Bug 1893687

Summary:	[ansible-freeipa] Not able to add additional attributes with existing attributes in permission handling
Product:	Red Hat Enterprise Linux 8	Reporter:	Varun Mylaraiah <mvarun>
Component:	ansible-freeipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.4	CC:	rjeffman, twoerner
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 15:51:22 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Varun Mylaraiah 2020-11-02 11:03:56 UTC

Cloned: https://github.com/freeipa/ansible-freeipa/issues/424



Not able to add additional attributes with existing attributes in Permission handling

[root@master ~]# ipa permission-show 01MyPermission
  Permission name: 01MyPermission
  Granted rights: read
  Effective attributes: audio, cn
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,dc=ipadomain,dc=test
  Type: user
  Permission flags: SYSTEM, V2
- name: Playbook to
  hosts: ipaserver

  tasks:
  - ipapermission:
      ipaadmin_password: <xxxxPasswordxxxxx>
      name: 01MyPermission
      attrs: 
        - carlicense
        - displayname
      action: member
[root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts perm05.yaml
ansible-playbook 2.9.11
  config file = /root/ansible.cfg
  configured module search path = ['/root/ansible-freeipa/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.8/site-packages/ansible
  executable location = /usr/bin/ansible-playbook
  python version = 3.8.5 (default, Aug 12 2020, 00:00:00) [GCC 10.2.1 20200723 (Red Hat 10.2.1-1)]
Using /root/ansible.cfg as config file

PLAYBOOK: perm05.yaml ************************************************************************************************
1 plays in perm05.yaml

PLAY [Playbook to] ***************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************
task path: /root/perm05.yaml:2
[DEPRECATION WARNING]: Distribution fedora 32 on host master.ipadomain.test should use /usr/bin/python3, but is using
 /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will default to 
using the discovered platform python for this host. See 
https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information. This 
feature will be removed in version 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False 
in ansible.cfg.
ok: [master.ipadomain.test]
META: ran handlers

TASK [ipapermission] *************************************************************************************************
task path: /root/perm05.yaml:6
fatal: [master.ipadomain.test]: FAILED! => {"changed": false, "msg": "Argument 'attrs' can not be used with action 'member' and state 'present'"}

PLAY RECAP ***********************************************************************************************************
master.ipadomain.test      : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

Comment 3 Rafael Jeffman 2021-01-08 19:25:27 UTC

Here is the upstream PR: https://github.com/freeipa/ansible-freeipa/pull/484

It has been merged.

Comment 7 Varun Mylaraiah 2021-01-21 11:27:47 UTC

Verified

Version:
ansible-freeipa-0.3.2-1.el8.noarch
ipa-server-4.9.0-1.module+el8.4.0+9274+259c83ee.x86_64

Passed	ansible_freeipa_tests/rbac_module.py::TestPermission::()::test_permission_update_with_additional_attributes

------------------------------ Captured log call -------------------------------
channel.py                1212 DEBUG    [chan 523] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 523] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 523 opened.
transport.py               318 INFO     RUN ['kinit', 'admin']
transport.py               519 DEBUG    RUN ['kinit', 'admin']
channel.py                1212 DEBUG    [chan 523] Sesch channel 523 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    Password for admin: 
channel.py                1212 DEBUG    [chan 523] EOF received (523)
channel.py                1212 DEBUG    [chan 523] EOF sent (523)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 524] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 524] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 524 opened.
transport.py               318 INFO     RUN ['ipa', 'permission-show', '01MytestPermission']
transport.py               519 DEBUG    RUN ['ipa', 'permission-show', '01MytestPermission']
channel.py                1212 DEBUG    [chan 524] Sesch channel 524 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG      Permission name: 01MytestPermission
transport.py               563 DEBUG      Granted rights: search, compare, write, add, delete, all
transport.py               563 DEBUG      Effective attributes: cn
transport.py               563 DEBUG      Bind rule type: permission
transport.py               563 DEBUG      Subtree: cn=users,cn=accounts,dc=ipadomain,dc=test
transport.py               563 DEBUG      Type: user
transport.py               563 DEBUG      Permission flags: SYSTEM, V2
channel.py                1212 DEBUG    [chan 524] EOF received (524)
channel.py                1212 DEBUG    [chan 524] EOF sent (524)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 525] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 525] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 525 opened.
transport.py               318 INFO     RUN ['kdestroy', '-A']
transport.py               519 DEBUG    RUN ['kdestroy', '-A']
channel.py                1212 DEBUG    [chan 525] Sesch channel 525 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
channel.py                1212 DEBUG    [chan 525] EOF received (525)
channel.py                1212 DEBUG    [chan 525] EOF sent (525)
transport.py               217 DEBUG    Exit code: 0
transport.py               293 INFO     WRITE inventory/rbac.hosts
sftp.py                    158 DEBUG    [chan 0] open(b'inventory/rbac.hosts', 'wb')
sftp.py                    158 DEBUG    [chan 0] open(b'inventory/rbac.hosts', 'wb') -> 00000000
sftp.py                    158 DEBUG    [chan 0] close(00000000)
transport.py               329 INFO     PUT rbac_module.yml
sftp.py                    158 DEBUG    [chan 0] open(b'rbac_module.yml', 'wb')
sftp.py                    158 DEBUG    [chan 0] open(b'rbac_module.yml', 'wb') -> 00000000
sftp.py                    158 DEBUG    [chan 0] close(00000000)
sftp.py                    158 DEBUG    [chan 0] stat(b'rbac_module.yml')
channel.py                1212 DEBUG    [chan 103] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 103] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 103 opened.
transport.py               318 INFO     RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/rbac.hosts', 'rbac_module.yml']
transport.py               519 DEBUG    RUN ['ansible-playbook', '--ssh-extra-args="-o StrictHostKeyChecking=no"', '-vv', '-i', 'inventory/rbac.hosts', 'rbac_module.yml']
channel.py                1212 DEBUG    [chan 103] Sesch channel 103 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    ansible-playbook 2.9.17
transport.py               563 DEBUG      config file = /root/ansible.cfg
transport.py               563 DEBUG      configured module search path = ['/root/ansible-freeipa/plugins/modules', '/usr/share/ansible/plugins/modules']
transport.py               563 DEBUG      ansible python module location = /usr/lib/python3.6/site-packages/ansible
transport.py               563 DEBUG      executable location = /usr/bin/ansible-playbook
transport.py               563 DEBUG      python version = 3.6.8 (default, Dec  7 2020, 09:56:35) [GCC 8.4.1 20200928 (Red Hat 8.4.1-1)]
transport.py               563 DEBUG    Using /root/ansible.cfg as config file
transport.py               563 DEBUG    
transport.py               563 DEBUG    PLAYBOOK: rbac_module.yml ******************************************************
transport.py               563 DEBUG    1 plays in rbac_module.yml
transport.py               563 DEBUG    
transport.py               563 DEBUG    PLAY [Playbook to ensure permission is present with new and existing attributes.] ***
transport.py               563 DEBUG    
transport.py               563 DEBUG    TASK [Gathering Facts] *********************************************************
transport.py               563 DEBUG    task path: /root/rbac_module.yml:2
transport.py               563 DEBUG    ok: [master.ipadomain.test]
transport.py               563 DEBUG    META: ran handlers
transport.py               563 DEBUG    
transport.py               563 DEBUG    TASK [ipapermission] ***********************************************************
transport.py               563 DEBUG    task path: /root/rbac_module.yml:6
transport.py               563 DEBUG    changed: [master.ipadomain.test] => {"changed": true}
transport.py               563 DEBUG    META: ran handlers
transport.py               563 DEBUG    META: ran handlers
transport.py               563 DEBUG    
transport.py               563 DEBUG    PLAY RECAP *********************************************************************
transport.py               563 DEBUG    master.ipadomain.test      : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
transport.py               563 DEBUG    
channel.py                1212 DEBUG    [chan 103] EOF received (103)
channel.py                1212 DEBUG    [chan 103] EOF sent (103)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 526] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 526] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 526 opened.
transport.py               318 INFO     RUN ['kinit', 'admin']
transport.py               519 DEBUG    RUN ['kinit', 'admin']
channel.py                1212 DEBUG    [chan 526] Sesch channel 526 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG    Password for admin: 
channel.py                1212 DEBUG    [chan 526] EOF received (526)
channel.py                1212 DEBUG    [chan 526] EOF sent (526)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 527] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 527] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 527 opened.
transport.py               318 INFO     RUN ['ipa', 'permission-show', '01MytestPermission']
transport.py               519 DEBUG    RUN ['ipa', 'permission-show', '01MytestPermission']
channel.py                1212 DEBUG    [chan 527] Sesch channel 527 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
transport.py               563 DEBUG      Permission name: 01MytestPermission
transport.py               563 DEBUG      Granted rights: search, compare, write, add, delete, all
transport.py               563 DEBUG      Effective attributes: carlicense, cn, displayname
transport.py               563 DEBUG      Bind rule type: permission
transport.py               563 DEBUG      Subtree: cn=users,cn=accounts,dc=ipadomain,dc=test
transport.py               563 DEBUG      Type: user
transport.py               563 DEBUG      Permission flags: SYSTEM, V2
channel.py                1212 DEBUG    [chan 527] EOF received (527)
channel.py                1212 DEBUG    [chan 527] EOF sent (527)
transport.py               217 DEBUG    Exit code: 0
channel.py                1212 DEBUG    [chan 528] Max packet in: 32768 bytes
channel.py                1212 DEBUG    [chan 528] Max packet out: 32768 bytes
transport.py              1819 DEBUG    Secsh channel 528 opened.
transport.py               318 INFO     RUN ['kdestroy', '-A']
transport.py               519 DEBUG    RUN ['kdestroy', '-A']
channel.py                1212 DEBUG    [chan 528] Sesch channel 528 request ok
transport.py               563 DEBUG    -bash: line 1: cd: /root/multihost_tests: No such file or directory
transport.py               563 DEBUG    -bash: line 2: /root/multihost_tests/env.sh: No such file or directory
channel.py                1212 DEBUG    [chan 528] EOF received (528)
channel.py                1212 DEBUG    [chan 528] EOF sent (528)
transport.py               217 DEBUG    Exit code: 0

Comment 9 errata-xmlrpc 2021-05-18 15:51:22 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ansible-freeipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2021:1860