Is the user module idempotent?

Archives Ansible Project
1

Hi all,

I tried the following task, but it reports 'changed' each time it
runs. Is this intentional?

- name: "create user"
  user: name="foobar"
    password="{{ some_variable | password_hash('sha512') }}"
    createhome=yes
    state=present
  register: some_result_variable

Ansible 2.1 running on OSX 10.10.5 with different linux machines as
targets.

Johannes

2

I believe that’s because the password_hash function uses a random seed, so the actual encrypted password will be different each time.

3

Hi,

4

That's one way, or provide the salt. From
http://docs.ansible.com/ansible/playbooks_filters.html#hashing-filters
{{ 'secretpassword'|password_hash('sha256', 'mysecretsalt') }}

5

Alternatively, you could look at the update_password option for the user module. http://docs.ansible.com/ansible/user_module.html

The default is always

“always will update passwords if they differ. on_create will only set the password for newly created users.”

6

Thanks Matt, I must have overlooked that one. I can confirm that this
solves the module reporting 'changed' on every run in my case.

Johannes