|
attrs:
|
|
- carlicense
|
|
- displayname
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure attributes carlicense and displayname are present in permission "System{{ ':' }} Update DNS Entries" again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "System: Update DNS Entries"
|
|
attrs:
|
|
- carlicense
|
|
- displayname
|
|
action: member
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 has rawfilter '(objectclass=ipagroup)'
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
rawfilter: '(objectclass=ipagroup)'
|
|
action: member
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 has rawfilter '(objectclass=ipagroup)', again
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
rawfilter: '(objectclass=ipagroup)'
|
|
action: member
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure filter and rawfilter cannot be used together.
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
rawfilter: '(objectclass=ipagroup)'
|
|
filter: '(cn=*.internal.*)'
|
|
action: member
|
|
register: result
|
|
failed_when: not result.failed or "Cannot specify target filter and extra target filter simultaneously" not in result.msg
|
|
|
|
- name: Rename permission perm-test-1 to perm-test-renamed
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
rename: perm-test-renamed
|
|
state: renamed
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-1 is absent
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-1
|
|
state: absent
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission perm-test-renamed is present
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-renamed
|
|
object_type: host
|
|
right: all
|
|
register: result
|
|
failed_when: result.changed or result.failed
|
|
|
|
- name: Ensure permission with bindtype 'self' is present, if IPA version >= 4.8.7
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-bindtype-test
|
|
bindtype: self
|
|
object_type: host
|
|
right: all
|
|
when: ipa_version is version('4.8.7', '>=')
|
|
register: result
|
|
failed_when: not result.changed or result.failed
|
|
|
|
- name: Fail to set permission perm-test-renamed bindtype to 'self', if IPA version < 4.8.7
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: perm-test-bindtype-test
|
|
bindtype: self
|
|
object_type: host
|
|
right: all
|
|
when: ipa_version is version('4.8.7', '<')
|
|
register: result
|
|
failed_when: not result.failed or "Bindtype 'self' is not supported by your IPA version." not in result.msg
|
|
|
|
# CLEANUP TEST ITEMS
|
|
|
|
- name: Ensure testing permissions are absent
|
|
ipapermission:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name:
|
|
- perm-test-1
|
|
- perm-test-bindtype-test
|
|
- perm-test-renamed
|
|
state: absent
|
|
|
|
- name: Ensure testing groups are absent.
|
|
ipagroup:
|
|
ipaadmin_password: SomeADMINpassword
|
|
ipaapi_context: "{{ ipa_context | default(omit) }}"
|
|
name: "{{ item }}"
|
|
state: absent
|
|
with_items:
|
|
- rbacgroup1
|
|
- rbacgroup2
|