# user.state

**URL:** <https://forum.ansible.com/t/user-state/21266>\
**Category:** Ansible Project\
**Created:** [April 25, 2016, 7:11pm UTC](https://forum.ansible.com/t/user-state/21266 "2016-04-25T19:11:10Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 25, 2016, 7:11pm UTC](https://forum.ansible.com/t/user-state/21266/1 "2016-04-25T19:11:10Z")

</div>

Is it currently possible to have a conditional like:

when: “{{ item }}.user.state == present”

Thanks.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [April 25, 2016, 7:39pm UTC](https://forum.ansible.com/t/user-state/21266/2 "2016-04-25T19:39:32Z")

</div>

not really, you probably want this:

when: hostvars[inventory\_hostname][item][‘user’][‘state’] == ‘present’

in yours you are conflating ‘present’ which is a string with variables and then trying to ‘double interpolate’ neither of which will work.

---

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 25, 2016, 8:13pm UTC](https://forum.ansible.com/t/user-state/21266/3 "2016-04-25T20:13:45Z")

</div>

Hmm… Just dropping it in didn’t quite do the trick. Maybe I’d be better off iterating through the users present on my hosts, and building the conditional off the files that exist. Right now, this currently works with ignore\_errors instead of the conditional, but I’m hoping to get rid of it, so I can actually monitor it for correct runs. Here’s the full task:

- name: deploy the ssh keys  
authorized\_key:  
user: “{{ item | basename }}”  
key: “{{ lookup(‘file’, item) }}”  
when: “{{ item | basename }}.user.state == present”  
with\_fileglob:
- files/\*

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [April 25, 2016, 8:32pm UTC](https://forum.ansible.com/t/user-state/21266/4 "2016-04-25T20:32:35Z")

</div>

don’t use {{ }} in when, its already implied, you’ll get weird results, also if present is not a var, it should be quoted, again, double interpolation does not work.

when: hostvars[inventory\_hostname][item|basename][‘user’][‘state’] == “present”

---

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 25, 2016, 8:39pm UTC](https://forum.ansible.com/t/user-state/21266/5 "2016-04-25T20:39:37Z")

</div>

When I try:

- name: deploy the ssh keys  
authorized\_key:  
user: “{{ item | basename }}”  
key: “{{ lookup(‘file’, item) }}”  
when: hostvars[inventory\_hostname][item|basename][‘user’][‘state’] == “present”  
with\_fileglob:
- files/\*

I get:

fatal: [vmtest01]: FAILED! =\> {“failed”: true, “msg”: “The conditional check ‘hostvars[inventory\_hostname][item|basename][‘user’][‘state’] == "present"’ failed. The error was: error while evaluating conditional (hostvars[inventory\_hostname][item|basename][‘user’][‘state’] == "present"): ‘dict object’ has no attribute u’imntreal’\n\nThe error appears to have been in ‘/etc/ansible/roles/deploy\_ssh\_keys/tasks/main.yml’: line 14, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: deploy the ssh keys\n ^ here\n”}

Thanks.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [April 25, 2016, 8:45pm UTC](https://forum.ansible.com/t/user-state/21266/6 "2016-04-25T20:45:44Z")

</div>

so the var you are looking for does not exist in the first place, where are you setting them?

---

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 27, 2016, 3:17pm UTC](https://forum.ansible.com/t/user-state/21266/7 "2016-04-27T15:17:48Z")

</div>

Thanks for helping with this. I would up rewriting the whole thing:

- name: list users  
shell: ls /home | grep -v domain & ls /home/domain  
register: userlist

- name: set users fact  
set\_fact: users={{ userlist.stdout\_lines }}

- name: set files fact  
set\_fact: files={{ item }}  
with\_fileglob:

- files/\*  
register: files\_result

- name: set keys fact  
set\_fact: keys={{ files\_result.results | map(attribute=‘ansible\_facts.files’) | list }}

- name: deploy ssh keys  
authorized\_key:  
user: “{{ item[0] }}”  
key: “{{ lookup(‘file’,item[1]) }}”  
when: item[0] == item[1]|basename  
with\_nested:

- “{{ users }}”

- “{{ keys }}”

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [April 27, 2016, 3:22pm UTC](https://forum.ansible.com/t/user-state/21266/8 "2016-04-27T15:22:12Z")

</div>

or you can use the ‘getent’ module to list the users on the machine.

---

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 27, 2016, 3:25pm UTC](https://forum.ansible.com/t/user-state/21266/9 "2016-04-27T15:25:29Z")

</div>

The issue with going that route is these machines are members of an AD domain with over 10000 users, but only users who have actually logged in will have a home directory to deploy the SSH key to. Thanks.

---

<div class="post-metadata">

**Author:** ![Benjamin\_Redling](https://avatars.discourse-cdn.com/v4/letter/b/47e85d/32.png) [@Benjamin\_Redling](https://forum.ansible.com/u/Benjamin_Redling)\
**Post date:** [April 27, 2016, 5:39pm UTC](https://forum.ansible.com/t/user-state/21266/10 "2016-04-27T17:39:48Z")

</div>

Why deploy the key to a home directory at all?  
[https://social.technet.microsoft.com/Forums/en-US/8aa28e34-2007-49fe-a689-e28e19b2757b/is-there-a-way-to-link-ssh-key-in-ad?forum=winserverDS](https://social.technet.microsoft.com/Forums/en-US/8aa28e34-2007-49fe-a689-e28e19b2757b/is-there-a-way-to-link-ssh-key-in-ad?forum=winserverDS)

(For better or worse I am thinking of distributing public keys via  
OpenLDAP to clean up my bastion host. So I guessed AD should be able to  
accomplish that somehow too)

Benjamin

---

<div class="post-metadata">

**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\
**Post date:** [April 27, 2016, 7:19pm UTC](https://forum.ansible.com/t/user-state/21266/11 "2016-04-27T19:19:44Z")

</div>

Aren't you missing a second ampersand here?

Johannes

---

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 28, 2016, 12:31pm UTC](https://forum.ansible.com/t/user-state/21266/12 "2016-04-28T12:31:35Z")

</div>

I also have some local accounts that need to have keys deployed.

---

<div class="post-metadata">

**Author:** ![Jameson](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jameson](https://forum.ansible.com/u/Jameson)\
**Post date:** [April 28, 2016, 12:34pm UTC](https://forum.ansible.com/t/user-state/21266/13 "2016-04-28T12:34:30Z")

</div>

Now, that you mention it, I’m kind of surprised it doesn’t wind up leaving out one list or another every time it’s run, but it seems to work. The reason there’s only one is because I originally copied it from a fish shell, not bash. I think I’ll add it to be safe, though.

Thanks.