# Managing users playbook -- could use a clever idea

**URL:** <https://forum.ansible.com/t/managing-users-playbook-could-use-a-clever-idea/17982>\
**Category:** Ansible Project\
**Created:** [April 15, 2015, 1:50pm UTC](https://forum.ansible.com/t/managing-users-playbook-could-use-a-clever-idea/17982 "2015-04-15T13:50:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rishi](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@Rishi](https://forum.ansible.com/u/Rishi)\
**Post date:** [April 15, 2015, 1:50pm UTC](https://forum.ansible.com/t/managing-users-playbook-could-use-a-clever-idea/17982/1 "2015-04-15T13:50:56Z")

</div>

I have a role that manages my users on my boxes, problem I am having is I have two tasks that modify the “groups” properties of users. This is obviously stupid since they keep changing each other, giving my false change notifications when I run ansible.

I have separate global/group/host vars that are just a list of usernames that get “sudo” access on a box which is why I currently separate it out into a separate task.

Anyone have an idea on how to merge theses? I was thinking of using set\_fact to build the list of groups first and then running the user module once. I couldn’t figure out if set\_fact supports a “when” clause though.

- name: manage user groups  
user:  
name: ‘{{ item.name }}’  
state: ‘{{ item.state | default(“present”) }}’  
groups: ‘{{ item.groups | join(“,”) }}’  
append: ‘{{ item.append | default(“no”) }}’  
with\_flattened:

- users\_global\_list

- users\_group\_list

- users\_host\_list  
when: ((item.name is defined and item.name) and (item.groups is defined and item.groups))

- name: manage admins  
user:  
name: ‘{{ item.name }}’  
state: ‘{{ item.state | default(“present”) }}’  
groups: ‘{{ users\_default\_admin\_group }}’  
append: ‘yes’  
with\_flattened:

- users\_global\_list

- users\_group\_list

- users\_host\_list  
when: ((item.name is defined and item.name) and  
(item.name in users\_global\_admins or  
item.name in users\_group\_admins or  
item.name in users\_host\_admins))