diff --git a/README-sudocmdgroup.md b/README-sudocmdgroup.md index cca08c191d..e37f577aa0 100644 --- a/README-sudocmdgroup.md +++ b/README-sudocmdgroup.md @@ -123,6 +123,7 @@ Variable | Description | Required -------- | ----------- | -------- `ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no `ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no +`ipaapi_context` | The context in which the module will execute. Executing in a server context is preferred. If not provided context will be determined by the execution environment. Valid values are `server` and `client`. | no `name` \| `cn` | The list of sudocmdgroup name strings. | no `description` | The sudocmdgroup description string. | no `nomembers` | Suppress processing of membership attributes. (bool) | no diff --git a/tests/sudocmdgroup/test_sudocmdgroup.yml b/tests/sudocmdgroup/test_sudocmdgroup.yml index 17c6088569..59f6306167 100644 --- a/tests/sudocmdgroup/test_sudocmdgroup.yml +++ b/tests/sudocmdgroup/test_sudocmdgroup.yml @@ -1,6 +1,6 @@ --- - name: Test sudocmdgroup - hosts: ipaserver + hosts: "{{ ipa_test_host | default('ipaserver') }}" become: true gather_facts: false @@ -8,6 +8,7 @@ - name: Ensure sudocmds are present ipasudocmd: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: - /usr/bin/su - /usr/sbin/ifconfig @@ -17,12 +18,14 @@ - name: Ensure sudocmdgroup is absent ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: absent - name: Ensure sudocmdgroup is present ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: present register: result @@ -31,6 +34,7 @@ - name: Ensure sudocmdgroup is present again ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: present register: result @@ -39,6 +43,7 @@ - name: Ensure sudocmdgroup is absent ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: absent register: result @@ -47,6 +52,7 @@ - name: Ensure sudocmdgroup is absent again ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: absent register: result @@ -55,6 +61,7 @@ - name: Ensure sudocmdgroup is present, with sudocmds. ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -66,6 +73,7 @@ - name: Ensure sudocmdgroup is present, with sudocmds, again. ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -85,6 +93,7 @@ - name: Ensure sudocmdgroup, with sudocmds, is absent ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: absent register: result @@ -93,6 +102,7 @@ - name: Ensure sudocmdgroup, with sudocmds, is absent again ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: absent register: result @@ -101,6 +111,7 @@ - name: Ensure testing sudocmdgroup is present ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network state: present register: result @@ -109,6 +120,7 @@ - name: Ensure sudo commands are present in existing sudocmdgroup ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -120,6 +132,7 @@ - name: Ensure sudo commands are present in existing sudocmdgroup, again ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -131,6 +144,7 @@ - name: Ensure sudo commands are absent in existing sudocmdgroup ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -143,6 +157,7 @@ - name: Ensure sudo commands are absent in existing sudocmdgroup, again ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -155,6 +170,7 @@ - name: Ensure sudo commands are present in sudocmdgroup ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -167,6 +183,7 @@ - name: Ensure one sudo command is not present in sudocmdgroup ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -178,6 +195,7 @@ - name: Ensure one sudo command is present in sudocmdgroup ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/ifconfig @@ -189,6 +207,7 @@ - name: Ensure the other sudo command is not present in sudocmdgroup ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/iwlist @@ -200,6 +219,7 @@ - name: Ensure the other sudo commandsis not present in sudocmdgroup, again ipasudocmdgroup: ipaadmin_password: SomeADMINpassword + ipaapi_context: "{{ ipa_context | default(omit) }}" name: network sudocmd: - /usr/sbin/iwlist diff --git a/tests/sudocmdgroup/test_sudocmdgroup_client_context.yml b/tests/sudocmdgroup/test_sudocmdgroup_client_context.yml new file mode 100644 index 0000000000..c5a3ae678e --- /dev/null +++ b/tests/sudocmdgroup/test_sudocmdgroup_client_context.yml @@ -0,0 +1,37 @@ +--- +- name: Test sudocmdgroup + hosts: ipaclients, ipaserver + become: no + gather_facts: no + + tasks: + - name: Include FreeIPA facts. + include_tasks: ../env_freeipa_facts.yml + + # Test will only be executed if host is not a server. + - name: Execute with server context in the client. + ipasudocmdgroup: + ipaadmin_password: SomeADMINpassword + ipaapi_context: server + name: ThisShouldNotWork + register: result + failed_when: not (result.failed and result.msg is regex("No module named '*ipaserver'*")) + when: ipa_host_is_client + +# Import basic module tests, and execute with ipa_context set to 'client'. +# If ipaclients is set, it will be executed using the client, if not, +# ipaserver will be used. +# +# With this setup, tests can be executed against an IPA client, against +# an IPA server using "client" context, and ensure that tests are executed +# in upstream CI. + +- name: Test sudocmdgroup using client context, in client host. + import_playbook: test_sudocmdgroup.yml + when: groups['ipaclients'] + vars: + ipa_test_host: ipaclients + +- name: Test sudocmdgroup using client context, in server host. + import_playbook: test_sudocmdgroup.yml + when: groups['ipaclients'] is not defined or not groups['ipaclients']