ansible ipa_group failure

[Monkey Bizness]

Hello,

I am working to automate my freeipa configuration (parts of it at
least) and I hit a strange behavior.
I'm not sure if it's a bug or if i'm doing it wrong.

When creating a user group with the ipa_group ansible role (ansible
2.9.5) it works fine if the there are some modifications to perform or
if the group doesn't exist.
But if I run it another time, the task fails with the message  "msg":
"response group_mod: no modifications to be performed"

It looks like the task sends a modification request with nothing to
modify...

I do not see the same behavior for external groups. The tasks does
nothing as expected.

Is it a known issue? Is there a workaround? Am I doing it wrong?

Here is a sample of code that generates the error.
---
- name: Playbook to configure IPA clients with username/password
  hosts: localhost
  become: true

  tasks:
  - name: "Create IPA user group"
    ipa_group:
      cn: "ipagroup"
      external: False
      state: present
      validate_certs: False
      ipa_host: "{{ ipaserver_host }}"
      ipa_user: "{{ ipaadmin_principal }}"
      ipa_pass: "{{ ipaadmin_password }}"
...

Thank you
Monkey

[Rafael Jeffman]

Hello,

There is an open issue about this:
https://github.com/ansible/ansible/issues/25660

You can try ansible-freeipa (https://github.com/freeipa/ansible-freeipa),
that has an idempotent ipagroup module.

Regards,

Rafael

On Wed, Mar 4, 2020 at 9:54 AM Monkey Bizness via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Hello,
>
>  I am working to automate my freeipa configuration (parts of it at least)
>  and I hit a strange behavior.
>  I'm not sure if it's a bug or if i'm doing it wrong.
>
>  When creating a user group with the ipa_group ansible role (ansible 2.9.5)
>  it works fine if the there are some modifications to perform or if the
>  group doesn't exist.
>  But if I run it another time, the task fails with the message "msg":
>  "response group_mod: no modifications to be performed"
>
>  It looks like the task sends a modification request with nothing to
>  modify...
>
>  I do not see the same behavior for external groups. The tasks does nothing
>  as expected.
>
>  Is it a known issue? Is there a workaround? Am I doing it wrong?
>
>  Here is a sample of code that generates the error.
>  ---
>  - name: Playbook to configure IPA clients with username/password
>  hosts: localhost
>  become: true
>
>  tasks:
>  - name: "Create IPA user group"
>  ipa_group:
>  cn: "ipagroup"
>  external: False
>  state: present
>  validate_certs: False
>  ipa_host: "{{ ipaserver_host }}"
>  ipa_user: "{{ ipaadmin_principal }}"
>  ipa_pass: "{{ ipaadmin_password }}"
>  ...
>
>  Thank you
>  Monkey
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  

-- 
Rafael Guterres Jeffman
Senior Software Engineer
FreeIPA - Red Hat

[Monkey Bizness]

Solved it.So it appears that external: False generates the error.If I
omit this parameter, the role works as expected."external" is of type
flag in the documentation. What is the specificity of flag type?
RegardsMonkey
On Fri, 2020-03-06 at 14:45 -0300, Rafael Jeffman via FreeIPA-users
wrote:
>  Hello,
>  
>  There is an open issue about this: 
>  https://github.com/ansible/ansible/issues/25660
>  
>  You can try ansible-freeipa (
>  https://github.com/freeipa/ansible-freeipa), that has an idempotent
>  ipagroup module.
>  
>  Regards,
>  
>  Rafael
>  
>  
>  On Wed, Mar 4, 2020 at 9:54 AM Monkey Bizness via FreeIPA-users <
>  freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>  > Hello,
>  > 
>  > I am working to automate my freeipa configuration (parts of it at
>  > least) and I hit a strange behavior.
>  > I'm not sure if it's a bug or if i'm doing it wrong.
>  > 
>  > When creating a user group with the ipa_group ansible role (ansible
>  > 2.9.5) it works fine if the there are some modifications to perform
>  > or if the group doesn't exist.
>  > But if I run it another time, the task fails with the
>  > message  "msg": "response group_mod: no modifications to be
>  > performed"
>  > 
>  > It looks like the task sends a modification request with nothing to
>  > modify...
>  > 
>  > I do not see the same behavior for external groups. The tasks does
>  > nothing as expected.
>  > 
>  > Is it a known issue? Is there a workaround? Am I doing it wrong?
>  > 
>  > Here is a sample of code that generates the error.
>  > ---
>  > - name: Playbook to configure IPA clients with username/password
>  >   hosts: localhost
>  >   become: true
>  > 
>  >   tasks:
>  >   - name: "Create IPA user group"
>  >     ipa_group:
>  >       cn: "ipagroup"
>  >       external: False
>  >       state: present
>  >       validate_certs: False
>  >       ipa_host: "{{ ipaserver_host }}"
>  >       ipa_user: "{{ ipaadmin_principal }}"
>  >       ipa_pass: "{{ ipaadmin_password }}"
>  > ...
>  > 
>  > Thank you
>  > Monkey
>  > _______________________________________________
>  > 
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > 
>  > To unsubscribe send an email to 
>  > freeipa-users-leave(a)lists.fedorahosted.org
>  > 
>  > Fedora Code of Conduct: 
>  > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  > 
>  > List Guidelines: 
>  > https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > 
>  > List Archives: 
>  > https://lists.fedorahosted.org/archives/list/[e-mail]...
>  > 
>  
>  
>  _______________________________________________FreeIPA-users mailing
>  list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to 
>  freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: 
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedorahosted.org/archives/list/[e-mail]...

[Rafael Jeffman]

A flag is simply a boolean (True/False, Yes/No) value. In this case, it
marks the group as external, which would accept users from trusted domains,
or not.

The error message you were receiving means that you try to modify a group
with the same configuration the group already has. This case, IMHO, should
be handled by the Ansible module.

Oh... as they did here https://github.com/ansible/ansible/pull/26282/files
and just now I realized that while the issue is open, looks like the fix
has already been merged.

Rafael

On Sat, Mar 7, 2020 at 6:23 AM Monkey Bizness via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Solved it.
>  So it appears that external: False generates the error.
>  If I omit this parameter, the role works as expected.
>  "external" is of type flag in the documentation. What is the specificity
>  of flag type?
>
>  Regards
>  Monkey
>
>  On Fri, 2020-03-06 at 14:45 -0300, Rafael Jeffman via FreeIPA-users wrote:
>
>  Hello,
>
>  There is an open issue about this:
>  https://github.com/ansible/ansible/issues/25660
>
>  You can try ansible-freeipa (https://github.com/freeipa/ansible-freeipa),
>  that has an idempotent ipagroup module.
>
>  Regards,
>
>  Rafael
>
>  On Wed, Mar 4, 2020 at 9:54 AM Monkey Bizness via FreeIPA-users <
>  freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>
>  Hello,
>
>  I am working to automate my freeipa configuration (parts of it at least)
>  and I hit a strange behavior.
>  I'm not sure if it's a bug or if i'm doing it wrong.
>
>  When creating a user group with the ipa_group ansible role (ansible 2.9.5)
>  it works fine if the there are some modifications to perform or if the
>  group doesn't exist.
>  But if I run it another time, the task fails with the message "msg":
>  "response group_mod: no modifications to be performed"
>
>  It looks like the task sends a modification request with nothing to
>  modify...
>
>  I do not see the same behavior for external groups. The tasks does nothing
>  as expected.
>
>  Is it a known issue? Is there a workaround? Am I doing it wrong?
>
>  Here is a sample of code that generates the error.
>  ---
>  - name: Playbook to configure IPA clients with username/password
>  hosts: localhost
>  become: true
>
>  tasks:
>  - name: "Create IPA user group"
>  ipa_group:
>  cn: "ipagroup"
>  external: False
>  state: present
>  validate_certs: False
>  ipa_host: "{{ ipaserver_host }}"
>  ipa_user: "{{ ipaadmin_principal }}"
>  ipa_pass: "{{ ipaadmin_password }}"
>  ...
>
>  Thank you
>  Monkey
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>
>
>
>  _______________________________________________
>
>  FreeIPA-users mailing list --
>
>  freeipa-users(a)lists.fedorahosted.org
>
>
>  To unsubscribe send an email to
>
>  freeipa-users-leave(a)lists.fedorahosted.org
>
>
>  Fedora Code of Conduct:
>
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>
>
>  List Guidelines:
>
>  https://fedoraproject.org/wiki/Mailing_list_guidelines
>
>
>  List Archives:
>
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>
>
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  

-- 
Rafael Guterres Jeffman
Senior Software Engineer
FreeIPA - Red Hat

[Thomas Woerner]

Hello,

On 3/7/20 10:21 AM, Monkey Bizness via FreeIPA-users wrote:
>  Solved it. 
that is great.

>  So it appears that external: False generates the error.
>  If I omit this parameter, the role works as expected.
>  "external" is of type flag in the documentation. What is the specificity of 
>  flag type?
>  The type should be bool. We also had type flag in README-group.md in 
ansible-freeipa - I have opened a PR to fix this: 
https://github.com/freeipa/ansible-freeipa/pull/223

>  Regards
>  Monkey
>   
Regards,
Thomas

>  On Fri, 2020-03-06 at 14:45 -0300, Rafael Jeffman via FreeIPA-users
> wrote:
> > Hello,
> >
> > There is an open issue about this: 
> > https://github.com/ansible/ansible/issues/25660
> >
> > You can try ansible-freeipa (https://github.com/freeipa/ansible-freeipa), 
> > that has an idempotent ipagroup module.
> >
> > Regards,
> >
> > Rafael
> >
> > On Wed, Mar 4, 2020 at 9:54 AM Monkey Bizness via FreeIPA-users 
> > <freeipa-users(a)lists.fedorahosted.org 
> > <mailto:[e-mail]>> wrote:
> >> Hello,
> >>
> >> I am working to automate my freeipa configuration (parts of it at least) and 
> >> I hit a strange behavior.
> >> I'm not sure if it's a bug or if i'm doing it wrong.
> >>
> >> When creating a user group with the ipa_group ansible role (ansible 2.9.5) 
> >> it works fine if the there are some modifications to perform or if the group 
> >> doesn't exist.
> >> But if I run it another time, the task fails with the message "msg": 
> >> "response group_mod: no modifications to be performed"
> >>
> >> It looks like the task sends a modification request with nothing to modify...
> >>
> >> I do not see the same behavior for external groups. The tasks does nothing 
> >> as expected.
> >>
> >> Is it a known issue? Is there a workaround? Am I doing it wrong?
> >>
> >> Here is a sample of code that generates the error.
> >> ---
> >> - name: Playbook to configure IPA clients with username/password
> >> hosts: localhost
> >> become: true
> >>
> >> tasks:
> >> - name: "Create IPA user group"
> >> ipa_group:
> >> cn: "ipagroup"
> >> external: False
> >> state: present
> >> validate_certs: False
> >> ipa_host: "{{ ipaserver_host }}"
> >> ipa_user: "{{ ipaadmin_principal }}"
> >> ipa_pass: "{{ ipaadmin_password }}"
> >> ...
> >>
> >> Thank you
> >> Monkey
> >> _______________________________________________
> >> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org 
> >> <mailto:[e-mail]>
> >> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org 
> >> <mailto:[e-mail]>
> >> Fedora Code of Conduct: 
> >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> >> List Archives: 
> >>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
> >
> > _______________________________________________
> > FreeIPA-users mailing list --
> > freeipa-users(a)lists.fedorahosted.org
> >  <mailto:[e-mail]>
> >
> > To unsubscribe send an email to
> > freeipa-users-leave(a)lists.fedorahosted.org
> >  <mailto:[e-mail]>
> >
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> >
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> >
> > List Archives:
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
> >
>  
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>

Thank you for the PR.
Should I open a big on ansible's within for the fact that it fails with external=false
on an existing non external group?
Monkey
---- Message d'origine ----
>  De : Thomas Woerner via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org&gt;
>  À : FreeIPA users list <freeipa-users(a)lists.fedorahosted.org&gt;
>  Sujet : [Freeipa-users] Re: ansible ipa_group failure
>  Date : 09/03/2020 10:34:31 Europe/Brussels
>  Copie à : Monkey Bizness <monkey(a)infra-monkey.com>;
>        Thomas Woerner <twoerner(a)redhat.com&gt;
>  
>  Hello,
>  
>  On 3/7/20 10:21 AM, Monkey Bizness via FreeIPA-users wrote:
>  > Solved it.
>  that is great.
>  
>  > So it appears that external: False generates the error.
>  > If I omit this parameter, the role works as expected.
>  > "external" is of type flag in the documentation. What is the specificity 
>  of 
>  > flag type?
>  > The type should be bool. We also had type flag in README-group.md in 
>  ansible-freeipa - I have opened a PR to fix this: 
>  https://github.com/freeipa/ansible-freeipa/pull/223
>  
>  > Regards
>  > Monkey
>  > 
>  
>  Regards,
>  Thomas
>  
>  > On Fri, 2020-03-06 at 14:45 -0300, Rafael Jeffman via FreeIPA-users 
>  wrote:
>  >> Hello,
>  >>
>  >> There is an open issue about this: 
>  >> https://github.com/ansible/ansible/issues/25660
>  >>
>  >> You can try ansible-freeipa (https://github.com/freeipa/ansible-freeipa), 
>  
>  >> that has an idempotent ipagroup module.
>  >>
>  >> Regards,
>  >>
>  >> Rafael
>  >>
>  >> On Wed, Mar 4, 2020 at 9:54 AM Monkey Bizness via FreeIPA-users 
>  >> <freeipa-users(a)lists.fedorahosted.org 
>  >> <mailto:[e-mail]>> wrote:
>  >>> Hello,
>  >>>
>  >>> I am working to automate my freeipa configuration (parts of it at least) 
>  and 
>  >>> I hit a strange behavior.
>  >>> I'm not sure if it's a bug or if i'm doing it wrong.
>  >>>
>  >>> When creating a user group with the ipa_group ansible role (ansible 
>  2.9.5) 
>  >>> it works fine if the there are some modifications to perform or if the 
>  group 
>  >>> doesn't exist.
>  >>> But if I run it another time, the task fails with the message
> "msg": 
>  >>> "response group_mod: no modifications to be performed"
>  >>>
>  >>> It looks like the task sends a modification request with nothing to 
>  modify...
>  >>>
>  >>> I do not see the same behavior for external groups. The tasks does 
>  nothing 
>  >>> as expected.
>  >>>
>  >>> Is it a known issue? Is there a workaround? Am I doing it wrong?
>  >>>
>  >>> Here is a sample of code that generates the error.
>  >>> ---
>  >>> - name: Playbook to configure IPA clients with username/password
>  >>> hosts: localhost
>  >>> become: true
>  >>>
>  >>> tasks:
>  >>> - name: "Create IPA user group"
>  >>> ipa_group:
>  >>> cn: "ipagroup"
>  >>> external: False
>  >>> state: present
>  >>> validate_certs: False
>  >>> ipa_host: "{{ ipaserver_host }}"
>  >>> ipa_user: "{{ ipaadmin_principal }}"
>  >>> ipa_pass: "{{ ipaadmin_password }}"
>  >>> ...
>  >>>
>  >>> Thank you
>  >>> Monkey
>  >>> _______________________________________________
>  >>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org 
>  >>> <mailto:[e-mail]>
>  >>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.or
>  g 
>  >>> <mailto:[e-mail]>
>  >>> Fedora Code of Conduct: 
>  >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >>> List Archives: 
>  >>> https://lists.fedorahosted.org/archives/list/[e-mail]
>  sted.org
>  >>
>  >>
>  >> _______________________________________________
>  >> FreeIPA-users mailing list --
>  >> freeipa-users(a)lists.fedorahosted.org
>  >>  <mailto:[e-mail]>
>  >>
>  >> To unsubscribe send an email to
>  >> freeipa-users-leave(a)lists.fedorahosted.org
>  >>  <mailto:[e-mail]>
>  >>
>  >> Fedora Code of Conduct:
>  >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >>
>  >> List Guidelines:
>  >> https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >>
>  >> List Archives:
>  >> https://lists.fedorahosted.org/archives/list/[e-mail]
>  ted.org
>  >>
>  > 
>  > _______________________________________________
>  > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org 
>  
>  > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-o
>  f-conduct/
>  > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  > List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@l
>  ists.fedorahosted.org
>  > 
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-
>  conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lis
>  ts.fedorahosted.org
>