[Role handling] Not able to add additional privileges with existing privilege.

[varunmylaraiah]

Not able to add additional privileges with existing privilege.

[root@master ~]# ipa role-show newrole
  Role name: newrole
  Privileges: Automember Readers, ADTrust Agents

[root@ansible ~]# cat newrole.yaml
---
- name: "Update an existing role with the additional privileges"
  hosts: ipaserver

  tasks:
  - iparole:
      ipaadmin_password: <password>
      name: newrole
      privilege: 
        - DNS Servers
        - Host Administrators
        - DNS Administrators
        - Group Administrators
      action: member

[root@ansible ~]# ansible-playbook -vv -i inventory/server.hosts newrole.yaml 
ansible-playbook 2.9.11
  config file = /root/ansible.cfg
  configured module search path = ['/root/ansible-freeipa/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.8/site-packages/ansible
  executable location = /usr/bin/ansible-playbook
  python version = 3.8.5 (default, Aug 12 2020, 00:00:00) [GCC 10.2.1 20200723 (Red Hat 10.2.1-1)]
Using /root/ansible.cfg as config file

PLAYBOOK: newrole.yaml ***********************************************************************************************
1 plays in newrole.yaml

PLAY [9.Update an existing role with the additional privilege] *******************************************************

TASK [Gathering Facts] ***********************************************************************************************
task path: /root/newrole.yaml:2
[DEPRECATION WARNING]: Distribution fedora 32 on host master.ipadomain.test should use /usr/bin/python3, but is using
 /usr/bin/python for backward compatibility with prior Ansible releases. A future Ansible release will default to 
using the discovered platform python for this host. See 
https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information. This 
feature will be removed in version 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False 
in ansible.cfg.
ok: [master.ipadomain.test]
META: ran handlers

TASK [iparole] *******************************************************************************************************
task path: /root/newrole.yaml:6
changed: [master.ipadomain.test] => {"changed": true}
META: ran handlers
META: ran handlers

PLAY RECAP ***********************************************************************************************************
master.ipadomain.test      : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0 

[root@master ~]# ipa role-show newrole
  Role name: newrole
  Privileges: Group Administrators, Host Administrators, DNS Administrators, DNS Servers

CLI Console output

[root@master ~]# ipa role-add-privilege newrole --privileges="User Administrators"
  Role name: newrole
  Privileges: User Administrators, Group Administrators, Host Administrators, DNS Administrators, DNS Servers
----------------------------
Number of privileges added 1
----------------------------

[varunmylaraiah]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1893678