Implement LDAP CA certs support

plugins/modules/auth_source_ldap.py

@@ -97,6 +97,12 @@
     description: Whether or not to use TLS when contacting the LDAP server.
     required: false
     type: bool
+  cacert:
+    description:
+      - PEM-encoded CA certificate(s) used to verify the LDAP server when LDAPS is enabled, in addition to the system trust store.
+      - Leave empty to use the system trust store only.
+    required: false
+    type: str
   groups_base:
     description: Base DN where groups reside.
     required: false
@@ -181,6 +187,19 @@
     username: "admin"
     password: "changeme"
     state: present
+
+- name: LDAPS with a custom CA certificate
+  theforeman.foreman.auth_source_ldap:
+    name: "Example LDAPS"
+    host: "ldap.example.org"
+    port: 636
+    tls: true
+    cacert: "{{ lookup('file', '/path/to/ldap-ca.pem') }}"
+    server_type: free_ipa
+    server_url: "https://foreman.example.com"
+    username: "admin"
+    password: "changeme"
+    state: present
 '''
 
 RETURN = '''
@@ -220,6 +239,7 @@ def main():
             onthefly_register=dict(type='bool'),
             usergroup_sync=dict(type='bool'),
             tls=dict(type='bool'),
+            cacert=dict(),
             groups_base=dict(),
             server_type=dict(choices=["free_ipa", "active_directory", "posix"]),
             ldap_filter=dict(),

roles/auth_sources_ldap/tasks/main.yml

@@ -19,6 +19,7 @@
     onthefly_register: "{{ item.onthefly_register | default(omit) }}"
     usergroup_sync: "{{ item.usergroup_sync | default(omit) }}"
     tls: "{{ item.tls | default(omit) }}"
+    cacert: "{{ item.cacert | default(omit) }}"
     groups_base: "{{ item.groups_base | default(omit) }}"
     host: "{{ item.host | default(omit) }}"
     port: "{{ item.port | default(omit) }}"

tests/test_playbooks/tasks/auth_source_ldap.yml

@@ -35,6 +35,7 @@
     onthefly_register: "{{ auth_source_ldap_onthefly_register }}"
     usergroup_sync: "{{ auth_source_ldap_usergroup_sync }}"
     tls: "{{ auth_source_ldap_tls }}"
+    cacert: "{{ auth_source_ldap_cacert | default(omit) }}"
     groups_base: "{{ auth_source_ldap_groups_base }}"
     server_type: "{{ auth_source_ldap_server_type }}"
     ldap_filter: "{{ auth_source_ldap_ldap_filter }}"