Ansible User module - how to tell it to remove expired user accounts? - ansible

Question

I am setting up user administration through Ansible for the first time. Can I use Ansible's user module to remove accounts that are past their expiration date? What conditional statement would I use?
Pardon my untested pseudocode, but I am looking for something like the following:
tasks:
- name: remove expired users
user: name=users.key state=absent force=yes
when: expired <----- what condition do I put here?
with_dict: users

Answer 1

You can use the shell module to get back the list of users on each host that are expired (as in useradd -e $expire_time) and then pass that to the user module.
As an example we can set up some users that expire around now:
sudo useradd testexpires -e 2015-09-24
sudo useradd testexpires2 -e 2015-09-22
sudo useradd testexpires3 -e 2015-09-21
sudo useradd testexpires4 -e 2015-09-28
sudo useradd testexpires5 -e 2015-09-21
sudo cat /etc/shadow then shows:
...
testexpires:!:16701:0:99999:7::16702:
testexpires2:!:16701:0:99999:7::16700:
testexpires3:!:16701:0:99999:7::16699:
testexpires4:!:16701:0:99999:7::16706:
testexpires5:!:16701:0:99999:7::16699:
We can then check whether that epoch date in the 8th column is older than today by using this reasonably horribly shell one liner:
sudo cat /etc/shadow | cut -d: -f1,8 | awk -F: '{if($2<{{ epoch_day }} && $2 != ""){print $0}}' | cut -d: -f1
We can easily get the epoch date using Ansible's built in ansible_date_time variable which gives us the epoch time in seconds and dividing through using Jinja's math filters:
epoch_day : "{{ ansible_date_time.epoch | int / 86400 | round() }}"
Putting this together (and escaping out the quotes in the awk) gives us a playbook that if you wanted to run it on localhost would look something like this:
- hosts : localhost
connection : local
gather_facts : yes
vars :
epoch_day : "{{ ansible_date_time.epoch | int / 86400 | round() }}"
tasks :
- name : debug epoch day
debug : var=epoch_day
- name : get users expired before today
shell : "cat /etc/shadow | cut -d: -f1,8 | awk -F: '{if($2<{{ epoch_day }} && $2 != \"\"){print $0}}' | cut -d: -f1"
changed_when : False
register : expired_users
- name : debug expired_users
debug : var=expired_users.stdout_lines
- name : remove expired users
user :
name : "{{ item }}"
state : absent
force : yes
with_items : expired_users.stdout_lines
Running this playbook when you don't have any expired users will make Ansible skip the last task because you don't have any items to pass to the task.

Answer 2

I simply maintain two lists of users: "current" and "former". Don't delete a user, move it from one list to the other.
tasks:
- name: ensure users
user: name=item.key state=present force=yes
with_dict: current_users
tasks:
- name: remove expired users
user: name=item.key state=absent force=yes
with_dict: former_users
If you wish to search for user accounts you'll need to script it, remove system accounts, etc.