ipagroup: Fix management of AD objects

[rjeffman]

When using AD objects, a user expects to use the more human readable
form, like "[email protected]", but this impose some dificulties on
evaluating which object is being referenced as AD has several forms to
refer to the same object.

Each object is AD is identified uniquely by its SID, and this is the
identifier that IPA stores in its database. When managing AD objects,
IPA finds its SID and works with that value.

ansible-freeipa tried to process these objects using the human readable
values, and it cause idempontence error when ensuring the values were
present or modified, and, at least in some cases, prevented the objects
to be made absent, as the object list created didn't match the SID to
the value used as module parameter.

By using SID to process the AD objects in ipagroup, the addition or
removal of members works and idempotence of these members is ensured.

The only issue with thils approach is that it only works no server
nodes. In client nodes, the conversion to SID is not available and the
same issues that existed before will still be present.

Tests were updated to reflect these changes, a new test, specific to
idempotence issues of AD objects was added:

tests/group/test_group_ad_users.yml

Resolves: https://issues.redhat.com/browse/RHEL-70023

For information on some changes required to finish or test this changes, please, refer to the specific commits.

[varunmylaraiah]

Fix is working fine.

[root@master ~]# ipa group-show external-group1
  Group name: external-group1
  External member: [email protected], [email protected]

[root@ansible ~]# cat external_group_remove.yaml
---
- name: Playbook to ensure external member is absent from the external group(external-group1)
 hosts: ipaserver
 become: true
 tasks:
 - ipagroup:
     ipaadmin_password: <xxxxxxxxx>
     name: external-group1
     action: member
     externalmember: 
       - [email protected]
       - [email protected]
     state: absent

PLAY [Playbook to ensure external member is absent from the external group(external-group1)] **************************************************************************************

TASK [Gathering Facts] ************************************************************************************************************************************************************
task path: /root/external_group_remove.yaml:2
ok: [master.ipadomain.test]

TASK [ipagroup] *******************************************************************************************************************************************************************
task path: /root/external_group_remove.yaml:6
changed: [master.ipadomain.test] => {"changed": true}

PLAY RECAP ************************************************************************************************************************************************************************
master.ipadomain.test      : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[root@master ~]# ipa group-show external-group1
  Group name: external-group1
  External member: [email protected]

[rjeffman]

@varunmylaraiah in this example shouldn't both the members should have been excluded?

[varunmylaraiah]

@rjeffman

[root@master ~]# ipa group-show external-group1
  Group name: external-group1
  External member: [email protected], [email protected]
  Member groups: testgroup
  Membership managed by groups: gmm_group01
  Membership managed by users: gmm_user01

[root@ansible ~]# cat external_group_remove.yaml
---
- name: Playbook to ensure external member is absent from the external group(external-group1)
  hosts: ipaserver
  become: true
  tasks:
  - ipagroup:
      ipaadmin_password: <xxxxxxxx>
      name: external-group1
      action: member
      externalmember: 
        - [email protected]
      state: absent

PLAY [Playbook to ensure external member is absent from the external group(external-group1)] **************************************************************************************

TASK [Gathering Facts] ************************************************************************************************************************************************************
task path: /root/external_group_remove.yaml:2
ok: [master.ipadomain.test]

TASK [ipagroup] *******************************************************************************************************************************************************************
task path: /root/external_group_remove.yaml:6
changed: [master.ipadomain.test] => {"changed": true}

PLAY RECAP ************************************************************************************************************************************************************************
master.ipadomain.test      : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[root@master ~]# ipa group-show external-group1
  Group name: external-group1
  External member: [email protected]
  Member groups: testgroup
  Membership managed by groups: gmm_group01
  Membership managed by users: gmm_user01

[t-woerner]

Please add a failure in case of external_member usage with client context. Please also add this to the docs (README and documentation sections in the module).

[rjeffman]

Added the test to fail in case externalmember or idoverrideuser are used without ipa_context: server.

@t-woerner, please, review de documentation.