# Help simplify my user management

**URL:** <https://forum.ansible.com/t/help-simplify-my-user-management/15547>\
**Category:** Ansible Project\
**Created:** [June 25, 2014, 6:09pm UTC](https://forum.ansible.com/t/help-simplify-my-user-management/15547 "2014-06-25T18:09:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pete\_Emerson](https://avatars.discourse-cdn.com/v4/letter/p/ee7513/32.png) [@Pete\_Emerson](https://forum.ansible.com/u/Pete_Emerson)\
**Post date:** [June 25, 2014, 6:09pm UTC](https://forum.ansible.com/t/help-simplify-my-user-management/15547/1 "2014-06-25T18:09:10Z")

</div>

I haven’t seen the “right” way to organizer users, so here’s my attempt, but it seems to me like it should be a bit simpler.

[https://gist.github.com/pete0emerson/ba331fd0defba6d2dd7c](https://gist.github.com/pete0emerson/ba331fd0defba6d2dd7c)

Why I organized things this way:

1. I want to only define users once, in one place (users.yaml)

2. I want to map groups of users in one place as well (user\_groups.yaml)

3. I want the definition of a user to be in one place (user\_definition.yaml)

4. Right now I’m saving usergroups for later (this is an MVP)

5. I’m saving _disabling_ of users for later as well (in a pinch I can revoke their ssh key)

Where I’d like some guidance:

The playbook that I run (users\_playbook.yaml) maps hosts to groups of users. But I currently specify the host group twice:

- hosts: haproxy  
include: user\_definition.yaml accounts\_to\_add=users\_haproxy hosts=haproxy

It seems strange to have the "- hosts: " section in both the users\_playbook.yaml and the user\_definition.yaml file, passing the host group from one to the other in a variable. Is there a nicer way to do this?

Any other comments such as “this is a very un-Ansible way of organizing things, try it this way” et cetera are very welcome. I’d love to see a “best practices” document come to life centered around these sorts of things.

Thanks,  
Pete

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [June 26, 2014, 12:15am UTC](https://forum.ansible.com/t/help-simplify-my-user-management/15547/2 "2014-06-26T00:15:34Z")

</div>

I’ll leave others to comment, but in the era of roles, a raw parameterized include is becoming increasingly a rare thing.

–Michael

---

<div class="post-metadata">

**Author:** ![Pete\_Emerson](https://avatars.discourse-cdn.com/v4/letter/p/ee7513/32.png) [@Pete\_Emerson](https://forum.ansible.com/u/Pete_Emerson)\
**Post date:** [June 26, 2014, 4:18am UTC](https://forum.ansible.com/t/help-simplify-my-user-management/15547/3 "2014-06-26T04:18:16Z")

</div>

Does that mean you’d recommend creating a “user” role, or that in my “haproxy” role I’d include user definitions? I’m not sure what the organization would look like.

Pete