Bug 1893678

Summary:	[ansible-freeipa] Not able to add additional privileges with existing privilege in role module
Product:	Red Hat Enterprise Linux 8	Reporter:	Varun Mylaraiah <mvarun>
Component:	ansible-freeipa	Assignee:	Rafael Jeffman <rjeffman>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.4	CC:	rjeffman, twoerner
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	x86_64
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 15:51:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Varun Mylaraiah 2020-11-02 10:53:36 UTC

Cloned: https://github.com/freeipa/ansible-freeipa/issues/409


Not able to add additional privileges with existing privilege.

[root@master ~]# ipa role-show newrole
  Role name: newrole
  Privileges: Automember Readers, ADTrust Agents

[root@ansible ~]# cat newrole.yaml
---
- name: "Update an existing role with the additional privileges"
  hosts: ipaserver

  tasks:
  - iparole:
      ipaadmin_password: <password>
      name: newrole
      privilege: 
        - DNS Servers
        - Host Administrators
        - DNS Administrators
        - Group Administrators
      action: member

[root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts newrole.yaml 
ansible-playbook 2.9.11
  config file = /root/ansible.cfg
  configured module search path = ['/root/ansible-freeipa/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.8/site-packages/ansible
  executable location = /usr/bin/ansible-playbook
  python version = 3.8.5 (default, Aug 12 2020, 00:00:00) [GCC 10.2.1 20200723 (Red Hat 10.2.1-1)]
Using /root/ansible.cfg as config file

PLAYBOOK: newrole.yaml ***********************************************************************************************
1 plays in newrole.yaml

PLAY [9.Update an existing role with the additional privilege] *******************************************************

TASK [Gathering Facts] ***********************************************************************************************
task path: /root/newrole.yaml:2
[DEPRECATION WARNING]: Distribution fedora 32 on host master.ipadomain.test should use /usr/bin/python3, but is using
 /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will default to 
using the discovered platform python for this host. See 
https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information. This 
feature will be removed in version 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False 
in ansible.cfg.
ok: [master.ipadomain.test]
META: ran handlers

TASK [iparole] *******************************************************************************************************
task path: /root/newrole.yaml:6
changed: [master.ipadomain.test] => {"changed": true}
META: ran handlers
META: ran handlers

PLAY RECAP ***********************************************************************************************************
master.ipadomain.test      : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0 
[root@master ~]# ipa role-show newrole
  Role name: newrole
  Privileges: Group Administrators, Host Administrators, DNS Administrators, DNS Servers
CLI Console output

[root@master ~]# ipa role-add-privilege newrole --privileges="User Administrators"
  Role name: newrole
  Privileges: User Administrators, Group Administrators, Host Administrators, DNS Administrators, DNS Servers
----------------------------
Number of privileges added 1
----------------------------

Comment 1 Varun Mylaraiah 2020-11-10 12:59:59 UTC

*** Bug 1893682 has been marked as a duplicate of this bug. ***

Comment 3 Rafael Jeffman 2020-12-15 17:46:18 UTC

There is an upstream patch for this issue: https://github.com/freeipa/ansible-freeipa/pull/469

Comment 5 Rafael Jeffman 2021-01-07 14:19:26 UTC

Upstream PR was merged.

Comment 9 Varun Mylaraiah 2021-01-21 11:13:21 UTC

Verified

Version:
ansible-freeipa-0.3.2-1.el8.noarch
ipa-server-4.9.0-1.module+el8.4.0+9274+259c83ee.x86_64

Passed	ansible_freeipa_tests/rbac_module.py::TestRole::()::test_role_update_with_additional_privileges
------------------------------ Captured log call -------------------------------
channel.py                1212 DEBUG    [chan 236] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 236] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 236 opened.
transport.py               318 INFO     RUN ['kinit', 'admin']
transport.py               519 DEBUG    RUN ['kinit', 'admin']
channel.py                1212 DEBUG    [chan 236] Sesch channel 236 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    Password for admin: 
channel.py                1212 DEBUG    [chan 236] EOF received (236)
channel.py                1212 DEBUG    [chan 236] EOF sent (236)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 237] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 237] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 237 opened.
transport.py               318 INFO     RUN ['ipa', 'role-show', 'Admin-role']
transport.py               519 DEBUG    RUN ['ipa', 'role-show', 'Admin-role']
channel.py                1212 DEBUG    [chan 237] Sesch channel 237 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG      Role name: Admin-role
transport.py               563 DEBUG      Description: test role in IPA.
transport.py               563 DEBUG      Privileges: Group Administrators
channel.py                1212 DEBUG    [chan 237] EOF received (237)
channel.py                1212 DEBUG    [chan 237] EOF sent (237)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 238] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 238] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 238 opened.
transport.py               318 INFO     RUN ['kdestroy', '-A']
transport.py               519 DEBUG    RUN ['kdestroy', '-A']
channel.py                1212 DEBUG    [chan 238] Sesch channel 238 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
channel.py                1212 DEBUG    [chan 238] EOF received (238)
channel.py                1212 DEBUG    [chan 238] EOF sent (238)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 239] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 239] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 239 opened.
transport.py               318 INFO     RUN ['kinit', 'admin']
transport.py               519 DEBUG    RUN ['kinit', 'admin']
channel.py                1212 DEBUG    [chan 239] Sesch channel 239 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    Password for admin: 
channel.py                1212 DEBUG    [chan 239] EOF received (239)
channel.py                1212 DEBUG    [chan 239] EOF sent (239)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 240] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 240] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 240 opened.
transport.py               318 INFO     RUN ['ipa', 'role-show', 'Admin-role']
transport.py               519 DEBUG    RUN ['ipa', 'role-show', 'Admin-role']
channel.py                1212 DEBUG    [chan 240] Sesch channel 240 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG      Role name: Admin-role
transport.py               563 DEBUG      Description: test role in IPA.
transport.py               563 DEBUG      Privileges: Group Administrators
channel.py                1212 DEBUG    [chan 240] EOF received (240)
channel.py                1212 DEBUG    [chan 240] EOF sent (240)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 241] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 241] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 241 opened.
transport.py               318 INFO     RUN ['kdestroy', '-A']
transport.py               519 DEBUG    RUN ['kdestroy', '-A']
channel.py                1212 DEBUG    [chan 241] Sesch channel 241 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
channel.py                1212 DEBUG    [chan 241] EOF received (241)
channel.py                1212 DEBUG    [chan 241] EOF sent (241)
transport.py               217 DEBUG    Exit code: 0
transport.py               293 INFO     WRITE inventory/rbac.hosts
sftp.py                    158 DEBUG    [chan 0] open(b'inventory/rbac.hosts', 'wb')
sftp.py                    158 DEBUG    [chan 0] open(b'inventory/rbac.hosts', 'wb') -> 00000000
sftp.py                    158 DEBUG    [chan 0] close(00000000)
transport.py               329 INFO     PUT rbac_module.yml
sftp.py                    158 DEBUG    [chan 0] open(b'rbac_module.yml', 'wb')
sftp.py                    158 DEBUG    [chan 0] open(b'rbac_module.yml', 'wb') -> 00000000
sftp.py                    158 DEBUG    [chan 0] close(00000000)
sftp.py                    158 DEBUG    [chan 0] stat(b'rbac_module.yml')
channel.py                1212 DEBUG    [chan 55] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 55] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 55 opened.
transport.py               318 INFO     RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/rbac.hosts', 'rbac_module.yml']
transport.py               519 DEBUG    RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/rbac.hosts', 'rbac_module.yml']
channel.py                1212 DEBUG    [chan 55] Sesch channel 55 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    ansible-playbook 2.9.17
transport.py               563 DEBUG      config file = /root/ansible.cfg
transport.py               563 DEBUG      configured module search path = ['/root/ansible-freeipa/plugins/modules', '/usr/share/ansible/plugins/modules']
transport.py               563 DEBUG      ansible python module location = /usr/lib/python3.6/site-packages/ansible
transport.py               563 DEBUG      executable location = /usr/bin/ansible-playbook
transport.py               563 DEBUG      python version = 3.6.8 (default, Dec  7 2020, 09:56:35) [GCC 8.4.1 20200928 (Red Hat 8.4.1-1)]
transport.py               563 DEBUG    Using /root/ansible.cfg as config file
transport.py               563 DEBUG    
transport.py               563 DEBUG    PLAYBOOK: rbac_module.yml ******************************************************
transport.py               563 DEBUG    1 plays in rbac_module.yml
transport.py               563 DEBUG    
transport.py               563 DEBUG    PLAY [Playbook to ensure role is present with the additional privilege.] *******
transport.py               563 DEBUG    
transport.py               563 DEBUG    TASK [Gathering Facts] *********************************************************
transport.py               563 DEBUG    task path: /root/rbac_module.yml:2
transport.py               563 DEBUG    ok: [master.ipadomain.test]
transport.py               563 DEBUG    META: ran handlers
transport.py               563 DEBUG    
transport.py               563 DEBUG    TASK [iparole] *****************************************************************
transport.py               563 DEBUG    task path: /root/rbac_module.yml:6
transport.py               563 DEBUG    changed: [master.ipadomain.test] => {"changed": true}
transport.py               563 DEBUG    META: ran handlers
transport.py               563 DEBUG    META: ran handlers
transport.py               563 DEBUG    
transport.py               563 DEBUG    PLAY RECAP *********************************************************************
transport.py               563 DEBUG    master.ipadomain.test      : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
transport.py               563 DEBUG    
channel.py                1212 DEBUG    [chan 55] EOF received (55)
channel.py                1212 DEBUG    [chan 55] EOF sent (55)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 242] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 242] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 242 opened.
transport.py               318 INFO     RUN ['kinit', 'admin']
transport.py               519 DEBUG    RUN ['kinit', 'admin']
channel.py                1212 DEBUG    [chan 242] Sesch channel 242 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    Password for admin: 
channel.py                1212 DEBUG    [chan 242] EOF received (242)
channel.py                1212 DEBUG    [chan 242] EOF sent (242)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 243] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 243] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 243 opened.
transport.py               318 INFO     RUN ['ipa', 'role-show', 'Admin-role']
transport.py               519 DEBUG    RUN ['ipa', 'role-show', 'Admin-role']
channel.py                1212 DEBUG    [chan 243] Sesch channel 243 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG      Role name: Admin-role
transport.py               563 DEBUG      Description: test role in IPA.
transport.py               563 DEBUG      Privileges: Group Administrators, Host Administrators, DNS Administrators, DNS Servers
channel.py                1212 DEBUG    [chan 243] EOF received (243)
channel.py                1212 DEBUG    [chan 243] EOF sent (243)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 244] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 244] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 244 opened.
transport.py               318 INFO     RUN ['kdestroy', '-A']
transport.py               519 DEBUG    RUN ['kdestroy', '-A']
channel.py                1212 DEBUG    [chan 244] Sesch channel 244 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
channel.py                1212 DEBUG    [chan 244] EOF received (244)
channel.py                1212 DEBUG    [chan 244] EOF sent (244)
transport.py               217 DEBUG    Exit code: 0

Comment 11 errata-xmlrpc 2021-05-18 15:51:22 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ansible-freeipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2021:1860