# Recommended approach for adding/managing multiple system level users?

**URL:** <https://forum.ansible.com/t/recommended-approach-for-adding-managing-multiple-system-level-users/12069>\
**Category:** Ansible Project\
**Created:** [November 5, 2012, 10:17pm UTC](https://forum.ansible.com/t/recommended-approach-for-adding-managing-multiple-system-level-users/12069 "2012-11-05T22:17:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![seanosh](https://avatars.discourse-cdn.com/v4/letter/s/9fc29f/32.png) [@seanosh](https://forum.ansible.com/u/seanosh)\
**Post date:** [November 5, 2012, 10:17pm UTC](https://forum.ansible.com/t/recommended-approach-for-adding-managing-multiple-system-level-users/12069/1 "2012-11-05T22:17:53Z")

</div>

Assuming:

- I have X servers,
- With Y users requiring access under their own unique accounts,
- And not all Y users are required on every X server (although this isn’t a hard requirement),
- And Z of the Y users need to be in a different group (for more access or sudo rights based on group),
- And each user having their own authorized key file for SSH…

What would be the recommended approach in the structuring of the playbooks/tasks? I’ve thought through a few different solutions (using --extra-vars for example to pass in on a per-user basis the variables needed, or using with\_items) but it felt “kludge-y” when attempting to implement…

---

<div class="post-metadata">

**Author:** ![Mark\_Maas](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@Mark\_Maas](https://forum.ansible.com/u/Mark_Maas)\
**Post date:** [November 18, 2012, 10:12am UTC](https://forum.ansible.com/t/recommended-approach-for-adding-managing-multiple-system-level-users/12069/2 "2012-11-18T10:12:35Z")

</div>

> Assuming:
> 
> - I have X servers,
> - With Y users requiring access under their own unique accounts,
> - And not all Y users are required on every X server (although this isn’t a hard requirement),
> - And Z of the Y users need to be in a different group (for more access or sudo rights based on group),

I’d split out the Z and Y users in two different groups to begin with. and put those users in a vars\_file or in a group\_vars ([http://ansible.cc/docs/playbooks2.html#variable-file-separation](http://ansible.cc/docs/playbooks2.html#variable-file-separation) and [http://ansible.cc/docs/patterns.html#groups-of-groups-and-group-variables](http://ansible.cc/docs/patterns.html#groups-of-groups-and-group-variables) and [http://ansible.cc/docs/patterns.html#splitting-out-host-and-group-specific-data](http://ansible.cc/docs/patterns.html#splitting-out-host-and-group-specific-data))

> - And each user having their own authorized key file for SSH…
> 
> What would be the recommended approach in the structuring of the playbooks/tasks? I’ve thought through a few different solutions (using --extra-vars for example to pass in on a per-user basis the variables needed, or using with\_items) but it felt “kludge-y” when attempting to implement…

You can then combine those things with this users setup: [https://groups.google.com/forum/?fromgroups=#!topic/ansible-project/3nRKU5AemYA](https://groups.google.com/forum/?fromgroups=#!topic/ansible-project/3nRKU5AemYA), look at nigelm’s setup. It’s all you need/want.