diff --git a/README-selfservice.md b/README-selfservice.md
index ae6a8a3e4313e3f301460466c06e39d0d8969628..8bfa8352e0b8e03c6bf1ee78ca15df26492d17f2 100644
--- a/README-selfservice.md
+++ b/README-selfservice.md
@@ -138,6 +138,7 @@ Variable | Description | Required
-------- | ----------- | --------
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
+`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
`name` \| `aciname` | The list of selfservice name strings. | yes
`permission` \| `permissions` | The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no
`attribute` \| `attrs` | The attribute list to which the selfservice applies. | no
diff --git a/tests/selfservice/test_selfservice.yml b/tests/selfservice/test_selfservice.yml
index 3f036acb6427710ce45f721ec1a95869a003537d..a5305187d2041e5ba9bba3e5393b20ac406f7a08 100644
--- a/tests/selfservice/test_selfservice.yml
+++ b/tests/selfservice/test_selfservice.yml
@@ -1,6 +1,6 @@
---
- name: Test selfservice
- hosts: ipaserver
+ hosts: "{{ ipa_test_host | default('ipaserver') }}"
become: true
tasks:
@@ -10,6 +10,7 @@
- name: Ensure selfservice "Users can manage their own name details" is absent
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
state: absent
@@ -20,6 +21,7 @@
- name: Ensure selfservice "Users can manage their own name details" is present
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: write
attribute:
@@ -32,6 +34,7 @@
- name: Ensure selfservice "Users can manage their own name details" is present again
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: write
attribute:
@@ -44,6 +47,7 @@
- name: Ensure selfservice "Users can manage their own name details" is present with different attribute initials
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: write
attribute:
@@ -54,6 +58,7 @@
- name: Ensure selfservice "Users can manage their own name details" is present with different attribute initials again
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: write
attribute:
@@ -64,6 +69,7 @@
- name: Ensure selfservice "Users can manage their own name details" member attributes givenname, displayname and title are present
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
attribute:
- givenname
@@ -76,6 +82,7 @@
- name: Ensure selfservice "Users can manage their own name details" member attributes givenname, displayname and title are present again
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
attribute:
- givenname
@@ -88,6 +95,7 @@
- name: Ensure selfservice "Users can manage their own name details" member attribute title is absent
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
attribute:
- title
@@ -99,6 +107,7 @@
- name: Ensure selfservice "Users can manage their own name details" member attribute title is absent again
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
attribute:
- title
@@ -112,6 +121,7 @@
- name: Ensure selfservice "Users can manage their own name details" is present with different read,write permission
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: read,write
register: result
@@ -120,6 +130,7 @@
- name: Ensure selfservice "Users can manage their own name details" is present with different read,write permission again
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: read,write
register: result
@@ -128,6 +139,7 @@
- name: Ensure selfservice "Users can manage their own name details" fails with bad permission read,read
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: read,read
register: result
@@ -136,6 +148,7 @@
- name: Ensure selfservice "Users can manage their own name details" fails with bad permission read,write,write
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
permission: read,write,write
register: result
@@ -144,6 +157,7 @@
- name: Ensure selfservice "Users can manage their own name details" fails with bad attribute title,title
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
attribute:
- title
@@ -156,5 +170,6 @@
- name: Ensure selfservice "Users can manage their own name details" is absent
ipaselfservice:
ipaadmin_password: SomeADMINpassword
+ ipaapi_context: "{{ ipa_context | default(omit) }}"
name: "Users can manage their own name details"
state: absent
diff --git a/tests/selfservice/test_selfservice_client_context.yml b/tests/selfservice/test_selfservice_client_context.yml
new file mode 100644
index 0000000000000000000000000000000000000000..d720aa537021f1c8fbe93a97101aa9438666f6f5
--- /dev/null
+++ b/tests/selfservice/test_selfservice_client_context.yml
@@ -0,0 +1,37 @@
+---
+- name: Test selfservice
+ hosts: ipaclients, ipaserver
+ become: no
+ gather_facts: no
+
+ tasks:
+ - name: Include FreeIPA facts.
+ include_tasks: ../env_freeipa_facts.yml
+
+ # Test will only be executed if host is not a server.
+ - name: Execute with server context in the client.
+ ipaselfservice:
+ ipaadmin_password: SomeADMINpassword
+ ipaapi_context: server
+ name: ThisShouldNotWork
+ register: result
+ failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
+ when: ipa_host_is_client
+
+# Import basic module tests, and execute with ipa_context set to 'client'.
+# If ipaclients is set, it will be executed using the client, if not,
+# ipaserver will be used.
+#
+# With this setup, tests can be executed against an IPA client, against
+# an IPA server using "client" context, and ensure that tests are executed
+# in upstream CI.
+
+- name: Test selfservice using client context, in client host.
+ import_playbook: test_selfservice.yml
+ when: groups['ipaclients']
+ vars:
+ ipa_test_host: ipaclients
+
+- name: Test selfservice using client context, in server host.
+ import_playbook: test_selfservice.yml
+ when: groups['ipaclients'] is not defined or not groups['ipaclients']