---

- name: "5.3.1 | L1 | PATCH | Create custom authselect profile"
  block:
      - name: "5.3.1 | L1 | PATCH | Create custom authselect profile | Gather profiles"
        shell: 'authselect current | grep "Profile ID: custom/"'
        failed_when: false
        changed_when: false
        check_mode: no
        register: rhel9cis_5_3_1_profiles

      - name: "5.3.1 | L1 | AUDIT | Create custom authselect profile | Show profiles"
        debug:
            msg:
                - "Below are the current custom profiles"
                - "{{ rhel9cis_5_3_1_profiles.stdout_lines }}"

      - name: "5.3.1 | L1 | PATCH | Create custom authselect profile | Create custom profiles"
        shell: authselect create-profile {{ rhel9cis_authselect['custom_profile_name'] }} -b {{ rhel9cis_authselect['default_file_to_copy'] }}
        args:
            warn: no
        when: rhel9cis_authselect_custom_profile_create
  when:
      - rhel9cis_rule_5_3_1
  tags:
      - level1-server
      - level1-workstation
      - patch
      - authselect
      - rule_5.3.1

- name: "5.3.2 | L1 | PATCH | Select authselect profile"
  block:
      - name: "5.3.2 | L1 | AUDIT | Select authselect profile | Gather profiles and enabled features"
        shell: "authselect current"
        args:
            warn: no
        failed_when: false
        changed_when: false
        check_mode: no
        register: rhel9cis_5_3_2_profiles

      - name: "5.3.2 | L1 | AUDIT | Select authselect profile | Show profiles"
        debug:
            msg:
                - "Below are the current custom profiles"
                - "{{ rhel9cis_5_3_2_profiles.stdout_lines }}"

      - name: "5.3.2 | L1 | PATCH | Select authselect profile | Create custom profiles"
        shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} {{ rhel9cis_authselect['options'] }}"
        args:
            warn: no
        when: rhel9cis_authselect_custom_profile_select
  when:
      - rhel9cis_rule_5_3_2
  tags:
      - level1-server
      - level1-workstation
      - patch
      - authselect
      - rule_5.3.2

- name: "5.3.3 | L1 | PATCH | Ensure authselect includes with-faillock"
  block:
      - name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock | Gather profiles and enabled features"
        shell: "authselect current | grep with-faillock"
        failed_when: false
        changed_when: false
        check_mode: no
        register: rhel9cis_5_3_3_profiles_faillock

      - name: "5.3.3 | L1 | AUDIT | Ensure authselect includes with-faillock| Show profiles"
        debug:
            msg:
                - "Below are the current custom profiles"
                - "{{ rhel9cis_5_3_3_profiles_faillock.stdout_lines }}"

      - name: "5.3.3 | L1 | PATCH | Ensure authselect includes with-faillock | Create custom profiles"
        shell: "authselect select custom/{{ rhel9cis_authselect['custom_profile_name'] }} with-faillock"
        args:
            warn: no
        when: rhel9cis_authselect_custom_profile_select
  when:
      - rhel9cis_rule_5_3_3
  tags:
      - level1-server
      - level1-workstation
      - patch
      - authselect
      - rule_5.3.3