---
# tasks
# perfact_adduser/ldap_add_user/tasks/main.yml

# this tasks runs on ldap-login-[prod|devel|localdev] (from playbook_perfact_adduser.yml)

#   vars:
#     USERLOGIN is given to playbook on commandline
#     vault_gitea_apikey comes from VAULTS internalit/vault_perfact_useradmin.yml
#     users[USERLOGIN].first_name
#     users[USERLOGIN].last_name
#     users[USERLOGIN].mail_address

- name: perfact_adduser/ldap_add_user exit if USERLOGIN is not given on commandline
  tags: always
  ansible.builtin.fail:
    msg: "Error: USERLOGIN is not given on commandline"
  when: USERLOGIN is undefined
  check_mode: false

- name: perfact_adduser ldap read var for position mapping
  tags: always
  ansible.builtin.include_vars:
    file: internalit/var_position_mapping.yml
  # example data:
  #    mailinglist_assignment:
  #      Projektrealisierung:
  #        - alle
  #        - verteiler-machinery
  #        - verteiler-logistics
  #        - entwickler
  #      Ausbildung:
  #        - alle
  #        - azubis
  #    group_assignment:
  #      Projektrealisierung:
  #        - perfactusers
  #        - project_realization
  #      Ausbildung:
  #        - perfactusers

- name: perfact_useradmin change user to perfact-useradmin for connection to ldap-master
  tags: ldap
  ansible.builtin.add_host:
    name: "{{ inventory_hostname }}"
    ansible_user: "perfact-useradmin"

- name: check if user in ou=file exists
  tags: ldap
  ansible.builtin.command: sudo /opt/perfact/custom/perfact_useradmin.py file-show-groups-of-user --user "{{ USERLOGIN }}"
  # also run in check_mode
  check_mode: false
  ignore_errors: true
  # do not print the big red error
  no_log: true
  register: user_in_ou_file_present


- debug:
  # print if user aleady exists
    var: user_in_ou_file_present
  when: not user_in_ou_file_present.failed

- name: perfact_useradmin add user to ou=file
  tags: ldap, ldap-file
  when: user_in_ou_file_present.failed
  block:

  # usr not present in ou=file - create it
  - name: perfact_useradmin add file user
    ansible.builtin.command: sudo /opt/perfact/custom/perfact_useradmin.py file-add-user --user "{{ USERLOGIN }}"  --password  "{{ pffile_passwd }}" --firstname "{{ users[USERLOGIN].first_name }}" --lastname "{{ users[USERLOGIN].last_name }}"

  #- debug:
  #    msg: "{{ item }}"
  #  with_items: "{{ group_assignment[users[USERLOGIN].position] }}"

  - name: get groups of user and add user to this groups
    ansible.builtin.command: sudo /opt/perfact/custom/perfact_useradmin.py file-add-user-to-group --user "{{ USERLOGIN }}" --group "{{ item }}"
    with_items: "{{ group_assignment[users[USERLOGIN].position] }}"


- name: check if user in ou=mail exists
  tags: ldap
  ansible.builtin.command: sudo /opt/perfact/custom/perfact_useradmin.py mail-show-aliases-for-user --user "{{ USERLOGIN }}"
  # also run in check_mode
  check_mode: false
  ignore_errors: true
  # do not print the big red error
  no_log: true
  register: user_in_ou_mail_present

- debug:
  # print if user aleady exists
    var: user_in_ou_mail_present
  when: not user_in_ou_mail_present.failed

#- name: end here
#  meta: end_play

- name: perfact_useradmin add user to ou=file
  tags: ldap
  when: user_in_ou_mail_present.failed
  block:

  # usr not present in ou=mail - create it
  - name: perfact_useradmin add mail user
    tags: ldap, ldap-mail
    ansible.builtin.command:
      cmd: "sudo /opt/perfact/custom/perfact_useradmin.py mail-add-user --user {{ USERLOGIN }} --password  {{ Mail_Password }} --mailaddress {{ users[USERLOGIN].mail_address }} --lastname {{ users[USERLOGIN].last_name }}"

  #- name: debug virtuals
  #  debug:
  #    msg: "{{ users[USERLOGIN].mail_virtual }}"

  - name: perfact_useradmin add virtuals
    tags: ldap, mail
    ansible.builtin.command:
      cmd: "sudo /opt/perfact/custom/perfact_useradmin.py mail-add-virtual-to-user --user {{ USERLOGIN }} --virtual {{ item }}"
    with_items: "{{ users[USERLOGIN].mail_virtual }}"
    when: users[USERLOGIN].mail_virtual is defined

  - name: perfact_useradmin to aliases (distribution lists)
    tags: ldap
    ansible.builtin.command:
      cmd: "sudo /opt/perfact/custom/perfact_useradmin.py mail-add-user-to-alias --alias {{ item }} --target {{ USERLOGIN }}"
    with_items: "{{ mailinglist_assignment[users[USERLOGIN].position] }}"
