Thomas Woerner

Thanks for the report. Yes, the task `Setup2 password expiration for user account` should not report a change.

No, it has not been fixed yet. But it is on the list for next fixes.

Important for an upstream fix and the matching test: `passwordexpiration` for users that are created with the `server` context (default for the plugins) is different compared to users that are...

@donescup Which ansible-freeipa and IPA versions are you using?

@rclar802 I only tried to remove my answer to your comment, but this removed the whole comment :-( And there is no undelete.

Thanks for the start of this.

`ipaclient_get_facts` is not supposed to be executed on the controller, but the server. Using OTP is working in our tests and the controller is not an IPA client.

Which ansible-freeipa version are you using and do you have a log?

No module in the `ipaclient` role should need `exit_raw_json` as there are no `no_log` parameters together with returning strings. `ipaclient_join.py` is using no_log, but only returning a bool value. There...

It would be nice to have the definition only once for all roles. It is also needed to add ignores for the use of sys.exit. Maybe a name like IPAAnsibleRoleModule...