Enable openldap memberof module with ansible ldap_attrs

Question

With ansible 2.10 I use the ldap_attrs module to enable the openldap memberof module:

- name: Enable memberof module
  ldap_attrs:
    dn: cn=module{0},cn=config
    attributes:
      olcModuleLoad: memberof.so
    state: present

The first time the task is executed works well, but if I play the playbook a second time it fails:

fatal: [myserver.mydomain.tld]: FAILED! => {"changed": false, "details": "{'info': u'modify/add: olcModuleLoad: value #0 already exists', 'desc': u'Type or value exists'}", "msg": "Attribute action failed."}

already exists sounds like something I expect, so I am surprised that it is considered fatal.

Is it an ansible bug, or did I miss something in the configuration?

Answer 1

In september '21 this is not yet supported by ansible.

I could automate the memberof and refint installation and configuration based on those workarounds:

- ldap_attrs:
    server_uri: "{{ ldap_api_url }}"
    dn: cn=module{0},cn=config
    attributes:
      olcModuleLoad:
        - refint.so
    register: ldap_attrs_result
    failed_when:
      - ldap_attrs_result.failed
      - ldap_attrs_result.details is not defined or (ldap_attrs_result.details|from_yaml)["desc"] != "Type or value exists"

- ldap_attrs:
    server_uri: "{{ ldap_api_url }}"
    dn: cn=module{0},cn=config
    attributes:
      olcModuleLoad:
        - memberof.so
    register: ldap_attrs_result
    failed_when:
      - ldap_attrs_result.failed
      - ldap_attrs_result.details is not defined or (ldap_attrs_result.details|from_yaml)["desc"] != "Type or value exists"

- ldap_entry:
    server_uri: "{{ ldap_api_url }}"
    dn: olcOverlay=refint,olcDatabase={1}mdb,cn=config
    objectClass:
      - olcOverlayConfig
      - olcRefintConfig
    attributes:
      olcOverlay: refint
      olcRefintAttribute: memberof member manager owner

- ldap_entry:
    server_uri: "{{ ldap_api_url }}"
    dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
    objectClass:
      - olcOverlayConfig
      - olcMemberOf
    attributes:
      olcOverlay: memberof
      olcMemberOfDangling: ignore
      olcMemberOfRefInt: "TRUE"
      olcMemberOfGroupOC: groupOfNames
      olcMemberOfMemberAD: member
      olcMemberOfMemberOfAD: memberOf