tests_basic_ipa.yml

---
- name: Test using IPA to issue certs
  hosts: all
  gather_facts: true
  become: true
  tags:
    - tests::slow
  tasks:
    - name: Check if test is supported
      vars:
        ostree_booted_file: /run/ostree-booted
      block:
        - name: Check if system is ostree
          stat:
            path: "{{ ostree_booted_file }}"
          register: __ostree_booted_stat

        - name: Skip if not supported
          meta: end_host
          when: __ostree_booted_stat.stat.exists

    - name: Setup IPA
      import_tasks: tasks/setup_ipa.yml

    - name: Issue IPA signed certificates
      include_role:
        name: linux-system-roles.certificate
      vars:
        certificate_requests:
          - name: mycert_basic_ipa
            dns: ipaserver.test.local
            principal: HTTP/ipaserver.test.local@TEST.LOCAL
            ca: ipa

          - name: groupcert
            dns: ipaserver.test.local
            principal: HTTP/ipaserver.test.local@TEST.LOCAL
            ca: ipa
            group: ftp

    - name: Verify certificates
      include_tasks: tasks/assert_certificate_parameters.yml
      loop: "{{ certificates }}"
      loop_control:
        loop_var: cert
      vars:
        certificates:
          - path: /etc/pki/tls/certs/mycert_basic_ipa.crt
            key_path: /etc/pki/tls/private/mycert_basic_ipa.key
            subject:
              - name: commonName
                oid: 2.5.4.3
                value: ipaserver.test.local
              - name: organizationName
                oid: 2.5.4.10
                value: TEST.LOCAL
            subject_alt_name:
              - name: DNS
                value: ipaserver.test.local
              - name: Universal Principal Name (UPN)
                oid: 1.3.6.1.4.1.311.20.2.3
                value: HTTP/ipaserver.test.local@TEST.LOCAL
              - name: Kerberos principalname
                oid: 1.3.6.1.5.2.2
                value: HTTP/ipaserver.test.local@TEST.LOCAL
            # IPA CA doesn't respect the requested key_usage (and that's ok)
            key_usage:
              - digital_signature
              - content_commitment
              - key_encipherment
              - data_encipherment

          - path: /etc/pki/tls/certs/groupcert.crt
            key_path: /etc/pki/tls/private/groupcert.key
            owner: root
            group: ftp
            mode: "0640"
            subject:
              - name: commonName
                oid: 2.5.4.3
                value: ipaserver.test.local
              - name: organizationName
                oid: 2.5.4.10
                value: TEST.LOCAL
            subject_alt_name:
              - name: DNS
                value: ipaserver.test.local
              - name: Universal Principal Name (UPN)
                oid: 1.3.6.1.4.1.311.20.2.3
                value: HTTP/ipaserver.test.local@TEST.LOCAL
              - name: Kerberos principalname
                oid: 1.3.6.1.5.2.2
                value: HTTP/ipaserver.test.local@TEST.LOCAL
            key_usage:
              - digital_signature
              - content_commitment
              - key_encipherment
              - data_encipherment