From 63423779a84d5e367082143b57ba601efb4c15f0 Mon Sep 17 00:00:00 2001 From: Rafael Guterres Jeffman <rjeffman@redhat.com> Date: Fri, 3 Sep 2021 13:47:13 -0300 Subject: [PATCH] ipaselfservice: Allow execution of plugin in client host. Update selfservice README file and add tests for executing plugin with `ipaapi_context` set to `client`. A new test playbook can be found at: tests/selfservice/test_selfservice_client_context.yml The new test file can be executed in a FreeIPA client host that is not a server. In this case, it should be defined in the `ipaclients` group, in the inventory file. --- README-selfservice.md | 1 + tests/selfservice/test_selfservice.yml | 17 ++++++++- .../test_selfservice_client_context.yml | 37 +++++++++++++++++++ 3 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 tests/selfservice/test_selfservice_client_context.yml diff --git a/README-selfservice.md b/README-selfservice.md index ae6a8a3e..8bfa8352 100644 --- a/README-selfservice.md +++ b/README-selfservice.md @@ -138,6 +138,7 @@ Variable | Description | Required -------- | ----------- | -------- `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no +`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no `name` \| `aciname` | The list of selfservice name strings. | yes `permission` \| `permissions` | The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no `attribute` \| `attrs` | The attribute list to which the selfservice applies. | no diff --git a/tests/selfservice/test_selfservice.yml b/tests/selfservice/test_selfservice.yml index 3f036acb..a5305187 100644 --- a/tests/selfservice/test_selfservice.yml +++ b/tests/selfservice/test_selfservice.yml @@ -1,6 +1,6 @@ --- - name: Test selfservice - hosts: ipaserver + hosts: "{{ ipa_test_host | default('ipaserver') }}" become: true tasks: @@ -10,6 +10,7 @@ - name: Ensure selfservice "Users can manage their own name details" is absent ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" state: absent @@ -20,6 +21,7 @@ - name: Ensure selfservice "Users can manage their own name details" is present ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: write attribute: @@ -32,6 +34,7 @@ - name: Ensure selfservice "Users can manage their own name details" is present again ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: write attribute: @@ -44,6 +47,7 @@ - name: Ensure selfservice "Users can manage their own name details" is present with different attribute initials ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: write attribute: @@ -54,6 +58,7 @@ - name: Ensure selfservice "Users can manage their own name details" is present with different attribute initials again ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: write attribute: @@ -64,6 +69,7 @@ - name: Ensure selfservice "Users can manage their own name details" member attributes givenname, displayname and title are present ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" attribute: - givenname @@ -76,6 +82,7 @@ - name: Ensure selfservice "Users can manage their own name details" member attributes givenname, displayname and title are present again ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" attribute: - givenname @@ -88,6 +95,7 @@ - name: Ensure selfservice "Users can manage their own name details" member attribute title is absent ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" attribute: - title @@ -99,6 +107,7 @@ - name: Ensure selfservice "Users can manage their own name details" member attribute title is absent again ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" attribute: - title @@ -112,6 +121,7 @@ - name: Ensure selfservice "Users can manage their own name details" is present with different read,write permission ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: read,write register: result @@ -120,6 +130,7 @@ - name: Ensure selfservice "Users can manage their own name details" is present with different read,write permission again ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: read,write register: result @@ -128,6 +139,7 @@ - name: Ensure selfservice "Users can manage their own name details" fails with bad permission read,read ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: read,read register: result @@ -136,6 +148,7 @@ - name: Ensure selfservice "Users can manage their own name details" fails with bad permission read,write,write ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" permission: read,write,write register: result @@ -144,6 +157,7 @@ - name: Ensure selfservice "Users can manage their own name details" fails with bad attribute title,title ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" attribute: - title @@ -156,5 +170,6 @@ - name: Ensure selfservice "Users can manage their own name details" is absent ipaselfservice: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "Users can manage their own name details" state: absent diff --git a/tests/selfservice/test_selfservice_client_context.yml b/tests/selfservice/test_selfservice_client_context.yml new file mode 100644 index 00000000..d720aa53 --- /dev/null +++ b/tests/selfservice/test_selfservice_client_context.yml @@ -0,0 +1,37 @@ +--- +- name: Test selfservice + hosts: ipaclients, ipaserver + become: no + gather_facts: no + + tasks: + - name: Include FreeIPA facts. + include_tasks: ../env_freeipa_facts.yml + + # Test will only be executed if host is not a server. + - name: Execute with server context in the client. + ipaselfservice: + ipaadmin_password: SomeADMINpassword + ipaapi_context: server + name: ThisShouldNotWork + register: result + failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*")) + when: ipa_host_is_client + +# Import basic module tests, and execute with ipa_context set to 'client'. +# If ipaclients is set, it will be executed using the client, if not, +# ipaserver will be used. +# +# With this setup, tests can be executed against an IPA client, against +# an IPA server using "client" context, and ensure that tests are executed +# in upstream CI. + +- name: Test selfservice using client context, in client host. + import_playbook: test_selfservice.yml + when: groups['ipaclients'] + vars: + ipa_test_host: ipaclients + +- name: Test selfservice using client context, in server host. + import_playbook: test_selfservice.yml + when: groups['ipaclients'] is not defined or not groups['ipaclients'] -- GitLab