From 47be01fe40217b189bdbfe0352379ede70f97aa3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20Laz=C3=ADk?= <alazik@redhat.com>
Date: Fri, 17 Jul 2026 14:44:31 +0200
Subject: [PATCH 1/2] Implement LDAP CA certs support

Made with Cursor.
---
 plugins/modules/auth_source_ldap.py           | 20 +++++++++++++++++++
 roles/auth_sources_ldap/tasks/main.yml        |  1 +
 .../test_playbooks/tasks/auth_source_ldap.yml |  1 +
 3 files changed, 22 insertions(+)

diff --git a/plugins/modules/auth_source_ldap.py b/plugins/modules/auth_source_ldap.py
index 723365e592..a4b8b7d0f9 100644
--- a/plugins/modules/auth_source_ldap.py
+++ b/plugins/modules/auth_source_ldap.py
@@ -97,6 +97,12 @@
     description: Whether or not to use TLS when contacting the LDAP server.
     required: false
     type: bool
+  cacert:
+    description:
+      - PEM-encoded CA certificate(s) used to verify the LDAP server when LDAPS is enabled.
+      - Leave empty to use the system trust store.
+    required: false
+    type: str
   groups_base:
     description: Base DN where groups reside.
     required: false
@@ -181,6 +187,19 @@
     username: "admin"
     password: "changeme"
     state: present
+
+- name: LDAPS with a custom CA certificate
+  theforeman.foreman.auth_source_ldap:
+    name: "Example LDAPS"
+    host: "ldap.example.org"
+    port: 636
+    tls: true
+    cacert: "{{ lookup('file', '/path/to/ldap-ca.pem') }}"
+    server_type: free_ipa
+    server_url: "https://foreman.example.com"
+    username: "admin"
+    password: "changeme"
+    state: present
 '''
 
 RETURN = '''
@@ -220,6 +239,7 @@ def main():
             onthefly_register=dict(type='bool'),
             usergroup_sync=dict(type='bool'),
             tls=dict(type='bool'),
+            cacert=dict(),
             groups_base=dict(),
             server_type=dict(choices=["free_ipa", "active_directory", "posix"]),
             ldap_filter=dict(),
diff --git a/roles/auth_sources_ldap/tasks/main.yml b/roles/auth_sources_ldap/tasks/main.yml
index 1875070112..6328c10303 100644
--- a/roles/auth_sources_ldap/tasks/main.yml
+++ b/roles/auth_sources_ldap/tasks/main.yml
@@ -19,6 +19,7 @@
     onthefly_register: "{{ item.onthefly_register | default(omit) }}"
     usergroup_sync: "{{ item.usergroup_sync | default(omit) }}"
     tls: "{{ item.tls | default(omit) }}"
+    cacert: "{{ item.cacert | default(omit) }}"
     groups_base: "{{ item.groups_base | default(omit) }}"
     host: "{{ item.host | default(omit) }}"
     port: "{{ item.port | default(omit) }}"
diff --git a/tests/test_playbooks/tasks/auth_source_ldap.yml b/tests/test_playbooks/tasks/auth_source_ldap.yml
index 6e19fa210c..1465879f1e 100644
--- a/tests/test_playbooks/tasks/auth_source_ldap.yml
+++ b/tests/test_playbooks/tasks/auth_source_ldap.yml
@@ -35,6 +35,7 @@
     onthefly_register: "{{ auth_source_ldap_onthefly_register }}"
     usergroup_sync: "{{ auth_source_ldap_usergroup_sync }}"
     tls: "{{ auth_source_ldap_tls }}"
+    cacert: "{{ auth_source_ldap_cacert | default(omit) }}"
     groups_base: "{{ auth_source_ldap_groups_base }}"
     server_type: "{{ auth_source_ldap_server_type }}"
     ldap_filter: "{{ auth_source_ldap_ldap_filter }}"

From c358fc0ce32775164f466e090651fa10e99fde41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20Laz=C3=ADk?= <alazik@redhat.com>
Date: Mon, 20 Jul 2026 19:48:13 +0200
Subject: [PATCH 2/2] Clarify cacert param description

---
 plugins/modules/auth_source_ldap.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/modules/auth_source_ldap.py b/plugins/modules/auth_source_ldap.py
index a4b8b7d0f9..3f6fc129a1 100644
--- a/plugins/modules/auth_source_ldap.py
+++ b/plugins/modules/auth_source_ldap.py
@@ -99,8 +99,8 @@
     type: bool
   cacert:
     description:
-      - PEM-encoded CA certificate(s) used to verify the LDAP server when LDAPS is enabled.
-      - Leave empty to use the system trust store.
+      - PEM-encoded CA certificate(s) used to verify the LDAP server when LDAPS is enabled, in addition to the system trust store.
+      - Leave empty to use the system trust store only.
     required: false
     type: str
   groups_base: