ipaautomember: Allow execution of plugin in client host.

Update automember README file and add tests for executing plugin with
`ipaapi_context` set to `client`.

A new test playbook can be found at:

    tests/automember/test_automember_client_context.yml

The new test file can be executed in a FreeIPA client host that is
not a server. In this case, it should be defined in the `ipaclients`
group, in the inventory file.

README-automember.md

@@ -122,6 +122,7 @@ Variable | Description | Required
 -------- | ----------- | --------
 `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
 `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
+`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no
 `name` \| `cn` | Automember rule. | yes
 `description` | A description of this auto member rule. | no
 `automember_type` | Grouping to which the rule applies. It can be one of `group`, `hostgroup`. | yes

tests/automember/test_automember.yml

 ---
 - name: Test automember
-  hosts: ipaserver
+  hosts: "{{ ipa_test_host | default('ipaserver') }}"
   become: true
 
   tasks:
@@ -10,18 +10,21 @@
   - name: Ensure group testgroup is absent
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       state: absent
 
   - name: Ensure hostgroup testhostgroup is absent
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       state: absent
 
   - name: Ensure group automember rule testgroup is absent
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       state: absent
       automember_type: group
@@ -29,6 +32,7 @@
   - name: Ensure hostgroup automember rule testhostgroup is absent
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       state: absent
       automember_type: hostgroup
@@ -39,16 +43,19 @@
   - name: Ensure testgroup group is present
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
 
   - name: Ensure testhostgroup hostgroup is present
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
 
   - name: Ensure testgroup group automember rule is present
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       description: testgroup automember rule.
       automember_type: group
@@ -58,6 +65,7 @@
   - name: Ensure testgroup group automember rule is present again
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       description: testgroup automember rule.
       automember_type: group
@@ -67,6 +75,7 @@
   - name: Change testgroup group automember rule description
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       description: testgroup automember rule description.
       automember_type: group
@@ -76,6 +85,7 @@
   - name: Ensure testgroup group automember rule has conditions
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       inclusive:
@@ -92,6 +102,7 @@
   - name: Ensure testgroup group automember rule has conditions again
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       inclusive:
@@ -108,6 +119,7 @@
   - name: Add testgroup group automember rule member condition
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       action: member
@@ -120,6 +132,7 @@
   - name: Ensure testgroup group automember rule has conditions
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       inclusive:
@@ -138,6 +151,7 @@
   - name: Remove testgroup group automember rule member condition
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       action: member
@@ -151,6 +165,7 @@
   - name: Ensure testgroup group automember rule has conditions again
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       inclusive:
@@ -168,6 +183,7 @@
     ipaautomember:
       ipaadmin_principal: admin
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       inclusive:
@@ -182,6 +198,7 @@
     ipaautomember:
       ipaadmin_principal: admin
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       automember_type: group
       exclusive:
@@ -195,6 +212,7 @@
   - name: Ensure testhostgroup hostgroup automember rule is present
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       description: testhostgroup automember rule
       automember_type: hostgroup
@@ -204,6 +222,7 @@
   - name: Ensure testhostgroup hostgroup automember rule is present again
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       description: testhostgroup automember rule
       automember_type: hostgroup
@@ -213,6 +232,7 @@
   - name: Change testhostgroup hostgroup automember rule description
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       description: testhostgroup test automember rule
       automember_type: hostgroup
@@ -222,6 +242,7 @@
   - name: Ensure testhostgroup hostgroup automember rule has conditions
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       inclusive:
@@ -238,6 +259,7 @@
   - name: Ensure testhostgroup hostgroup automember rule has conditions again
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       inclusive:
@@ -254,6 +276,7 @@
   - name: Add testhostgroup hostgroup automember rule member condition
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       action: member
@@ -266,6 +289,7 @@
   - name: Ensure testhostgroup hostgroup automember rule has conditions
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       inclusive:
@@ -284,6 +308,7 @@
   - name: Remove testhostgroup hostgroup automember rule member condition
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       action: member
@@ -297,6 +322,7 @@
   - name: Ensure testhostgroup hostgroup automember rule has conditions
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       inclusive:
@@ -315,6 +341,7 @@
     ipaautomember:
       ipaadmin_principal: admin
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       inclusive:
@@ -329,6 +356,7 @@
     ipaautomember:
       ipaadmin_principal: admin
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       automember_type: hostgroup
       exclusive:
@@ -344,18 +372,21 @@
   - name: Ensure group testgroup is absent
     ipagroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testgroup
       state: absent
 
   - name: Ensure hostgroup testhostgroup is absent
     ipahostgroup:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       name: testhostgroup
       state: absent
 
   - name: Ensure group automember rule testgroup is absent
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       automember_type: group
       name: testgroup
       state: absent
@@ -363,6 +394,7 @@
   - name: Ensure hostgroup automember rule testhostgroup is absent
     ipaautomember:
       ipaadmin_password: SomeADMINpassword
+      ipaapi_context: "{{ ipa_context | default(omit) }}"
       automember_type: hostgroup
       name: testhostgroup
       state: absent

tests/automember/test_automember_client_context.yml

+---
+- name: Test automember
+  hosts: ipaclients, ipaserver
+  become: no
+  gather_facts: no
+
+  tasks:
+  - name: Include FreeIPA facts.
+    include_tasks: ../env_freeipa_facts.yml
+
+  # Test will only be executed if host is not a server.
+  - name: Execute with server context in the client.
+    ipaautomember:
+      ipaadmin_password: SomeADMINpassword
+      ipaapi_context: server
+      name: ThisShouldNotWork
+      state: rebuild
+    register: result
+    failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*"))
+    when: ipa_host_is_client
+
+# Import basic module tests, and execute with ipa_context set to 'client'.
+# If ipaclients is set, it will be executed using the client, if not,
+# ipaserver will be used.
+#
+# With this setup, tests can be executed against an IPA client, against
+# an IPA server using "client" context, and ensure that tests are executed
+# in upstream CI.
+
+- name: Test automember using client context, in client host.
+  import_playbook: test_automember.yml
+  when: groups['ipaclients']
+  vars:
+    ipa_test_host: ipaclients
+
+- name: Test automember using client context, in server host.
+  import_playbook: test_automember.yml
+  when: groups['ipaclients'] is not defined or not groups['ipaclients']