# This test uses skip_host_check, so it will fail if not using
# FreeIPA version 4.7.0 or later.
#
# To test against earlier versions, use test_without_skip_host_check.yml.
#
# This test define 6 hosts:
#    - www.ansible.com: a host with a DNS setup (external), not present in IPA
#    - no.idontexist.info: a host without DNS and not present in IPA.
#    - svc.ihavenodns.inf: a host without DNS, but present in IPA.
#    - svc_fqdn: a host with DNS and present in IPA.
#    - host1_fqdn and host2_fqdn: used for member actions only.
#
---
- name: Test service
  hosts: ipaserver
  become: yes

  tasks:
  # setup
  - name: Get Domain from server name
    set_fact:
      ipaserver_domain: "{{ groups.ipaserver[0].split('.')[1:] | join ('.') }}"
    when: ipaserver_domain is not defined

  - name: Set host1, host2 and svc hosts fqdn
    set_fact:
      host1_fqdn: "{{ 'host1.' + ipaserver_domain }}"
      host2_fqdn: "{{ 'host2.' + ipaserver_domain }}"
      svc_fqdn: "{{ 'svc.' + ipaserver_domain }}"

  - name: Host absent
    ipahost:
      ipaadmin_password: SomeADMINpassword
      name:
      - www.ansible.com
      - no.idontexist.info
      - svc.ihavenodns.info
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      - "{{ svc_fqdn }}"
      update_dns: no
      state: absent

  - name: Get IPv4 address prefix from server node
    set_fact:
      ipv4_prefix: "{{ ansible_default_ipv4.address.split('.')[:-1] |
                       join('.') }}"

  - name: Add hosts for tests.
    ipahost:
      ipaadmin_password: SomeADMINpassword
      hosts:
          - name: "{{ host1_fqdn }}"
            force: yes
          - name: "{{ host2_fqdn }}"
            force: yes
          - name: "{{ svc_fqdn }}"
            ip_address: "{{ ipv4_prefix + '.201' }}"
          - name: svc.ihavenodns.info
            force: yes

  - name: Ensure testing user user01 is present.
    ipauser:
      ipaadmin_password: SomeADMINpassword
      name: user01
      first: user01
      last: last

  - name: Ensure testing user user02 is present.
    ipauser:
      ipaadmin_password: SomeADMINpassword
      name: user02
      first: user02
      last: last

  - name: Ensure testing group group01 is present.
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      name: group01

  - name: Ensure testing group group02 is present.
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      name: group02

  - name: Ensure testing hostgroup hostgroup01 is present.
    ipahostgroup:
      ipaadmin_password: SomeADMINpassword
      name: hostgroup01

  - name: Ensure testing hostgroup hostgroup02 is present.
    ipahostgroup:
      ipaadmin_password: SomeADMINpassword
      name: hostgroup02

  - name: Ensure services are absent.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name:
      - "HTTP/{{ svc_fqdn }}"
      - HTTP/www.ansible.com
      - HTTP/svc.ihavenodns.info
      - HTTP/no.idontexist.info
      state: absent

  # tests
  - name: Ensure service is present
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      pac_type:
        - MS-PAC
        - PAD
      auth_ind: otp
      skip_host_check: no
      force: yes
      requires_pre_auth: yes
      ok_as_delegate: no
      ok_to_auth_as_delegate: no
    register: result
    failed_when: not result.changed

  - name: Ensure service is present, again
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      pac_type:
        - MS_PAC
        - PAD
      auth_ind: otp
      skip_host_check: no
      force: no
      requires_pre_auth: yes
      ok_as_delegate: no
      ok_to_auth_as_delegate: no
    register: result
    failed_when: result.changed

  - name: Modify service.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      pac_type: NONE
      ok_as_delegate: yes
      ok_to_auth_as_delegate: yes
    register: result
    failed_when: not result.changed

  - name: Modify service, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      pac_type: NONE
      ok_as_delegate: yes
      ok_to_auth_as_delegate: yes
    register: result
    failed_when: result.changed

  - name: Ensure service is present, without host object.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: HTTP/www.ansible.com
      skip_host_check: yes
    register: result
    failed_when: not result.changed

  - name: Ensure service is present, without host object, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: HTTP/www.ansible.com
      skip_host_check: yes
    register: result
    failed_when: result.changed

  - name: Ensure service is present, with host not in DNS.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: HTTP/svc.ihavenodns.info
      skip_host_check: no
      force: yes
    register: result
    failed_when: not result.changed

  - name: Ensure service is present, with host not in DNS, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: HTTP/svc.ihavenodns.info
      skip_host_check: no
      force: yes
    register: result
    failed_when: result.changed

  - name: Ensure service is present, whithout host object and with host not in DNS.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: HTTP/no.idontexist.info
      skip_host_check: yes
      force: yes
    register: result
    failed_when: not result.changed

  - name: Ensure service is present, whithout host object and with host not in DNS, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: HTTP/no.idontexist.info
      skip_host_check: yes
      force: yes
    register: result
    failed_when: result.changed

  - name: Principal host/test.example.com present in service.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      principal:
        - host/test.example.com
      action: member
    register: result
    failed_when: not result.changed

  - name: Principal host/test.example.com present in service, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      principal:
        - host/test.example.com
      action: member
    register: result
    failed_when: result.changed

  - name: Principal host/test.example.com absent in service.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      principal:
        - host/test.example.com
      action: member
      state: absent
    register: result
    failed_when: not result.changed

  - name: Principal host/test.example.com absent in service, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      principal:
        - host/test.example.com
      action: member
      state: absent
    register: result
    failed_when: result.changed

  - name: Ensure host can manage service.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      action: member
    register: result
    failed_when: not result.changed

  - name: Ensure host can manage service, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      host: "{{ host1_fqdn }}"
      action: member
    register: result
    failed_when: result.changed

  - name: Ensure host cannot manage service.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      action: member
      state: absent
    register: result
    failed_when: not result.changed

  - name: Ensure host cannot manage service, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      action: member
      state: absent
    register: result
    failed_when: result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_create_keytab_user:
      - user01
      - user02
      allow_create_keytab_group:
      - group01
      - group02
      allow_create_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_create_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
    register: result
    failed_when: not result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab present for users, groups, hosts and hostgroups, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_create_keytab_user:
      - user01
      - user02
      allow_create_keytab_group:
      - group01
      - group02
      allow_create_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_create_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
    register: result
    failed_when: result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_create_keytab_user:
      - user01
      - user02
      allow_create_keytab_group:
      - group01
      - group02
      allow_create_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_create_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
      state: absent
    register: result
    failed_when: not result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_create_keytab absent for users, groups, hosts and hostgroups, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_create_keytab_user:
      - user01
      - user02
      allow_create_keytab_group:
      - group01
      - group02
      allow_create_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_create_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
      state: absent
    register: result
    failed_when: result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_retrieve_keytab_user:
      - user01
      - user02
      allow_retrieve_keytab_group:
      - group01
      - group02
      allow_retrieve_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_retrieve_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
    register: result
    failed_when: not result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab present for users, groups, hosts and hostgroups, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_retrieve_keytab_user:
      - user01
      - user02
      allow_retrieve_keytab_group:
      - group01
      - group02
      allow_retrieve_keytab_host:
      - "{{ host1_fqdn }}"
      - host02.exampl "{{ groups.ipaserver[0] }}"e.com
      allow_retrieve_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
    register: result
    failed_when: result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_retrieve_keytab_user:
      - user01
      - user02
      allow_retrieve_keytab_group:
      - group01
      - group02
      allow_retrieve_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_retrieve_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
      state: absent
    register: result
    failed_when: not result.changed

  - name: Service "HTTP/{{ svc_fqdn }}" members allow_retrieve_keytab absent for users, groups, hosts and hostgroups, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      allow_retrieve_keytab_user:
      - user01
      - user02
      allow_retrieve_keytab_group:
      - group01
      - group02
      allow_retrieve_keytab_host:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      allow_retrieve_keytab_hostgroup:
      - hostgroup01
      - hostgroup02
      action: member
      state: absent
    register: result
    failed_when: result.changed

  #
  - name: Ensure service is absent
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      state: absent
    register: result
    failed_when: not result.changed

  - name: Ensure service is absent, again
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      state: absent
    register: result
    failed_when: result.changed

  - name: Ensure service is present, with multiple auth_ind values.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      auth_ind: otp,radius
      skip_host_check: no
      force: yes
    register: result
    failed_when: not result.changed

  - name: Ensure service is present, with multiple auth_ind values, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      auth_ind: otp,radius
      skip_host_check: no
      force: yes
    register: result
    failed_when: result.changed

  - name: Clear auth_ind.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      auth_ind: ""
      skip_host_check: no
      force: yes
    register: result
    failed_when: not result.changed

  - name: Clear auth_ind, again.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name: "HTTP/{{ svc_fqdn }}"
      auth_ind: ""
      skip_host_check: no
      force: yes
    register: result
    failed_when: result.changed

  - name: Ensure services are absent.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name:
      - "HTTP/{{ svc_fqdn }}"
      - HTTP/www.ansible.com
      - HTTP/svc.ihavenodns.info
      - HTTP/no.idontexist.local
      continue: yes
      state: absent
    register: result
    failed_when: not result.changed

  - name: Ensure services are absent.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name:
      - "HTTP/{{ svc_fqdn }}"
      - HTTP/www.ansible.com
      - HTTP/svc.ihavenodns.info
      - HTTP/no.idontexist.local
      continue: yes
      state: absent
    register: result
    failed_when: result.changed

  - name: Ensure SMB service is present.
    ipaservice:
      ipaadmin_password: MyPassword123
      name: "{{ host1_fqdn }}"
      smb: yes
      netbiosname: SAMBASVC
    register: result
    failed_when: not result.changed

  - name: Ensure SMB service is again.
    ipaservice:
      ipaadmin_password: MyPassword123
      name: "{{ host1_fqdn }}"
      smb: yes
      netbiosname: SAMBASVC
    register: result
    failed_when: result.changed

  - name: Ensure SMB service is absent.
    ipaservice:
      ipaadmin_password: MyPassword123
      name: "cifs/{{ host1_fqdn }}"
      state: absent
    register: result
    failed_when: not result.changed

  - name: Ensure SMB service is absent, again.
    ipaservice:
      ipaadmin_password: MyPassword123
      name: "cifs/{{ host1_fqdn }}"
      state: absent
    register: result
    failed_when: result.changed

  # cleanup

  - name: Ensure services are absent.
    ipaservice:
      ipaadmin_password: SomeADMINpassword
      name:
      - "HTTP/{{ svc_fqdn }}"
      - HTTP/www.ansible.com
      - HTTP/svc.ihavenodns.info
      - HTTP/no.idontexist.local
      - "cifs/{{ host1_fqdn }}"
      state: absent

  - name: Ensure host "{{ svc_fqdn }}" is absent
    ipahost:
      ipaadmin_password: SomeADMINpassword
      name: "{{ svc_fqdn }}"
      update_dns: yes
      state: absent

  - name: Ensure host is absent
    ipahost:
      ipaadmin_password: SomeADMINpassword
      name:
      - "{{ host1_fqdn }}"
      - "{{ host2_fqdn }}"
      - www.ansible.com
      - svc.ihavenodns.info
      update_dns: no
      state: absent

  - name: Ensure testing users are absent.
    ipauser:
      ipaadmin_password: SomeADMINpassword
      name:
      - user01
      - user02
      state: absent

  - name: Ensure testing groups are absent.
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      name:
      - group01
      - group02
      state: absent

  - name: Ensure testing hostgroup hostgroup01 is absent.
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      name:
      - hostgroup01
      state: absent

  - name: Ensure testing hostgroup hostgroup02 is absent.
    ipagroup:
      ipaadmin_password: SomeADMINpassword
      name:
      - hostgroup02
      state: absent