11 changed files with 356 additions and 375 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,39 @@
-SOURCES/ansible-freeipa-1.12.1.tar.gz
+/ansible-freeipa-0.1.1.tar.gz
+/ansible-freeipa-0.1.5.tar.gz
+/ansible-freeipa-0.1.6.tar.gz
+/ansible-freeipa-0.1.8.tar.gz
+/ansible-freeipa-0.1.9.tar.gz
+/ansible-freeipa-0.1.10.tar.gz
+/ansible-freeipa-0.1.11.tar.gz
+/ansible-freeipa-0.1.12.tar.gz
+/ansible-freeipa-0.2.1.tar.gz
+/ansible-freeipa-0.3.0.tar.gz
+/ansible-freeipa-0.3.1.tar.gz
+/ansible-freeipa-0.3.4.tar.gz
+/ansible-freeipa-0.3.5.tar.gz
+/ansible-freeipa-0.3.6.tar.gz
+/ansible-freeipa-0.3.8.tar.gz
+/ansible-freeipa-0.4.0.tar.gz
+/ansible-freeipa-1.5.0.tar.gz
+/ansible-freeipa-1.5.3.tar.gz
+/ansible-freeipa-1.6.2.tar.gz
+/ansible-freeipa-1.7.0.tar.gz
+/ansible-freeipa-1.8.0.tar.gz
+/ansible-freeipa-1.8.1.tar.gz
+/ansible-freeipa-1.8.2.tar.gz
+/ansible-freeipa-1.8.3.tar.gz
+/ansible-freeipa-1.8.4.tar.gz
+/ansible-freeipa-1.9.0.tar.gz
+/ansible-freeipa-1.9.1.tar.gz
+/ansible-freeipa-1.9.2.tar.gz
+/ansible-freeipa-1.10.0.tar.gz
+/ansible-freeipa-1.11.0.tar.gz
+/ansible-freeipa-1.11.1.tar.gz
+/ansible-freeipa-1.12.0.tar.gz
+/ansible-freeipa-1.12.1.tar.gz
+/ansible-freeipa-1.14.0.tar.gz
+/ansible-freeipa-1.14.1.tar.gz
+/ansible-freeipa-1.14.2.tar.gz
+/ansible-freeipa-1.14.3.tar.gz
+/ansible-freeipa-1.14.4.tar.gz
+/ansible-freeipa-1.14.5.tar.gz
--- a/README.md
+++ b/README.md
@ -0,0 +1,3 @@
+# ansible-freeipa
+
+The ansible-freeipa package
--- a/SPECS/ansible-freeipa.spec
+++ b/SPECS/ansible-freeipa.spec
@ -5,14 +5,23 @@

 %global python %{__python3}

+%global collection_namespace freeipa
+%global collection_name ansible_freeipa
+%global ansible_collections_dir %{_datadir}/ansible/collections/ansible_collections
+
 Summary: Roles and playbooks to deploy FreeIPA servers, replicas and clients
 Name: ansible-freeipa
-Version: 1.12.1
+Version: 1.14.5
 Release: 1%{?dist}
 URL: https://github.com/freeipa/ansible-freeipa
 License: GPL-3.0-or-later
 Source: https://github.com/freeipa/ansible-freeipa/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
 BuildArch: noarch
+%if 0%{?fedora} >= 35 || 0%{?rhel} >= 9
+Requires: ansible-core >= 1:2.14.0
+%endif
+BuildRequires: ansible-core >= 1:2.14.0
+BuildRequires: python

 %description
 Ansible roles to install and uninstall FreeIPA servers, replicas and clients,
@ -31,6 +40,7 @@ Features
 - Repair mode for clients
 - Backup and restore, also to and from controller
 - Smartcard setup for servers and clients
+- Inventory plugin freeipa
 - Modules for automembership rule management
 - Modules for automount key management
 - Modules for automount location management
@ -90,7 +100,7 @@ Supported Distributions
 Requirements

  Controller
-  - Ansible version: 2.13+
+  - Ansible version: 2.14+

  Node
  - Supported FreeIPA version (see above)
@ -115,10 +125,17 @@ Please have a look at %{_datadir}/ansible-freeipa/requirements-tests.txt
 to get the needed requrements to run the tests.


+%package collection
+Summary: %{collection_namespace}.%{collection_name} collection
+Provides: ansible-collection-%{collection_namespace}-%{collection_name} = %{version}-%{release}
+
+%description collection
+The %{collection_namespace}.%{collection_name} collection, including tests.
+
+
 %prep
 %setup -q
 # Do not create backup files with patches
-
 # Fix python modules and module utils:
 # - Remove shebang
 # - Remove execute flag
@ -161,6 +178,11 @@ cp -rp utils %{buildroot}%{_datadir}/ansible-freeipa/
 install -m 755 -d %{buildroot}%{_datadir}/ansible-freeipa/tests
 cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/

+# Create collection and install to %{buildroot}%{ansible_collections_dir}
+# ansible-galaxy collection install creates ansible_collections directory
+# automatically in given path, therefore /..
+utils/build-galaxy-release.sh -o "%{version}" -p %{buildroot}%{ansible_collections_dir}/.. %{collection_namespace} %{collection_name}
+
 %files
 %license COPYING
 %{_datadir}/ansible/roles/ipaserver
@ -172,6 +194,7 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
 %{_datadir}/ansible/plugins/doc_fragments
 %{_datadir}/ansible/plugins/module_utils
 %{_datadir}/ansible/plugins/modules
+%{_datadir}/ansible/plugins/inventory
 %doc README*.md
 %doc playbooks
 %{_datadir}/ansible-freeipa/requirements.txt
@ -182,220 +205,287 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
 %{_datadir}/ansible-freeipa/tests
 %{_datadir}/ansible-freeipa/requirements-tests.txt

+%files collection
+%dir %{ansible_collections_dir}/%{collection_namespace}
+%{ansible_collections_dir}/%{collection_namespace}/%{collection_name}
+
 %changelog
+* Tue Feb 11 2025 Thomas Woerner <twoerner@redhat.com> - 1.14.5-1
+- Update to version 1.14.5
+  Resolves: RHEL-67566
+- ipa* deployment roles: Hotfix for dns_over_tls (Freeipa#7343)
+  Resolves: RHEL-78230
+
+* Tue Feb  4 2025 Thomas Woerner <twoerner@redhat.com> - 1.14.4-1
+- Update to version 1.14.4
+  Resolves: RHEL-67566
+- Fix management of AD objects for ipagroup
+  Resolves: RHEL-25009
+
+* Mon Feb  3 2025 Thomas Woerner <twoerner@redhat.com> - 1.14.3-1
+- Update to version 1.14.3
+  Resolves: RHEL-67566
+- Fix management of AD objects for ipagroup
+  Resolves: RHEL-25009
+
+* Fri Dec 13 2024 Thomas Woerner <twoerner@redhat.com> - 1.14.2-1
+- Update to version 1.14.2
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.14.2
+  Resolves: RHEL-67566
+- ipareplica: Pass ipareplica_ip_addresses to ipaclient
+  Resolves: RHEL-40227
+- ipagroup: Correctly handle externalmember in member actions
+  Resolves: RHEL-25009
+- ipasudorule: Evaluate all members related to hosts and users
+  Resolves: RHEL-68439
+- ipacert: Correctly handle removFromCRL revocation
+  Resolves: RHEL-70016
+- Collection: No more role module duplication
+  Resolves: RHEL-71123
+
+* Wed Nov 27 2024 Thomas Woerner <twoerner@redhat.com> - 1.14.1-1
+- Update to version 1.14.1
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.14.1
+  Resolves: RHEL-67566
+- Fix requirements for ansible-core
+  Resolves: RHEL-69146
+
+* Fri Nov 22 2024 Thomas Woerner <twoerner@redhat.com> - 1.14.0-1
+- Update to version 1.14.0
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.14.0
+  Resolves: RHEL-67566
+- Multi sudorule management with the ipasudorule module
+  Resolves: RHEL-61431
+
+* Mon Jul  1 2024 Thomas Woerner <twoerner@redhat.com> - 1.13.2-1
+- Update to version 1.13.2
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.2
+  Resolves: RHEL-35565
+- Convert input certificates
+  Resolves: RHEL-44614
+- Fix rolesdeployment with IPA 4.12
+  Resolves: RHEL-40869
+
+* Tue May 28 2024 Thomas Woerner <twoerner@redhat.com> - 1.13.1-1
+- Update to version 1.13.1
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.0
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.1
+  Resolves: RHEL-35565
+- New inventory plugin
+  Resolves: RHEL-35541
+- Enable batch command as backend
+  Resolves: RHEL-38943
+- New collection sub package
+  Resolves: RHEL-38931
+
 * Mon Feb 12 2024 Thomas Woerner <twoerner@redhat.com> - 1.12.1-1
 - Update to version 1.12.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.12.1
-  Resolves: RHEL-13746
+  Resolves: RHEL-13744
 - ipauser module lacks the "rename" field.
-  Resolves: RHEL-4963
+  Resolves: RHEL-4962
 - Add missing support for rename in ipagroup module
-  Resolves: RHEL-13759
+  Resolves: RHEL-13758
 - The IDP module does not support the modification of IDP options
-  Resolves: RHEL-17955
+  Resolves: RHEL-17954
 - The IDP module does not support resetting IDP options
-  Resolves: RHEL-17958
+  Resolves: RHEL-17957
 - ipauser is not idempotent when random is defined
-  Resolves: RHEL-4934
+  Resolves: RHEL-19123
 - ipasudorule: Allow setting groups for runasuser
-  Resolves: RHEL-19129
+  Resolves: RHEL-19130
 - Idempotency fixes
-  Resolves: RHEL-13755
+  Resolves: RHEL-19132
 - ipadnszone: Add support for per-zone privilege delegation
-  Resolves: RHEL-19133
+  Resolves: RHEL-19134
 - Handle data type or empty string in module_utils
-  Resolves: RHEL-19135
- ipa-server installation failing
-  Resolves: RHEL-23633
+  Resolves: RHEL-19136

 * Tue Nov 28 2023 Thomas Woerner <twoerner@redhat.com> - 1.12.0-2
 - Fix test_pwpolicy for https://pagure.io/freeipa/issue/9297
-  Related: RHEL-13746
+  Related: RHEL-13744

 * Mon Nov 27 2023 Thomas Woerner <twoerner@redhat.com> - 1.12.0-1
 - Update to version 1.12.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.12.0
-  Resolves: RHEL-13746
+  Resolves: RHEL-13744
 - New idoverridegroup management module.
-  Resolves: RHEL-16935
+  Resolves: RHEL-16937
 - New idoverrideuser management module.
-  Resolves: RHEL-16941
+  Resolves: RHEL-16942
 - New idview management module.
-  Resolves: RHEL-16933
+  Resolves: RHEL-16934
 - New idp management module.
-  Resolves: RHEL-16938
+  Resolves: RHEL-16939
 - idoverride{user,group}: Fix delete_continue with state absent
-  Resolves: RHEL-16682
+  Resolves: RHEL-16680

 * Mon Jul 24 2023 Thomas Woerner <twoerner@redhat.com> - 1.11.1-1
 - Update to version 1.11.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.11.1
-  Resolves: RHBZ#2170371
+  Resolves: RHBZ#2170373
 - ipaautomountmap: add support for indirect maps
-  Resolves: RHBZ#2050158
+  Resolves: RHBZ#2050176
 - ipauser: Add support to modify GECOS field
-  Resolves: RHBZ#2168022
+  Resolves: RHBZ#2169372
 - ipauser: Add support for parameter "street"
-  Resolves: RHBZ#2215532
+  Resolves: RHBZ#2215531
 - ipauser: Add support for SMB attributes
-  Resolves: RHBZ#2215534
+  Resolves: RHBZ#2215533
 - ipauser: Support for External IdP attributes
-  Resolves: RHBZ#2215539
+  Resolves: RHBZ#2215536
 - Fix handling of ipapwpolicy attributes usercheck and dictcheck
-  Resolves: RHBZ#2215543
+  Resolves: RHBZ#2215542
 - Update authtypes authind
-  Resolves: RHBZ#2215540
+  Resolves: RHBZ#2215538

 * Mon Jun 12 2023 Thomas Woerner <twoerner@redhat.com> - 1.11.0-1
 - Update to version 1.11.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.11.0
-  Resolves: RHBZ#2170371
+  Resolves: RHBZ#2170373
 - Multiple service management
-  Resolves: RHBZ#2175769
+  Resolves: RHBZ#2175771
 - New ipacert module
-  Resolves: RHBZ#2127906
+  Resolves: RHBZ#2127907
 - Fix maxsequence handling in ipapwpolicy module
-  Resolves: RHBZ#2214295
+  Resolves: RHBZ#2214294

 * Wed Apr  5 2023 Thomas Woerner <twoerner@redhat.com> - 1.10.0-1
 - Update to version 1.10.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.10.0
-  Resolves: RHBZ#2170371
+  Resolves: RHBZ#2170373
 - ipareplica/server: Enable removal from domain with undeployment
-  Resolves: RHBZ#2127901
+  Resolves: RHBZ#2127903
 - ipagroup: Allow multiple group management
-  Resolves: RHBZ#2175762
+  Resolves: RHBZ#2175763
 - ipaserver: Allow deployments with random serial numbers
-  Resolves: RHBZ#2127904
+  Resolves: RHBZ#2127905
 - ipagroup: Fix ensuring external group members (without trust-ad)
-  Resolves: RHBZ#2183820
+  Resolves: RHBZ#2183822
 - ipaclient: Add subid option to select the sssd profile with-subid
-  Resolves: RHBZ#2175766
+  Resolves: RHBZ#2175767
 - ipaclient: Fix allow_repair with removed krb5.conf and DNS lookup
-  Resolves: RHBZ#1759785
+  Resolves: RHBZ#2127883
 - ipaclient: Keep server affinity while deploying as long as possible
-  Resolves: RHBZ#2175755
+  Resolves: RHBZ#2175757

 * Tue Jan 31 2023 Thomas Woerner <twoerner@redhat.com> - 1.9.2-1
 - Update to version 1.9.2
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.2
-  Resolves: RHBZ#2125591
+  Resolves: RHBZ#2125592
 - ipabackup: Use ipabackup_item again in copy_backup_to_server
-  Resolves: RHBZ#2165951
+  Resolves: RHBZ#2165953

 * Mon Jan 30 2023 Thomas Woerner <twoerner@redhat.com> - 1.9.1-1
 - Update to version 1.9.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.1
-  Resolves: RHBZ#2125591
+  Resolves: RHBZ#2125592
 - pwpolicy: Allow clearing policy values
-  Resolves: RHBZ#2150332
+  Resolves: RHBZ#2150334
 - Use netgroup_find instead of netgroup_show to workaround IPA bug
-  Resolves: RHBZ#2144724
+  Resolves: RHBZ#2144725

 * Wed Dec  7 2022 Thomas Woerner <twoerner@redhat.com> - 1.9.0-1
 - Update to version 1.9.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.9.0
-  Related: RHBZ#2125591
+  Related: RHBZ#2125592
 - pwpolicy: Add support for password check and grace limit
-  Resolves: RHBZ#2015288
+  Resolves: RHBZ#2127911
 - ipaconfig: Do not allow enable_sid set to False
-  Resolves: RHBZ#2127447
+  Resolves: RHBZ#2127446
 - ipaclient: No kinit on controller for deployment using OTP
-  Resolves: RHBZ#2127885
+  Resolves: RHBZ#2127887
 - ipaclient: Configure DNS resolver
-  Resolves: RHBZ#2127894
+  Resolves: RHBZ#2127895
 - New netgroup management module
-  Resolves: RHBZ#2127908
+  Resolves: RHBZ#2127910
 - sudorule: Add support for 'hostmask' parameter
-  Resolves: RHBZ#2127912
+  Resolves: RHBZ#2127913
 - ipaconfig: Fix fail_json calls
-  Resolves: RHBZ#2128460
+  Resolves: RHBZ#2134375
 - ipaconfig: Do not require enable_sid for add_sids or netbios_name
-  Resolves: RHBZ#2134530
+  Resolves: RHBZ#2134505
 - ipaserver: Add missing idstart check
-  Resolves: RHBZ#2132729
+  Resolves: RHBZ#2132731

 * Mon Sep 12 2022 Thomas Woerner <twoerner@redhat.com> - 1.8.4-1
 - Update to version 1.8.4
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.4
-  Resolves: RHBZ#2125591
+  Resolves: RHBZ#2125592
 - 'ansible-doc' -l lists most idm modules as 'UNDOCUMENTED'
-  Resolves: RHBZ#2121362
+  Resolves: RHBZ#2125603
 - ansible-freeipa Replica Install Setup DNS fails
-  Resolves: RHBZ#2120415
+  Resolves: RHBZ#2125616
 - ipaconfig does not support SID and netbios attributes
-  Resolves: RHBZ#2069174
+  Resolves: RHBZ#2069184

 * Tue Aug 16 2022 Thomas Woerner <twoerner@redhat.com> - 1.8.3-1
 - Update to version 1.8.3
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.3
-  Related: RHBZ#2080321
+  Related: RHBZ#2080322
 - Fixes replica deployment issue for domains without SID support.
-  Related: RHBZ#2110491
+  Related: RHBZ#2110478

 * Thu Jul 28 2022 Thomas Woerner <twoerner@redhat.com> - 1.8.2-1
 - Update to version 1.8.2
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.2
-  Related: RHBZ#2080321
+  Related: RHBZ#2080322
 - SIDs are always generated for server and replica deployments
-  Resolves: RHBZ#2110491
+  Resolves: RHBZ#2110478
 - Random Serial Numbers are not enabled by default any more
-  Resolves: RHBZ#2110526
+  Resolves: RHBZ#2110523
 - Fixes comparison of bool values in IPA 4.9.10+ for ipadnsconfig
-  Resolves: RHBZ#2110539
+  Resolves: RHBZ#2110538

 * Thu Jul  7 2022 Thomas Woerner <twoerner@redhat.com> - 1.8.1-1
 - Update to version 1.8.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.1
-  Related: RHBZ#2080321
+  Related: RHBZ#2080322
 - ipa server deploys failing with latest IPA compose
-  Resolves: RHBZ#2103928
+  Resolves: RHBZ#2103924
 - ipaserver_external_cert_files failes to copy with ansible 2.13
-  Resolves: RHBZ#2104842
+  Resolves: RHBZ#2104142

 * Fri Jun 24 2022 Thomas Woerner <twoerner@redhat.com> - 1.8.0-1
 - idrange: Fix usage of dom_name when idrange doesn't exist.
-  Resolves: RHBZ#2086993
+  Resolves: RHBZ#2086994
 - smartcard roles for ansible-freeipa
-  Resolves: RHBZ#2076554
+  Resolves: RHBZ#2076567

 * Fri Apr 29 2022 Thomas Woerner <twoerner@redhat.com> - 1.7.0-1
 - Update to version 1.7.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.7.0
-  Resolves: RHBZ#2080321
+  Resolves: RHBZ#2080322
 - New idrange management module.
-  Resolves: RHBZ#1921545
+  Resolves: RHBZ#2069188
 - Not able to update empty descriptions in automount maps.a
-  Resolves: RHBZ#2048552
+  Resolves: RHBZ#2050179
 - New servicedelegationrule management module.
-  Resolves: RHBZ#2069170
+  Resolves: RHBZ#2069179
 - New servicedelegationtarget management module.
-  Resolves: RHBZ#2069172
+  Resolves: RHBZ#2069180
 - Add support for managing idoverrideusers in ipagroup.
-  Resolves: RHBZ#2069173
+  Resolves: RHBZ#2069183

 * Thu Jan 27 2022 Thomas Woerner <twoerner@redhat.com> - 1.6.3-1
 - Update to version 1.6.3
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.3
-  Related: RHBZ#2010621
+  Related: RHBZ#2010622

 * Wed Jan 26 2022 Thomas Woerner <twoerner@redhat.com> - 1.6.2-1
 - Update to version 1.6.2
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.2
-  Related: RHBZ#2010621
+  Related: RHBZ#2010622

 * Fri Jan 21 2022 Thomas Woerner <twoerner@redhat.com> - 1.6.1-1
 - Update to version 1.6.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.0
-  Related: RHBZ#2010621
+  Related: RHBZ#2010622
 - Add module to manage automount maps
-  Resolves: RHBZ#2040462
+  Resolves: RHBZ#2040701
 - Add module to manage automount keys
-  Resolves: RHBZ#2040464
- Client deploy failing with ipaadmin keytab and OTP due to latest ansible
-  version
-  Resolves: RHBZ#2041753
+  Resolves: RHBZ#2040702

 * Wed Dec 29 2021 Thomas Woerner <twoerner@redhat.com> - 1.5.3-1
 - Update to version 1.5.3
@ -403,331 +493,143 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.2
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.0
-  Related: RHBZ#2010621
+  Related: RHBZ#2010622
 - automember set default group/hostgroup is missing from the automember module
-  Resolves: RHBZ#1999912
+  Resolves: RHBZ#2021947
 - automember remove default group/hostgroup is missing from the automember
  module
-  Resolves: RHBZ#1999913
+  Resolves: RHBZ#2021952
 - automember rebuild is missing from the automember module
-  Resolves: RHBZ#1999915
+  Resolves: RHBZ#2021954
 - automember remove orphans group/hostgroup is missing from the automember
  module
-  Resolves: RHBZ#1999916
+  Resolves: RHBZ#2021955
 - Not able to update existing automember rule description
-  Resolves: RHBZ#2021393
+  Resolves: RHBZ#1976922

 * Tue Oct  5 2021 Thomas Woerner <twoerner@redhat.com> - 0.4.0-1
 - Update to version 0.4.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.4.0
-  Resolves: RHBZ#2010621
+  Resolves: RHBZ#2010622
 - Add ability to run modules remotely
-  Resolves: RHBZ#1918025
+  Resolves: RHBZ#2010633
 - New management module ipaautomountlocation
-  Resolves: RHBZ#2010639
+  Resolves: RHBZ#2010643

-* Tue Jul 13 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.8-1
- Update to version 0.3.8
-  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.8
-  Related: RHBZ#1959875
- automember: Verify condition keys
-  Related: RHBZ#1976926
+* Mon Aug 16 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.8-3
+- Add requirement for ansible-core
+  Resolves: RHBZ#1993857
+- Remove python3, pip and ansible installation from sanity test
+  Related: RHBZ#1993857
+- Replace json_query in tests/user/test_users_absent.yml
+  Resolves: RHBZ#1992997

-* Tue Jul 13 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.7-1
- Update to version 0.3.7
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 0.3.8-2
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Thu Jul 15 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.8-1
+- Update to version 0.3.7 and 0.3.8
  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.7
-  Related: RHBZ#1959875
- automember: Fix action to be automember or member, not service
-  Resolves: RRBZ#1976923
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.8
+  Related: RHBZ#1972178
+- automember: Verify condition keys
+  Resolves: RHBZ#1981713
 - automember: Fix result["failed"] issues with conditions
-  Resolves: RRBZ#1976926
+  Resolves: RHBZ#1981713
+- automember: Fix action to be automember or member, not service
+  Resolves: RHBZ#1981711

-* Wed Jun  9 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.6-3
+* Thu Jun 17 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.6-3
 - Apply fix for ipabackup: Use module to get IPA_BACKUP_DIR from ipaplatform
-  Related: RRBZ#1969847
-
-* Wed Jun  9 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.6-2
- ipabackup: Use module to get IPA_BACKUP_DIR from ipaplatform
-  Resolves: RRBZ#1969847
+  Resolves: RRBZ#1973173

 * Mon Jun  7 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.6-1
 - Update to version 0.3.6
  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.6
-  Resolves: RHBZ#1959875
+  Resolves: RHBZ#1972178
 - ansible-freeipa-tests not in the compose
-  Resolves: RHBZ#1936869
+  Resolves: RHBZ#1940014
 - Remove unsupported parameter for (ipapermission) module: perm_rights from
  permission-present.yml
-  Resolves: RHBZ#1921654
+  Resolves: RHBZ#1973167
 - Sample playbook included for selfservice module is incorrect
-  Resolves: RHBZ#1922060
+  Resolves: RHBZ#1973166
 - ipa-client-install failing with error code 7(keytab: /usr/sbin/ipa-rmkeytab
  returned 7)
-  Resolves: RHBZ#1935123
+  Resolves: RHBZ#1973169
 - New management module ipaserver
-  Resolves: RHBZ#1966493
+  Resolves: RHBZ#1973171
 - New management module ipaautomember
-  Resolves: RHBZ#1966496
+  Resolves: RHBZ#1973172

-* Mon Jan 18 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.2-1
- Update to version 0.3.2
+* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 0.3.5-2
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Wed Mar  3 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.5-1
+- Update to version 0.3.5
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.5
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.3.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Jan 18 2021 Thomas Woerner <twoerner@redhat.com> - 0.3.4-1
+- Update to version 0.3.4
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.4
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.3
  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.2
-  Related: RHBZ#1891826
- Not able to add additional privileges with existing privilege in role module
-  Resolves: RHBZ#1893678
- Required error message while adding non-existing members in role handling
-  Resolves: RHBZ#1893679
- Not able to add new members with existing members role handling
-  Resolves: RHBZ#1893684
- service members are removed while updating other members in role handling
-  Resolves: RHBZ#1893685
- after changing the vault type from standard to symmetric, Salt is missing
-  Resolves: RHBZ#1880367
- After changing the vault type from symmetric to asymmetric, Salt is present
-  in the asymmetric vault
-  Resolves: RHBZ#1880377
- After changing the vault type from asymmetric to the standard vault, the
-  Public key is present in the standard vault
-  Resolves: RHBZ#1880378
- Not able to replace public-key-file to the public-key in asymmetric vault
-  type
-  Resolves: RHBZ#1880862
- ipauser module does not seem to support --check flag to ansible-playbook
-  Resolves: RHBZ#1893675
- Not able to add additional attributes with existing attributes in permission
-  handling
-  Resolves: RHBZ#1893687
- Privilege variable is removed from permission handling
-  Resolves: RHBZ#1893688

 * Wed Dec  2 2020 Thomas Woerner <twoerner@redhat.com> - 0.3.1-1
 - Update to version 0.3.1
  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.1
-  Related: RHBZ#1891826
 - ipabackup: Fix undefined vars for conditions in shell tasks without else
-  Related: RHBZ#1894494

 * Tue Dec  1 2020 Thomas Woerner <twoerner@redhat.com> - 0.3.0-2
 - Ship ipabackup role for backup and restore
-  Related: RHBZ#1894494

 * Thu Nov 26 2020 Thomas Woerner <twoerner@redhat.com> - 0.3.0-1
 - Update to version 0.3.0
  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.3.0
-  With tests sub package
-  Resolves: RHBZ#1891826
- Support for firewalld zone in ipaserver and ipareplica roles 
-  Resolves: RHBZ#1894488
- ipagroup: Add support for the IPA CLI option `posix`
-  Resolves: RHBZ#1894493
- New ipabackup role for backup and restore
-  Resolves: RHBZ#1894494
- New management module ipadelegation
-  Resolves: RHBZ#1894496
- New management module ipalocation
-  Resolves: RHBZ#1894497
- New management module ipaprivilege
-  Resolves: RHBZ#1894498
- New management module ipapermission
-  Resolves: RHBZ#1894499
- New management module iparole
-  Resolves: RHBZ#1894500
- New management module ipaselfservice
-  Resolves: RHBZ#1894501
- New management module ipatrust
-  Resolves: RHBZ#1894502
- Fixed log of vault data return when retrieving to a file
-  Resolves: RHBZ#1875378
- ipadnszone: Fix modification o SOA serial with other attributes
-  Resolves: RHBZ#1876896
- Fix symmetric vault password change when using password_files
-  Resolves: RHBZ#1879004
- ipadnsrecord: fix record modification behavior
-  Resolves: RHBZ#1880409
-  Resolves: RHBZ#1881452
- ipadnsrecord: fix record update when multiple records exist
-  Resolves: RHBZ#1881436

-* Tue Aug 18 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.12-6
- Allow to manage multiple dnszone entries
-  Resolves: RHBZ#1845058
- Fixed error msgs on FreeIPABaseModule subclasses
-  Resolves: RHBZ#1845051
- Fix `allow_create_keytab_host` in service module
-  Resolves: RHBZ#1868020
- Modified return value for ipavault module
-  Resolves: RHBZ#1867909
- Add support for option `name_from_ip` in ipadnszone module
-  Resolves: RHBZ#1845056
- Fixe password behavior on Vault module
-  Resolves: RHBZ#1839200
+* Fri Oct 09 2020 Thomas Woerner <twoerner@redhat.com> - 0.2.1-1
+- Update to version 0.2.1
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.2.1
+- Update to version 0.2.0
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.2.0
+- New tests sub package providing upstream tests
+- Utils in /usr/share/ansible-freeipa/utils

-* Tue Jul 14 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.12-5
- ipareplica: Fix failure while deploying KRA
-  Resolves: RHBZ#1855299
-
-* Thu Jul 02 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.12-4
- ipa[server,replica]: Fix pkcs12 info regressions introduced with CA-less
-  Resolves: RHBZ#1853284
-
-* Wed Jul 01 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.12-3
- action_plugins/ipaclient_get_otp: Discovered python needed in task_vars
-  Resolves: RHBZ#1852714
-
-* Mon Jun 29 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.12-2
- Fixes service disable when service has no certificates attached
-  Resolves: RHBZ#1836294
- Add suppport for changing password of symmetric vaults
-  Resolves: RHBZ#1839197
- Fix forwardzone issues
-  Resolves: RHBZ#1843826
-  Resolves: RHBZ#1843828
-  Resolves: RHBZ#1843829
-  Resolves: RHBZ#1843830
-  Resolves: RHBZ#1843831
- ipa[host]group: Fix membermanager unknow user issue
-  Resolves: RHBZ#1848426
- ipa[user,host]: Fail on duplucate names in the users and hosts lists
-  Resolves: RHBZ#1822683
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.12-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

 * Mon Jun 15 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.12-1
 - Update to version 0.1.12 bug fix only release
-  Related: RHBZ#1818768

 * Thu Jun 11 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.11-1
 - Update to version 0.1.11
-  Related: RHBZ#1818768
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.1.11

 * Mon Apr 27 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.10-1
- Update to version 0.1.10:
-  - ipaclient: Not delete keytab when ipaclient_on_master is true
-  - New module to manage dns forwarder zones in ipa
-  - Enhancements of sudorule module tests
-  - Gracefully handle RuntimeError raised during parameter validation in
-    fail_jso
-  - ipareplica_prepare: Fix module DOCUMENTATION
-  - ipa[server,replica,client]: setup_logging wrapper for
-    standard_logging_setup
-  - Created FreeIPABaseModule class to facilitate creation of new modules
-  - New IPADNSZone module
-  - Add admin password to the ipadnsconfig module tests
-  - Added alias module arguments in dnszone module
-  - Fixed a bug in AnsibleFreeIPAParams
-  - utils/build-galaxy-release: Do not add release tag to version for galaxy
-  - ipaserver docs: Calm down module linter
-  - galaxy.yml: Add system tag
-  - ipareplica_setup_kra: Remove unused ccache parameter
-  - ipareplica_setup_krb: krb is assigned to but never used
-  - utils/galaxy: Make galaxy scripts more generic
-  - galaxyfy-playbook.py: Fixed script name
-  Related: RHBZ#1818768
+- Update to version 0.1.10 with fixes and additional modules
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.1.10

-* Thu Feb 20 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.8-3
- ipahost: Do not fail on missing DNS or zone when no IP address given
-  Resolves: RHBZ#1804838
+* Mon Mar 16 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.9-1
+- Update to version 0.1.8 with lots of fixes and additional modules
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.1.9

-* Fri Feb 14 2020 Thomas Woerner <twoerner@redhat.com> - 0.1.8-2
- Updated RPM description for ansible-freeipa 0.1.8
-  Related: RHBZ#1748986
- ipahost: Fix choices of auth_ind parameter, allow to reset parameter
-  Resolves: RHBZ#1783992
- ipauser: Allow reset of userauthtype, do not depend on first,last for mod
-  Resolves: RHBZ#1784474
- ipahost: Enhanced failure msg for member params used without member action
-  Resolves: RHBZ#1783948
- Add missing attributes to ipasudorule
-  Resolves: RHBZ#1788168
-  Resolves: RHBZ#1788035
-  Resolves: RHBZ#1788024
- ipapwpolicy: Use global_policy if name is not set
-  Resolves: RHBZ#1797532
- ipahbacrule: Fix handing of members with action hbacrule
-  Resolves: RHBZ#1787996
- ansible_freeipa_module: Fix comparison of bool parameters in compare_args_isa
-  Resolves: RHBZ#1784514
- ipahost: Add support for several IP addresses and also to change them
-  Resolves: RHBZ#1783979
-  Resolves: RHBZ#1783976
- ipahost: Fail on action member for new hosts, fix dnsrecord_add reverse flag
-  Resolves: RHBZ#1803026
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

-* Sat Dec 14 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.8-1
- Update to version 0.1.8 (bug fix release)
-  - roles/ipaclient/README.md: Add information about ipaclient_otp
-  - Install and enable firewalld if it is configured for ipaserver and
-    ipareplica roles
-  - ipaserver_test: Do not use zone_overlap_check for domain name validation
-  - Allow execution of API commands that do not require a name
-  - Update README-host: Drop options from allow_*keytab parameters docs
-  - ipauser: Extend email addresses with default email domain if no domain is
-    given
-    Resolves: RHBZ#1747413
-  Related: RHBZ#1748986
+* Fri Dec 20 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.8-1
+- Update to version 0.1.8 with lots of fixes and additional modules
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.1.8
+  https://github.com/freeipa/ansible-freeipa/releases/tag/v0.1.7

-* Mon Dec  2 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.7-1
- Update to version 0.1.7
-  - Add debian support for ipaclient
-  - Added support for predefining client OTP using ipaclient_otp
-  - ipatopologysegment: Store suffix for commands in command list
-  - ipatopologysegment: Fail for missing entry with reinitialized
-  - Utils scripts: ansible-ipa-[server,replica,client]-install
-  - ipaserver_test,ipareplica_prepare: Do not return _pkcs12_file settings
-  - ansible_freeipa_module: Add support for GSSAPI
-  - ansible_ipa_client: Drop import of configure_nsswitch_database
-  - New host management module
-  - New hostgroup management module
-  - ipagroup: Remove unused member_[present,absent] states
-  - external-ca tests: Fix typo in inventory files
-  - tests/external-signed-ca tests: Fix external-ca.sh to use proper serials
-  - ipagroup: Rework to use same mechanisms as ipahostgroup module
-  - ansible_freeipa_module: api_command should not have extra try clause
-  - ansible_freeipa_module: compare_args_ipa needs to compare lists orderless
-  - ansible_freeipa_module: New function api_check_param
-  - ansible_freeipa_module: New functions module_params_get and _afm_convert
-  - ansible_freeipa_module: Add missing to_text import for _afm_convert
-  - ansible_freeipa_module: Convert tuple to list in compare_args_ipa
-  - ansible_freeipa_module: New function api_get_realm
-  - ipauser: User module extension
-  - New sudocmd management module
-  - New sudocmdgroup management module
-  - ansible_freeipa_module: Convert int to string in compare_args_ipa
-  - New pwpolicy management module
-  - New hbacsvc (HBAC Service) management module
-  - New hbacsvcgroup (HBAC Service Group) management module
-  - ipagroup: Properly support IPA versions 4.6 and RHEL-7
-  - ipagroup: Fix changed flag, new test cases
-  - ipauser: Add info about version limitation of passwordexpiration
-  - New hbacrule (HBAC Rule) management module
-  - ipahostgroup: Fix changed flag, support IPA 4.6 on RHEL-7, new test cases
-  - New sudorule (Sudo Rule) management module
-  - ipauser: Support 'sn' alias of 'last' for surname
-  - Update galaxy.yml: Update description, drop empty dependencies
-  - Update ipauser.py: Fix typo in users.name description
-  - ipaclient: Fix misspelled sssd options
-  - ipauser: Return generated random password
-  - ipahost: Return generated random password
-  - Added context configuration to api_connect
-  - ansible_freeipa_module: Better support for KRB5CCNAME environment variable
-  - ipa[server,replica,client]: Add support for CentOS-8
-  - ipahost: Extension to be able handle several hosts and all settings
-  - Flake8 fixes
-  - Documentation updates
-  - Cleanup
-  Resolves: RHBZ#1748986
-
-* Fri Sep  6 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-4
- ansible_ipa_client: Drop import of configure_nsswitch_database
-  (RHBZ#1748905)
-
-* Wed Jul 31 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-3
- ipatopologysegment: Store suffix for commands in command list (RHBZ#1733547)
- ipatopologysegment: Fail for missing entry with reinitialized (RHBZ#1733559)
-
-* Tue Jul 23 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-2
- Drop dirserv_cert_files key from utils/gen_module_docs.py for covscan
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.1.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

 * Tue Jul 23 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.6-1
- update to version 0.1.6
+- Update to version 0.1.6
  - Lots of documentation updates in READMEs and modules
  - library/ipaclient_get_otp: Enable force mode for host_add call (fixes #74)
  - Flake8 and pylint reated fixes
@ -748,7 +650,13 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
  - ipa[server,replica]: Set _packages_adtrust for Ubuntu
  - New build script for galaxy release
  - New utils script to update module docs
- Changes from ansible-freeipa-0.1.5
+
+* Tue Jul  9 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.5-2
+- Update README-user.md: Fixed examples, new example
+- ipauser example playbooks: Fixed actions, new example
+
+* Tue Jul  9 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.5-1
+- Update to version 0.1.5
  - Support for IPA 4.8.0
  - New user management module
  - New group management module
@ -758,20 +666,9 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
  - ipareplica: Fixes for certmonger and kra setup
  - New tests folder
  - OTP related updates to README files
-
-* Thu Jul  4 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.4-2
- ansible_ipa_client: Always set options.unattended (RHBZ#1726645)
- ipaserver_prepare: Properly report error, do show trace back (RHBZ#1726668)
- ipa[server,replica,client]: RHEL-8 specific vars files (RHBZ#1727095)
- ipatopology modules: Use ipaadmin_ prefix for principal and password
-  (RHBZ#1727101)
-
-* Mon Jun 17 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.4-1
- update to version 0.1.4
+- Updates of version 0.1.4
  - ipatopologysegment: Use commands, not command
-
-* Mon Jun 17 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.3-1
- update to version 0.1.3
+- Updates of version 0.1.3
  - ipaclient_test: Fix Python2 decode use with Python3
  - Fixed: #86 (AttributeError: 'str' object has no attribute 'decode')
  - ipaclient_get_otp: Remove ansible_python_interpreter handling
@ -784,15 +681,7 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
  - ipatopologysegment: Allow domain+ca suffix, new state: checked
  - Documentation updates
  - Cleanups
-
-* Tue Jun 11 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.2-3
- bump release for functional test
-
-* Tue Jun 11 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.2-2
- bump release for functional test
-
-* Fri Jun  7 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.2-1
- update to version 0.1.2
+- Update of version 0.1.2
  - Now a new Ansible Collection
  - Fix gssapi requirement for OTP: It is only needed if keytab is used with
    OTP now.
@ -808,6 +697,6 @@ cp -rp tests %{buildroot}%{_datadir}/ansible-freeipa/
  - Fix errors when ipaservers variable is not set
  - Fix ipaclient install role length typo
  - Cleanups
-  
+
 * Mon May  6 2019 Thomas Woerner <twoerner@redhat.com> - 0.1.1-1
 - Initial package
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,8 @@
+# recipients: abokovoy, frenaud, kaleem, ftrivino
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: idm-ci.brew-build.tier1.functional}
--- a/2
+++ b/2
@ -0,0 +1,2 @@
+SHA512 (ansible-freeipa-1.14.4.tar.gz) = ada609ae90c3e6c374758af9bf5dd0822b8d1d11be46e99481826704b975271f639b09fa05ce6169b47b21869462603b64c742d221a572c53f80a6d4c089226a
+SHA512 (ansible-freeipa-1.14.5.tar.gz) = e19963dea18e9b963efad69d2f684fb80113cac2697114d11b7ebe70ea0b266f967938fd6aebfb6b6ec172ee0d2cd82c0904024d0e8bdfae007563cad8b7bb35
--- a/tests/.fmf/version
+++ b/tests/.fmf/version
@ -0,0 +1 @@
+1
--- a/tests/provision.fmf
+++ b/tests/provision.fmf
@ -0,0 +1,5 @@
+---
+
+standard-inventory-qcow2:
+  qemu:
+    m: 3G
--- a/tests/sanity/install-server.yml
+++ b/tests/sanity/install-server.yml
@ -0,0 +1,8 @@
+---
+- name: Playbook to configure IPA servers
+  hosts: ipaserver
+  become: true
+
+  roles:
+  - role: ipaserver
+    state: present
--- a/tests/sanity/inventory
+++ b/tests/sanity/inventory
@ -0,0 +1,10 @@
+[ipaserver]
+localhost
+
+[ipaserver:vars]
+ipaserver_domain=example.test
+ipaserver_realm=EXAMPLE.TEST
+ipaserver_setup_dns=yes
+ipaserver_auto_forwarders=yes
+ipaadmin_password=Secret123
+ipadm_password=Secret123
--- a/tests/sanity/runtest.sh
+++ b/tests/sanity/runtest.sh
@ -0,0 +1,3 @@
+#!/bin/sh -eux
+ 
+ansible-playbook -i inventory install-server.yml -v --connection=local
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,14 @@
+---
+- hosts: localhost
+  tags:
+  - classic
+  roles:
+  - role: standard-test-basic
+    required_packages:
+    - firewalld
+    # pip3 is used to install ansible 2.8+
+    #- ansible
+    required_services:
+    - firewalld
+    tests:
+    - sanity