# Is the user module idempotent?

**URL:** <https://forum.ansible.com/t/is-the-user-module-idempotent/21632>\
**Category:** Ansible Project\
**Created:** [June 1, 2016, 12:28pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632 "2016-06-01T12:28:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [June 1, 2016, 12:28pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632/1 "2016-06-01T12:28:23Z")

</div>

Hi all,

I tried the following task, but it reports 'changed' each time it  
runs. Is this intentional?

- name: "create user"  
&nbsp;&nbsp;user: name="foobar"  
&nbsp;&nbsp;&nbsp;&nbsp;password="{{ some\_variable | password\_hash('sha512') }}"  
&nbsp;&nbsp;&nbsp;&nbsp;createhome=yes  
&nbsp;&nbsp;&nbsp;&nbsp;state=present  
&nbsp;&nbsp;register: some\_result\_variable

Ansible 2.1 running on OSX 10.10.5 with different linux machines as  
targets.

Johannes

---

<div class="post-metadata">

**Author:** ![Uditha\_Desilva](https://avatars.discourse-cdn.com/v4/letter/u/f475e1/32.png) [@Uditha\_Desilva](https://forum.ansible.com/u/Uditha_Desilva)\
**Post date:** [June 1, 2016, 1:25pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632/2 "2016-06-01T13:25:31Z")

</div>

I believe that’s because the password\_hash function uses a random seed, so the actual encrypted password will be different each time.

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [June 1, 2016, 3:00pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632/3 "2016-06-01T15:00:19Z")

</div>

Hi,

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [June 1, 2016, 3:07pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632/4 "2016-06-01T15:07:22Z")

</div>

That's one way, or provide the salt. From  
[http://docs.ansible.com/ansible/playbooks\_filters.html#hashing-filters](http://docs.ansible.com/ansible/playbooks_filters.html#hashing-filters)  
{{ 'secretpassword'|password\_hash('sha256', 'mysecretsalt') }}

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [June 1, 2016, 3:51pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632/5 "2016-06-01T15:51:14Z")

</div>

Alternatively, you could look at the `update_password` option for the user module. [http://docs.ansible.com/ansible/user\_module.html](http://docs.ansible.com/ansible/user_module.html)

The default is `always`

“`always` will update passwords if they differ. `on_create` will only set the password for newly created users.”

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [June 1, 2016, 4:08pm UTC](https://forum.ansible.com/t/is-the-user-module-idempotent/21632/6 "2016-06-01T16:08:19Z")

</div>

Thanks Matt, I must have overlooked that one. I can confirm that this  
solves the module reporting 'changed' on every run in my case.

Johannes