ansible/ansible — pull request #7409 by grossws (2014-05-15 01:00:35+00:00)
Title: Idempotent LDAP feature-rich module

When I tried to configure ldap with ansible, I have to do it in three phases: copy `ldif` file to target system, perform `ldapsearch` to check if entry exists and call to `ldapadd` or `ldapmodify` after that (conditionally). It's uncomfortable and error-prone. So I implemented ldap module using python ldap library, present in base repos (CentOS base in my case).

Another advantage over calling `ldapmodify` (and other utils from `openldap-clients`) that module supports fully idempotent ldap operation and check mode.

Supported operation modes are equal to `ldapadd`, `ldapmodify` and `ldapdelete` openldap utils but will not apply any operations if LDAP entry wouldn't change after these operations (like deleting non-existent attribute, replace attribute with values already present in it etc).

Supported features:
- connect using `ldap`, `ldaps` and `ldapi` protocols;
- *STARTTLS* over `ldap` protocol;
- anonymous and authenticated operation (using `simple` auth);
- SASL *EXTERNAL* auth method on `ldapi` protocol (usually used to configure OpenLDAP 2.4+ on-line configs in `cn=config` subtree);
- adding and deleting entries (via `state=present` and `state=absent`);
- adding, deleting and replacing individual attributes, attribute-value pairs or their combinations;
- `simple_args` and `complex_args` format for entry modification command;
- many examples to explain different args format and operation modes;
- simple DSL for one-line ldap entry modification command (with EBNF-like `simple_args` format definition);
- *UTF-8* for attribute values;
- grouping (by attribute) and collapsing ldap modification operations to get true idemponent behavior;
- parsed and final ldap modifications (as they will be sent to ldap server) are logged to simplify module learing and operations debugging.

Module from #7073 was useless for me.

Target system requirement:
- python-ldap