diff --git a/README-delegation.md b/README-delegation.md index 63e4150b1fe3b41f27f3a3f2ba591f3cdf374c9b..00d84388b0f644b9aef7e70f08ecec72b37f3a15 100644 --- a/README-delegation.md +++ b/README-delegation.md @@ -142,6 +142,7 @@ Variable | Description | Required -------- | ----------- | -------- `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no +`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no `name` \| `aciname` | The list of delegation name strings. | yes `permission` \| `permissions` | The permission to grant `read`, `read,write`, `write`]. Default is `write`. | no `attribute` \| `attrs` | The attribute list to which the delegation applies. | no diff --git a/tests/delegation/test_delegation.yml b/tests/delegation/test_delegation.yml index 4f609b8a19b14d64d862ae800f777e4973b5a415..6bd0df7fdc2ad1972435ffa26b03aba6fde1ca70 100644 --- a/tests/delegation/test_delegation.yml +++ b/tests/delegation/test_delegation.yml @@ -1,6 +1,6 @@ --- - name: Test delegation - hosts: ipaserver + hosts: "{{ ipa_test_host | default('ipaserver') }}" become: true tasks: @@ -10,12 +10,14 @@ - name: Ensure test groups are absent ipagroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: managers,managers2,employees,employees2 state: absent - name: Ensure delegation "basic manager attributes" is absent ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" state: absent @@ -24,21 +26,25 @@ - name: Ensure test group managers is present ipagroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: managers - name: Ensure test group managers2 is present ipagroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: managers2 - name: Ensure test group employees is present ipagroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: employees - name: Ensure test group employees2 is present ipagroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: employees2 # TESTS @@ -46,6 +52,7 @@ - name: Ensure delegation "basic manager attributes" is present ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read attribute: @@ -58,6 +65,7 @@ - name: Ensure delegation "basic manager attributes" is present again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read attribute: @@ -70,6 +78,7 @@ - name: Ensure delegation "basic manager attributes" is present with different attribute employeetype ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read attribute: @@ -82,6 +91,7 @@ - name: Ensure delegation "basic manager attributes" is present with different attribute employeetype again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read attribute: @@ -94,6 +104,7 @@ - name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - departmentnumber @@ -104,6 +115,7 @@ - name: Ensure delegation "basic manager attributes" member attribute departmentnumber is present again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - departmentnumber @@ -114,6 +126,7 @@ - name: Ensure delegation "basic manager attributes" member attributes employeetype and employeenumber are present ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - employeetype @@ -125,6 +138,7 @@ - name: Ensure delegation "basic manager attributes" member attributes employeetype and employeenumber are present again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - employeetype @@ -136,6 +150,7 @@ - name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - employeenumber @@ -148,6 +163,7 @@ - name: Ensure delegation "basic manager attributes" member attributes employeenumber and employeetype are absent again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - employeenumber @@ -162,6 +178,7 @@ - name: Ensure delegation "basic manager attributes" is present with different read,write permission ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read,write attribute: @@ -174,6 +191,7 @@ - name: Ensure delegation "basic manager attributes" is present with different read,write permission again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read,write attribute: @@ -186,6 +204,7 @@ - name: Ensure delegation "basic manager attributes" is present with different group managers2 ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" group: managers2 register: result @@ -194,6 +213,7 @@ - name: Ensure delegation "basic manager attributes" is present with different group managers2 again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" group: managers2 register: result @@ -202,6 +222,7 @@ - name: Ensure delegation "basic manager attributes" is present with different membergroup employees2 ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" membergroup: employees2 register: result @@ -210,6 +231,7 @@ - name: Ensure delegation "basic manager attributes" is present with different membergroup employees2 again ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" membergroup: employees2 register: result @@ -218,6 +240,7 @@ - name: Ensure delegation "basic manager attributes" fails with bad permission read,read ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read,read register: result @@ -226,6 +249,7 @@ - name: Ensure delegation "basic manager attributes" fails with bad permission read,write,write ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" permission: read,write,write register: result @@ -234,6 +258,7 @@ - name: Ensure delegation "basic manager attributes" fails with bad attribute businesscategory,businesscategory ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" attribute: - businesscategory @@ -246,11 +271,13 @@ - name: Ensure delegation "basic manager attributes" is absent ipadelegation: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: "basic manager attributes" state: absent - name: Ensure test groups are absent ipagroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: managers,managers2,employees,employees2 state: absent diff --git a/tests/delegation/test_delegation_client_context.yml b/tests/delegation/test_delegation_client_context.yml new file mode 100644 index 0000000000000000000000000000000000000000..8756897d3005d3ab0857eab1afa9de86fc696545 --- /dev/null +++ b/tests/delegation/test_delegation_client_context.yml @@ -0,0 +1,37 @@ +--- +- name: Test delegation + hosts: ipaclients, ipaserver + become: no + gather_facts: no + + tasks: + - name: Include FreeIPA facts. + include_tasks: ../env_freeipa_facts.yml + + # Test will only be executed if host is not a server. + - name: Execute with server context in the client. + ipadelegation: + ipaadmin_password: SomeADMINpassword + ipaapi_context: server + name: ThisShouldNotWork + register: result + failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*")) + when: ipa_host_is_client + +# Import basic module tests, and execute with ipa_context set to 'client'. +# If ipaclients is set, it will be executed using the client, if not, +# ipaserver will be used. +# +# With this setup, tests can be executed against an IPA client, against +# an IPA server using "client" context, and ensure that tests are executed +# in upstream CI. + +- name: Test delegation using client context, in client host. + import_playbook: test_delegation.yml + when: groups['ipaclients'] + vars: + ipa_test_host: ipaclients + +- name: Test delegation using client context, in server host. + import_playbook: test_delegation.yml + when: groups['ipaclients'] is not defined or not groups['ipaclients']