---
- name: Test issuing certificate with principal.
  hosts: all
  vars:
    certificate_requests:
      - name: mycert_principal
        dns: www.example.com
        principal: HTTP/www.example.com@EXAMPLE.COM
        ca: self-sign
  roles:
    - fedora.linux_system_roles.certificate

- name: Verify certificate
  hosts: all
  vars:
    certificates:
      - path: /etc/pki/tls/certs/mycert_principal.crt
        key_path: /etc/pki/tls/private/mycert_principal.key
        subject:
          - name: commonName
            oid: 2.5.4.3
            value: www.example.com
        subject_alt_name:
          - name: DNS
            value: www.example.com
          - name: Universal Principal Name (UPN)
            value: HTTP/www.example.com@EXAMPLE.COM
            oid: 1.3.6.1.4.1.311.20.2.3
          - name: Kerberos principalname
            value: HTTP/www.example.com@EXAMPLE.COM
            oid: 1.3.6.1.5.2.2
  tasks:
    - name: Verify each certificate
      include_tasks: tasks/assert_certificate_parameters.yml
      loop: "{{ certificates }}"
      loop_control:
        loop_var: cert


- name: Test issuing certificate with invalid principal.
  hosts: all
  vars:
    certificate_requests:
      - name: mycertinvalid
        dns: www.example.com
        principal: HTTP/abc
        ca: self-sign
  tasks:
    - name: Run test
      vars:
        expected_error_msg: >-
          It should be formatted as 'primary/instance@REALM'
      block:
        - name: Import certificate role
          import_role:
            name: fedora.linux_system_roles.certificate
        - name: Failed
          fail:
            msg: "certificate with invalid principal"
      rescue:
        - name: Assert...
          assert:
            that:
              - expected_error_msg in ansible_failed_result.results.0.msg
