Permission module fails when using filter Variable

[arozmarin]

Hi guys, I could't make it work. I try to use Permission module and

that is my task

• name: Ensure RBAC Permission {{ item.name }} exists freeipa.ansible_freeipa.ipapermission: ipaadmin_principal: "{{ principal }}" ipaadmin_password: "{{ admin_password }}" state: "{{ item.state }}" name: "{{ item.name }}" rename: "{{ item.rename | default(omit) }}" right: "{{ item.right | default(omit) }}" attrs: "{{ item.attrs | default(omit) }}" bindtype: "{{ item.bindtype | default(omit) }}" subtree: "{{ item.subtree | default(omit) }}" filter: "{{ item.filter | default(omit) }}" rawfilter: "{{ item.rawfilter | default(omit) }}" target: "{{ item.target | default(omit) }}" targetto: "{{ item.targetto | default(omit) }}" targetfrom: "{{ item.targetfrom | default(omit) }}" memberof: "{{ item.memberof | default(omit) }}" targetgroup: "{{ item.targetgroup | default(omit) }}" object_type: "{{ item.object_type | default(omit) }}" rename: "{{ item.rename | default(omit) }}" when: item.state != 'absent'

and task always fails

"msg": "permission_add: Self Service Password reset: invalid 'filter': must be enclosed in parentheses"

I tried different variables for filter eve remove variable and write value like

filter: '(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))' filter: "(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))"

I get always same error. Any idea how should I write filter value that module will work. If I don't include filter in task, task works ok.

thanks

[rjeffman]

This seems to have something to do with the way Ansible/Jinja2 handle string and lists.

The issue is that your filter is being treated as a list of filters, thus the IPA API error reporting.

I was able to fix this with the following change to filter:

  - name: Ensure permission perm-test-1 is present
    ipapermission:
      name: perm-test-1
      object_type: host
      memberof: rbacgroup1
      filter: 
        - '(!(memberOf=cn=admins,cn=groups,cn=accounts,dc=example,dc=com))'
      right: all

Note that my filter is now a list entry, so (somehow) it is not considered a list of filters anymore (maybe because Ansible expect a list of strings, but I have digged deeper).

[arozmarin]

Perfect thanks for help. It's working now