# SPDX-License-Identifier: MIT
---
# To run this test, AD server must be configured and it's properties
# provided with the following variables:
# ad_integration_realm
# ad_integration_user
# ad_integration_password
# Inventory must contain the client Linux node and the ad AD Server node like:
# all:
#   hosts:
#     client:
#       ansible_connection: local
#       ansible_host: 127.0.0.1
#     ad:
#       ansible_host: 10.192.1.1
#       ad_fqdn: ad1.domain.com
#       ansible_connection: winrm
#       ansible_password: Secret123
#       ansible_port: 5986
#       ansible_user: Administrator
#       ansible_winrm_server_cert_validation: ignore
- name: Test integration with AD server
  hosts: client
  vars:
    mssql_accept_microsoft_odbc_driver_17_for_sql_server_eula: true
    mssql_accept_microsoft_cli_utilities_for_sql_server_eula: true
    mssql_accept_microsoft_sql_server_standard_eula: true
    mssql_version: 2022
    mssql_password: "p@55w0rD"
    mssql_edition: Evaluation
    mssql_manage_firewall: true
    mssql_debug: true
    mssql_ad_configure: true
    mssql_ad_sql_user: sqluser
    mssql_ad_sql_password: "p@55w0rD1"
    ad_integration_realm: domain.com
    ad_integration_user: Administrator
    ad_integration_password: Secret123
    ad_integration_manage_dns: true
    ad_integration_dns_server: 1.1.1.1
    ad_integration_dns_connection_name: eth0
    ad_integration_dns_connection_type: ethernet
    # ad_integration_realm is randomized in IDM CI hence need to use variables
    # Cannot use variable for Administrator because test with
    # mssql_ad_join: false does ad_integration_user: null
    __mssql_ad_login: >-
      {{ ad_integration_realm.split('.') | first + '\Administrator' }}
    mssql_post_input_sql_content: |-
      USE master;
      IF NOT EXISTS (
        SELECT name FROM sys.server_principals
        WHERE name = '{{ __mssql_ad_login }}'
      )
      BEGIN
        PRINT 'A {{ __mssql_ad_login }} login does not exist, creating';
        CREATE LOGIN [{{ __mssql_ad_login }}] FROM WINDOWS;
        PRINT 'The {{ __mssql_ad_login }} login created successfully';
      END
      ELSE
      BEGIN
        PRINT 'A {{ __mssql_ad_login }} login already exists, skipping'
      END

  tasks:
    # Test general scenario
    - name: Set up MSSQL and configure AD authentication
      include_role:
        name: linux-system-roles.mssql

    - name: Get KerberosEncryptionType of user {{ mssql_ad_sql_user }}
      ansible.windows.win_shell: >-
        Get-ADUser -Identity {{ mssql_ad_sql_user }}
        -Properties *
        | Format-Table Name,KerberosEncryptionType -A
      register: __mssql_sql_username_enc_type
      changed_when: false
      delegate_to: ad

    - name: Set AES128,AES256 encryption type for {{ mssql_ad_sql_user }}
      ansible.windows.win_shell: >-
        Set-ADUser -Identity {{ mssql_ad_sql_user }}
        -KerberosEncryptionType AES128,AES256
      when: "not 'AES128, AES256' in __mssql_sql_username_enc_type.stdout"
      delegate_to: ad

    - name: Test AD integration
      include_tasks: ../tasks/verify_ad_auth.yml

    # Test with mssql_ad_keytab_file
    - name: Fetch keytab file that was prepared above
      fetch:
        src: /var/opt/mssql/secrets/mssql.keytab
        dest: /tmp/mssql.keytab
        flat: true
        mode: preserve
      run_once: true

    - name: Clean up after the role invocation
      include_tasks: ../tasks/cleanup.yml

    - name: Set up MSSQL and configure AD authentication with keytab
      vars:
        mssql_ad_keytab_file: /tmp/mssql.keytab
        mssql_ad_keytab_remote_src: false
        mssql_ad_sql_password: null
      include_role:
        name: linux-system-roles.mssql

    - name: Test AD integration
      include_tasks: ../tasks/verify_ad_auth.yml

    - name: Clean up after the role invocation
      include_tasks: ../tasks/cleanup.yml

    # Test with mssql_ad_join: false
    - name: Authenticate to AD
      include_role:
        name: linux-system-roles.ad_integration

    - name: Set up MSSQL and configure AD authentication without joining to AD
      include_role:
        name: linux-system-roles.mssql
      vars:
        mssql_ad_join: false
        # Explicitly set kerberos vars, otherwise the value becomes null
        mssql_ad_kerberos_user: Administrator
        mssql_ad_kerberos_password: Secret123
        ad_integration_user: null
        ad_integration_password: null
        ad_integration_manage_dns: null
        ad_integration_dns_server: null
        ad_integration_dns_connection_name: null
        ad_integration_dns_connection_type: null

    - name: Test AD integration
      include_tasks: ../tasks/verify_ad_auth.yml
