# Centralized User List

**URL:** <https://forum.ansible.com/t/centralized-user-list/14029>\
**Category:** Ansible Project\
**Created:** [November 29, 2013, 2:45am UTC](https://forum.ansible.com/t/centralized-user-list/14029 "2013-11-29T02:45:26Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [November 29, 2013, 2:45am UTC](https://forum.ansible.com/t/centralized-user-list/14029/1 "2013-11-29T02:45:26Z")

</div>

Good evening all!

I am new to Ansible (only 2 days in), but am quite excited by the prospects.

I have a laundry list of questions but I figured it’d be best to separate them into multiple posts to help people searching these lists in the future.

The first question is:…

- After much searching, I found an archived exchange that points out a way to have a list of users in a group\_vars/xxxx.yaml file, and then in a “add\_users.yaml” playbook, do something like the following:

> **_1 —_**  
> **_2 - hosts: all_**  
> **_3 vars\_files:_**  
> **_4 - /etc/ansible/group\_vars/[some-group-name-goes-here]/users.yaml_**  
> **_5 tasks:_**  
> **_6 - name: Create user._**  
> **_7 user: home=/home/{{ item }} name={{ item }} shell=/bin/bash state=present_**  
> **_8 with\_items: users_**  
> **_9 - name: copy per-user ssh key (authorized\_keys2) to the destination server_**  
> **_10 action: copy src=/usr/share/ansible/files/ssh/{{ item }}/authorized\_keys2 dest=/home/{{ item }}/.ssh/authorized\_keys2 mode=755_**  
> **_11 with\_items: users_**

This works quite well (thank to to whomever it was who posted that solution). However, I personally don’t like the idea of having to maintain multiple files of users per group/pattern. What I’d like to be able to do, is the same way I have 1 hosts file (/etc/ansible/hosts) that has _all_ of my hosts and groups in one nicely organized file, I would like to have one giant users.yaml which has different groups of users (ie: one for the database boxes, one for the staging boxes, one for the production boxes, etc.)

Perhaps I’m thinking of this the wrong way, but it seems like something that should be easy to do. This is kind of a “global variable” concept, I’d just like to centralize the management of this.

Any thoughts on the syntax to properly do this? Thanks!!! :o)

---

<div class="post-metadata">

**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\
**Post date:** [November 29, 2013, 10:56pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/2 "2013-11-29T22:56:05Z")

</div>

Let me show you how I do this.

I have a vars file with al my users containing:

1/ A list of users with config details:

user:  
paul:  
description: Paul McCartney  
uid: 1001  
ringo  
description: Ringo Star  
uid: 1002  
…

2/ several lists of users, e.g.

users\_apple\_admin:

- paul
- john

users\_apple\_dev:

- ringo
- george

…

Then, in the inventory, e.g. for the group “apple”, I define:

users\_admin:

- “{{users\_apple\_admin}}”

users\_dev:

- “{{users\_apple\_dev}}”
- "{{users\_virgin\_dev}}

Finally, in a playbooks role, where I create all users, I call the role with:

- role: real\_user  
real\_user\_list:
- “{{users\_admin}}”
- “{{users\_dev}}”

and in the role, the create user tasks uses this loop

action:  
module: user  
name: “{{ item }}”  
comment: “{{ user[item][‘description’] }}”  
uid: “{{ user[item][‘uid’] }}”  
with\_flattened: real\_user\_list

Elsewhere, where I create groups, I’ll do something like this

- name: Assign Developer roles  
action:  
module: user  
name: “{{ item }}”  
groups: “{{ lookup(‘flattened’, groups\_dev) }}”  
append: “yes”  
state: present  
with\_flattened: users\_dev

Where groups\_dev is set somewhere in the inventory, and is a list of groups that developers should be member of, for the group where it was set.

groups\_dev:

- developers
- tomcat\_user

…

Hope this helps,

Serge

---

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [November 30, 2013, 2:30am UTC](https://forum.ansible.com/t/centralized-user-list/14029/3 "2013-11-30T02:30:10Z")

</div>

First off, allow me to thank you for your post. I was able to get what I wanted by looking over your code. However, perhaps I am grossly over simplifying things, but here’s my set up now:

> _ **$ cat /etc/ansible/users.yaml** _  
> _ **all\_users:** _  
> _ **- user1** _  
> _ **- user2** _  
> _ **- user3** _  
> _ **- user4** _  
> _ **- user5** _  
> _ **- user6** _
> 
> _ **Ops:** _  
> _ **- user1** _  
> _ **- user2** _  
> _ **- user3** _  
> _ **- user4** _
> 
> _ **databaseTeam:** _  
> _ **- user5** _  
> _ **- user6** _

Then, in my add\_users.yaml file:

> **_—_**  
> **_- hosts: all_**  
> **_vars\_files:_**  
> **_- /etc/ansible/users.yaml_**  
> **_tasks:_**  
> **_- name: Create user._**  
> **_user: home=/home/{{ item }} name={{ item }} shell=/bin/bash state=present_**  
> **_with\_items: Ops_**  
> **_- name: copy per-user ssh key (authorized\_keys2) to the destination server_**  
> **_action: copy src=/usr/share/ansible/files/ssh/{{ item }}/authorized\_keys2 dest=/home/{{ item }}/.ssh/authorized\_keys2 mode=755_**  
> **_with\_items: Ops_**

This works, and I like it becuase I have one centralized users.yaml file to edit whenever someone joins/leaves.

The only question remaining I have, is how to make the add\_users.yaml file even more generic. What I’d like to do is something like:

> **_—_**  
> **_- hosts: all_**  
> **_vars\_files:_**  
> **_- /etc/ansible/users.yaml_**  
> **_tasks:_**  
> **_- name: Create user._**  
> **_user: home=/home/{{ item }} name={{ item }} shell=/bin/bash state=present_**  
> **_with\_items: accounts\_to\_add_**  
> **_- name: copy per-user ssh key (authorized\_keys2) to the destination server_**  
> **_action: copy src=/usr/share/ansible/files/ssh/{{ item }}/authorized\_keys2 dest=/home/{{ item }}/.ssh/authorized\_keys2 mode=755_**  
> **_with\_items: accounts\_to\_add_**

and then run: _ **ansible-playbook add\_users.yaml -u root --check --extra-vars “accounts\_to\_add=databaseTeam”** _

to only add the databaseTeam.

Basically, I’m looking to make this thing as modular as humanly possible, and hardcode as little as possible.  
(Note: the above throws an error and does not “expand” on accounts\_to\_add)

**TASK: [Create user.] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***  
**changed: [xxxxxxxxx] =\> (item=databaseTeam)**

**TASK: [copy per-user ssh key (authorized\_keys2) to the destination server] \*\*\*\***  
**failed: [xxxxxxxxx] =\> (item=databaseTeam)**

---

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [November 30, 2013, 4:03am UTC](https://forum.ansible.com/t/centralized-user-list/14029/4 "2013-11-30T04:03:01Z")

</div>

OK, I got it working, but would still like to see if someone could view and see if it’s the “right” way of doing it. Since I’m still learning, I’d like to learn the proper way of doing it (I’m assuming this has something to do with roles?

1. users.yaml

> _ **$ cat /etc/ansible/users.yaml** _  
> _ **all\_users:** _
> 
>  
> _ **- user1** _
> 
>  
> 
>  
> _ **- user2** _
> 
>  
> 
>  
> _ **- user3** _
> 
>  
> 
> _ **- user4** _  
> _ **- user5** _  
> _ **- user6** _
> 
> _ **Ops:** _
> 
>  
> _ **- user1** _
> 
>  
> 
>  
> _ **- user2** _
> 
>  
> 
>  
> _ **- user3** _
> 
>  
> 
> _ **- user4** _

> 

> _ **databaseTeam:** _  
> _ **- user5** _  
> _ **- user6** _

1. add\_users.yaml

> **_1 —_**  
> **_2 - hosts: all_**  
> **_3 vars\_files:_**  
> **_4 - /etc/ansible/users.yaml_**  
> **_5 tasks:_**  
> **_6 - name: Create user._**  
> **_7 user: home=/home/{{ item }} name={{ item }} shell=/bin/bash state=present_**  
> **_8 with\_items: $accounts\_to\_add_**  
> **_9 - name: copy per-user ssh key (authorized\_keys2) to the destination server_**  
> **_10 action: copy src=/usr/share/ansible/files/ssh/{{ item }}/authorized\_keys2 dest=/home/{{ item }}/.ssh/authorized\_keys2 mode=755_**  
> **_11 with\_items: $accounts\_to\_add_**

1. xyz\_boxes.yaml

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [November 30, 2013, 1:02pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/5 "2013-11-30T13:02:45Z")

</div>

" **_11 with\_items: $accounts\_to\_add"_**

**_Legacy variable usage, which 1.4 will rightfully warn you about. Correct:_**

**_with\_items: accounts\_to\_add_**

---

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [November 30, 2013, 1:52pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/6 "2013-11-30T13:52:03Z")

</div>

I had thought I had read that that was legacy, however for some reason when I did just "accounts\_to\_add" it was taking it literally and not as a variable to expand.

Will take another look.

---

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [November 30, 2013, 2:02pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/7 "2013-11-30T14:02:57Z")

</div>

As it turns out, the updates repo in FC19 only has 1.3.4 as the latest version, which might be why it wasn’t working the other way.

---

<div class="post-metadata">

**Author:** ![Pete\_Emerson](https://avatars.discourse-cdn.com/v4/letter/p/ee7513/32.png) [@Pete\_Emerson](https://forum.ansible.com/u/Pete_Emerson)\
**Post date:** [December 4, 2013, 7:32pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/8 "2013-12-04T19:32:26Z")

</div>

I just followed this example with:

ansible 1.5 (devel 7aa35d64c2) last updated 2013/12/04 19:15:46 (GMT +000)

and it only works for me with the $ in front of accounts\_to\_add.

GATHERING FACTS \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [ubuntu-01]

TASK: [Add group {{item.name}}] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [ubuntu-01] =\> One or more undefined variables: ‘unicode object’ has no attribute ‘name’

---

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [December 8, 2013, 2:17am UTC](https://forum.ansible.com/t/centralized-user-list/14029/9 "2013-12-08T02:17:18Z")

</div>

Thanks for the follow up Pete!

I have not gotten a chance to check any further into this, especially since it’s working with the $$ and not throwing warnings, I’ve moved ahead with this solution until I can upgrade / it starts warning.

However it’s interesting that your 1.5 version still functions the same as my 1.3.x version.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [December 8, 2013, 3:57pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/10 "2013-12-08T15:57:02Z")

</div>

“and it only works for me with the $ in front of accounts\_to\_add”

Are you sure you are running 1.5? (see ansible --version?)

I use list variables without a prefix all of the time and it’s fine.

with\_items: imalist

etc

---

<div class="post-metadata">

**Author:** ![BrianAI](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@BrianAI](https://forum.ansible.com/u/BrianAI)\
**Post date:** [December 9, 2013, 5:09pm UTC](https://forum.ansible.com/t/centralized-user-list/14029/11 "2013-12-09T17:09:24Z")

</div>

FC19 just got 1.4.1:

$ ansible --version  
ansible 1.4.1

and I still can only get it to work with $ in front:

**TASK: [Create user.] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***  
**changed: [server1] =\> (item=Ops)**

(vs)

**TASK: [Create user.] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***  
**changed: [server1] =\> (item=user1)**  
**changed: [server1] =\> (item=user2)**  
**changed: [server1] =\> (item=user3)**  
**changed: [server1] =\> (item=user4)**