Failure when adding service, idempotency

[p3lim]

On an already managed host (e.g. host/$FQDN is already managed) I try to add a host, service and certificate for an alternate CNAME for this host using this collection:

- name: Create host for cname
  freeipa.ansible_freeipa.ipahost:
    name: '{{ service_cname }}.{{ service_domain }}'
    ip_address: '{{ ansible_host }}'
    ipaadmin_principal: '{{ ipaadmin_principal }}'
    ipaadmin_password: '{{ ipaadmin_password }}'

- name: Create service for cname
  freeipa.ansible_freeipa.ipaservice:
    name: 'HTTP/{{ service_cname }}.{{ service_domain }}'
    principal: 'host/{{ service_cname }}.{{ service_domain }}'
    ipaadmin_principal: '{{ ipaadmin_principal }}'
    ipaadmin_password: '{{ ipaadmin_password }}'

# here goes some private key and CSR, omitted for brievity, it outputs task_csr used below

- name: Sign certificate
  become: true
  freeipa.ansible_freeipa.ipacert:
    state: requested
    csr: '{{ task_csr.csr }}'
    principal: 'HTTP/{{ service_cname }}.{{ service_domain }}'
    certificate_out: '/etc/pki/service/{{ service_cname }}.{{ service_domain }}.crt'
    ipaadmin_principal: '{{ ipaadmin_principal }}'
    ipaadmin_password: '{{ ipaadmin_password }}'

Using this the 2nd task (ipaservice) fails with this error:

fatal: [myhost]: FAILED => changed=false
  msg: 'service_add_principal: HTTP/mycname.mydomain: This entry already exists'

If I check IdM the service was created correctly.
If I start fresh (delete the host, service etc from IdM manually) and omit the 2nd task the 3rd task (signing the certificate) fails because the service principal doesn't exist.

The service is made correctly, but the task fails by its own creation (e.g. it creates the service first, then checks if it already exists, then fails because it already exists). There's some major idempotency and/or order-of-execution issues here.

Using version 1.13.2 of the collection against IdM on RHEL9.

[t-woerner]

This is a bug. Currently CNAMEs are not used for the verification if an entry already exists.