
    Vh
.                         d dl mZmZmZ eZdZdZdZd dl	Z	d dl
mZ d dlmZmZ d dlmZ  G d	 d
e      ZddZd Zd Zd Zedk(  r e        yy)    )absolute_importdivisionprint_functiona
  
module: ipa_group
author: Thomas Krahn (@Nosmoht)
short_description: Manage FreeIPA group
description:
  - Add, modify and delete group within IPA server.
attributes:
  check_mode:
    support: full
  diff_mode:
    support: none
options:
  append:
    description:
      - If V(true), add the listed O(user) and O(group) to the group members.
      - If V(false), only the listed O(user) and O(group) will be group members, removing any other members.
    default: false
    type: bool
    version_added: 4.0.0
  cn:
    description:
      - Canonical name.
      - Can not be changed as it is the unique identifier.
    required: true
    aliases: ['name']
    type: str
  description:
    description:
      - Description of the group.
    type: str
  external:
    description:
      - Allow adding external non-IPA members from trusted domains.
    type: bool
  gidnumber:
    description:
      - GID (use this option to set it manually).
    aliases: ['gid']
    type: str
  group:
    description:
      - List of group names assigned to this group.
      - If O(append=false) and an empty list is passed all groups will be removed from this group.
      - Groups that are already assigned but not passed will be removed.
      - If O(append=true) the listed groups will be assigned without removing other groups.
      - If option is omitted assigned groups will not be checked or changed.
    type: list
    elements: str
  nonposix:
    description:
      - Create as a non-POSIX group.
    type: bool
  user:
    description:
      - List of user names assigned to this group.
      - If O(append=false) and an empty list is passed all users will be removed from this group.
      - Users that are already assigned but not passed will be removed.
      - If O(append=true) the listed users will be assigned without removing other users.
      - If option is omitted assigned users will not be checked or changed.
    type: list
    elements: str
  external_user:
    description:
      - List of external users assigned to this group.
      - Behaves identically to O(user) with respect to O(append) attribute.
      - List entries can be in V(DOMAIN\\\\username) or SID format.
      - Unless SIDs are provided, the module will always attempt to make changes even if the group already has all the users.
        This is because only SIDs are returned by IPA query.
      - O(external=true) is needed for this option to work.
    type: list
    elements: str
    version_added: 6.3.0
  state:
    description:
      - State to ensure.
    default: "present"
    choices: ["absent", "present"]
    type: str
extends_documentation_fragment:
  - community.general.ipa.documentation
  - community.general.attributes
ai  
- name: Ensure group is present
  community.general.ipa_group:
    name: oinstall
    gidnumber: '54321'
    state: present
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure that groups sysops and appops are assigned to ops but no other group
  community.general.ipa_group:
    name: ops
    group:
      - sysops
      - appops
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure that users linus and larry are assign to the group, but no other user
  community.general.ipa_group:
    name: sysops
    user:
      - linus
      - larry
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure that new starter named john is member of the group, without removing other members
  community.general.ipa_group:
    name: developers
    user:
      - john
    append: true
    state: present
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Add external user to a group
  community.general.ipa_group:
    name: developers
    external: true
    append: true
    external_user:
      - S-1-5-21-123-1234-12345-63421
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Add a user from MYDOMAIN
  community.general.ipa_group:
    name: developers
    external: true
    append: true
    external_user:
      - MYDOMAIN\\john
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret

- name: Ensure group is absent
  community.general.ipa_group:
    name: sysops
    state: absent
    ipa_host: ipa.example.com
    ipa_user: admin
    ipa_pass: topsecret
zU
group:
  description: Group as returned by IPA API.
  returned: always
  type: dict
N)AnsibleModule)	IPAClientipa_argument_spec)	to_nativec                   f     e Zd Z fdZd Zd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Z xZS )GroupIPAClientc                 2    t         t        |   ||||       y )N)superr   __init__)selfmodulehostportprotocol	__class__s        o/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/general/plugins/modules/ipa_group.pyr   zGroupIPAClient.__init__   s    nd,VT4J    c                 0    | j                  dd d|d      S )N
group_findT)allcnmethodnameitem
_post_jsonr   r   s     r   r   zGroupIPAClient.group_find   s    lDX\D]^^r   c                 *    | j                  d||      S )N	group_addr   r   r   r   r   s      r   r#   zGroupIPAClient.group_add       k4HHr   c                 *    | j                  d||      S )N	group_modr   r   r$   s      r   r'   zGroupIPAClient.group_mod   r%   r   c                 (    | j                  d|      S )N	group_del)r   r   r   r!   s     r   r)   zGroupIPAClient.group_del   s    k==r   c                 *    | j                  d||      S )Ngroup_add_memberr   r   r$   s      r   r+   zGroupIPAClient.group_add_member   s    &8t$OOr   c                 ,    | j                  |d|i      S Ngroupr   r   r+   r$   s      r   group_add_member_groupz%GroupIPAClient.group_add_member_group   s    $$$gt_$EEr   c                 ,    | j                  |d|i      S Nuserr/   r0   r$   s      r   group_add_member_userz$GroupIPAClient.group_add_member_user   s    $$$fd^$DDr   c                 ,    | j                  |d|i      S Nipaexternalmemberr/   r0   r$   s      r   group_add_member_externaluserz,GroupIPAClient.group_add_member_externaluser   s    $$$6I45P$QQr   c                 *    | j                  d||      S )Ngroup_remove_memberr   r   r$   s      r   r;   z"GroupIPAClient.group_remove_member   s    &;$TRRr   c                 ,    | j                  |d|i      S r-   r;   r$   s      r   group_remove_member_groupz(GroupIPAClient.group_remove_member_group   s    ''T$'HHr   c                 ,    | j                  |d|i      S r3   r=   r$   s      r   group_remove_member_userz'GroupIPAClient.group_remove_member_user   s    ''T'GGr   c                 ,    | j                  |d|i      S r7   r=   r$   s      r    group_remove_member_externaluserz/GroupIPAClient.group_remove_member_externaluser   s    ''T9Ld8S'TTr   )__name__
__module____qualname__r   r   r#   r'   r)   r+   r1   r5   r9   r;   r>   r@   rB   __classcell__)r   s   @r   r   r      sP    K_II>PFERSIHUr   r   c                 B    i }| | |d<   |||d<   |||d<   |||d<   |S )Ndescriptionexternal	gidnumbernonposix )rH   rI   gidrK   r.   s        r   get_group_dictrN      sK    E*m$j
 k$jLr   c                     g }d|v r|d   s|j                  d      rd|d<   |d= d|v r|d   rd|j                  d      v r|d= | j                  ||      S )NrK   TposixrI   ipaexternalgroupobjectclass)ipa_datamodule_data)getget_diff)client	ipa_groupmodule_groupdatas       r   get_group_diffr[      sp    D\!J'IMM*,E$(L!$\!
#(:immM>Z(ZZ(??I<?HHr   c                    | j                   d   }| j                   d   }| j                   d   }| j                   d   }| j                   d   }| j                   d   }| j                   d   }t        | j                   d   || j                   d	   | j                   d
         }	|j                  |      }
|s|| j                  d       d}|dk(  rA|
s"d}| j                  sm|j                  ||	      }
nYt        ||
|	      }t        |      dkD  r>d}| j                  s0i }|D ]  }|	j                  |      ||<    |j                  ||       |?|j                  ||
j                  dg       ||j                  |j                  |      xs |}|?|j                  ||
j                  dg       ||j                  |j                  |      xs |}|a|j                  ||
j                  dg       ||j                  |j                   |      xs |}n!|
rd}| j                  s|j#                  |       ||j                  |      fS )Nstater   r.   r4   rI   external_userappendrH   rJ   rK   )rH   rI   rM   rK   )r   z0external_user can only be set if external = TrueFpresentT)r   r   r/   member_group)r_   member_userr8   )paramsrN   r   	fail_json
check_moder#   r[   lenrU   r'   modify_if_diffr1   r>   r5   r@   r9   rB   r)   )r   rW   r]   r   r.   r4   rI   r^   r_   rY   rX   changeddiffrZ   keys                  r   ensurerk      s   MM'"E==DMM'"E== D}}Z(HMM/2M]]8$F!fmmM.J+3&,mmK&@+1==+DFL !!t!,I.KLG	G$$",,T,E	!&)\BD4y1}((D# :$0$4$4S$9S	:$$$T$:++D)--PR2SUZ,2,I,I,2,L,L39 , ; F ?F 
 ++D)--r2RTX,2,H,H,2,K,K39 , ; F ?F 
 $++D)--@SUW2XZg,2,P,P,2,S,S39 , ; F ?F 
 G$$  &F%%4%000r   c                     t               } | j                  t        dddg      t        d      t        d      t        dd      t        dd	g
      t        dd      t        d      t        ddddg      t        dd      t        dd      
       t        | d      }t	        ||j
                  d   |j
                  d   |j
                  d         }	 |j                  |j
                  d   |j
                  d          t        ||      \  }}|j                  ||       y # t        $ r8}|j                  t        |      t        j                                Y d }~y d }~ww xY w)NstrTr   )typerequiredaliases)rn   boollist)rn   elementsrM   )rn   rp   r`   absent)rn   defaultchoicesF)rn   ru   )
r   rH   rI   r^   rJ   r.   rK   r]   r4   r_   )argument_specsupports_check_modeipa_hostipa_portipa_prot)r   r   r   r   ipa_useripa_pass)usernamepassword)rh   r.   )msg	exception)r   updatedictr   r   rc   loginrk   	exit_json	Exceptionrd   r	   	traceback
format_exc)rw   r   rW   rh   r.   es         r   mainr   5  sS   %'MDedVHM%)u%5"&F"3'+%'H#'UUG#D#%@"&F"3#	IW_K`a"? $&% @  	B /3F 6!'z!:!'z!:%+]]:%>@FMfmmJ7$mmJ7 	 	9/6 MYq\Y5I5I5KLLMs   AD+ +	E,4.E''E,__main__)NNNN)
__future__r   r   r   rn   __metaclass__DOCUMENTATIONEXAMPLESRETURNr   ansible.module_utils.basicr   >ansible_collections.community.general.plugins.module_utils.ipar   r   +ansible.module_utils.common.text.convertersr	   r   rN   r[   rk   r   rC   rL   r   r   <module>r      st    A @QfFP
  4 g A&UY &UR
I 91xM< zF r   