Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

user

ANSIBLE VERSION

ansible 2.3.0.0
config file = /home/user/work/git/ansible/ansible.cfg
configured module search path = [u'./library/']
python version = 2.7.5 (default, Aug 2 2016, 04:20:16) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]

CONFIGURATION

OS / ENVIRONMENT

Running from "Red Hat Enterprise Linux Server release 7.3 (Maipo)"

Managing AIX 7.1 TL04 SP02 (1614)

SUMMARY

Attempts to create user fail during setting of password.

STEPS TO REPRODUCE

ansible server -m user -a 'name=unxtst01 password="********"'

server | FAILED! => {

"changed": false,

"cmd": "/ u s r / b i n / c h p a s s w d ' ' - e ' ' - c",

"failed": true,

"msg": "[Errno 13] Permission denied",

"rc": 13

}

EXPECTED RESULTS

The password would be set without error.

ACTUAL RESULTS

$ ansible -vvvv server -m user -a 'name=unxtst01 password="letmein"'
Using /home/xxx1234/work/git/ansible/ansible.cfg as config file
Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callback/__init__.pyc
META: ran handlers
Using module file /usr/lib/python2.7/site-packages/ansible/modules/system/user.py
<server> ESTABLISH SSH CONNECTION FOR USER: None
<server> SSH: EXEC ssh -vvv -oLogLevel=quiet -oConnectTimeout=10 -oControlMaster=auto -oControlPersist=90s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ansible/.ansible/cp/827e06aeba server'/bin/sh -c '"'"'sudo -H -S -n -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-oeclakddmuojlwurlnqaljnulbngfhsd; /usr/bin/python'"'"'"'"'"'"'"'"' && sleep 0'"'"''
<server> (1, '\n{"msg": "[Errno 13] Permission denied", "failed": true, "cmd": "/ u s r / b i n / c h p a s s w d \' \' - e \' \' - c", "rc": 13, "invocation": {"module_args": {"comment": null, "ssh_key_bits": 0, "update_password": "always", "non_unique": false, "force": false, "ssh_key_type": "rsa", "ssh_key_passphrase": null, "createhome": true, "uid": null, "home": null, "append": false, "skeleton": null, "ssh_key_comment": "ansible-generated on server", "group": null, "system": false, "state": "present", "shell": null, "expires": null, "ssh_key_file": null, "groups": null, "move_home": false, "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "name": "unxtst01", "seuser": null, "remove": false, "login_class": null, "generate_ssh_key": null}}}\n', 'OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 20: Applying options for *\r\ndebug3: ciphers ok: [aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc]\r\ndebug3: macs ok: [hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160]\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket "/home/ansible/.ansible/cp/827e06aeba" does not exist\r\ndebug2: ssh_connect: needpriv 0\r\ndebug1: Connecting to server [10.30.6.242] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: fd 3 clearing O_NONBLOCK\r\ndebug1: Connection established.\r\ndebug3: timeout: 10000 ms remain after connect\r\ndebug1: identity file /home/ansible/.ssh/identity type -1\r\ndebug1: identity file /home/ansible/.ssh/identity-cert type -1\r\ndebug3: Incorrect RSA1 identifier\r\ndebug3: Could not load "/home/ansible/.ssh/id_rsa" as a RSA1 public key\r\ndebug1: identity file /home/ansible/.ssh/id_rsa type 1\r\ndebug1: identity file /home/ansible/.ssh/id_rsa-cert type -1\r\ndebug1: identity file /home/ansible/.ssh/id_dsa type -1\r\ndebug1: identity file /home/ansible/.ssh/id_dsa-cert type -1\r\ndebug1: Enabling compatibility mode for protocol 2.0\r\ndebug1: Local version string SSH-2.0-OpenSSH_6.6.1\r\ndebug1: Remote protocol version 2.0, remote software version OpenSSH_6.0\r\ndebug1: match: OpenSSH_6.0 pat OpenSSH* compat 0x04000000\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug3: load_hostkeys: loading entries for host "server" from file "/home/ansible/.ssh/known_hosts"\r\ndebug3: load_hostkeys: found key type RSA in file /home/ansible/.ssh/known_hosts:1\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa\r\ndebug1: SSH2_MSG_KEXINIT sent\r\ndebug1: SSH2_MSG_KEXINIT received\r\ndebug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex_parse_kexinit: ssh-rsa-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-rsa,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-dss\r\ndebug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc\r\ndebug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160\r\ndebug2: kex_parse_kexinit: zlib@openssh.com,zlib,none\r\ndebug2: kex_parse_kexinit: zlib@openssh.com,zlib,none\r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: first_kex_follows 0 \r\ndebug2: kex_parse_kexinit: reserved 0 \r\ndebug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\r\ndebug2: kex_parse_kexinit: ssh-rsa,ssh-dss\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96\r\ndebug2: kex_parse_kexinit: none,zlib@openssh.com\r\ndebug2: kex_parse_kexinit: none,zlib@openssh.com\r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: \r\ndebug2: kex_parse_kexinit: first_kex_follows 0 \r\ndebug2: kex_parse_kexinit: reserved 0 \r\ndebug2: mac_setup: setup hmac-md5\r\ndebug1: kex: server->client aes128-cbc hmac-md5 zlib@openssh.com\r\ndebug2: mac_setup: setup hmac-md5\r\ndebug1: kex: client->server aes128-cbc hmac-md5 zlib@openssh.com\r\ndebug1: kex: ecdh-sha2-nistp256 need=16 dh_need=16\r\ndebug1: kex: ecdh-sha2-nistp256 need=16 dh_need=16\r\ndebug1: sending SSH2_MSG_KEX_ECDH_INIT\r\ndebug1: expecting SSH2_MSG_KEX_ECDH_REPLY\r\ndebug1: Server host key: RSA 46:d0:38:19:69:0b:ae:47:82:24:10:06:04:c5:d3:f7\r\ndebug3: load_hostkeys: loading entries for host "server" from file "/home/ansible/.ssh/known_hosts"\r\ndebug3: load_hostkeys: found key type RSA in file /home/ansible/.ssh/known_hosts:1\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug3: load_hostkeys: loading entries for host "10.30.6.242" from file "/home/ansible/.ssh/known_hosts"\r\ndebug3: load_hostkeys: found key type RSA in file /home/ansible/.ssh/known_hosts:1\r\ndebug3: load_hostkeys: loaded 1 keys\r\ndebug1: Host \'server\' is known and matches the RSA host key.\r\ndebug1: Found key in /home/ansible/.ssh/known_hosts:1\r\ndebug1: ssh_rsa_verify: signature correct\r\ndebug2: kex_derive_keys\r\ndebug2: set_newkeys: mode 1\r\ndebug1: SSH2_MSG_NEWKEYS sent\r\ndebug1: expecting SSH2_MSG_NEWKEYS\r\ndebug2: set_newkeys: mode 0\r\ndebug1: SSH2_MSG_NEWKEYS received\r\ndebug1: SSH2_MSG_SERVICE_REQUEST sent\r\ndebug2: service_accept: ssh-userauth\r\ndebug1: SSH2_MSG_SERVICE_ACCEPT received\r\ndebug2: key: /home/ansible/.ssh/identity ((nil)),\r\ndebug2: key: /home/ansible/.ssh/id_rsa (0x7fcd22182bb0),\r\ndebug2: key: /home/ansible/.ssh/id_dsa ((nil)),\r\ndebug3: input_userauth_banner\r\n\nBy proceeding further, I accept the following:\n\nYou are about to access an HCA-Information Technology & Services, Inc. (IT&S)\ncomputer system. This system is to be used only by authorized users of IT&S, its\ncustomers and affiliates. As a user of this system, you have no expectation of\nprivacy rights or ownership in anything you may create, store, send or receive\non this system. By proceeding, your use of this system 1) constitutes your\nagreement that IT&S and/or your company may consent to law enforcement officials\nand agencies accessing information regarding your use of this network, 2)\nconstitutes your consent to monitoring, retrieval, and disclosure of any\ninformation within this system for all purposes deemed appropriate by IT&S,\nincluding enforcement of rules concerning unacceptable uses of this system, and\n3) constitutes your agreement to comply with all privacy, security and other\npolicies and procedures of IT&S and your company. If you have any questions\nabout what constitutes an acceptable use by you, please consult the written\npolicies provided by IT&S and your company.\n\n\ndebug1: Authentications that can continue: publickey,password,keyboard-interactive\r\ndebug3: start over, passed a different list publickey,password,keyboard-interactive\r\ndebug3: preferred gssapi-with-mic,gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod_lookup publickey\r\ndebug3: remaining preferred: ,gssapi-keyex,hostbased,publickey\r\ndebug3: authmethod_is_enabled publickey\r\ndebug1: Next authentication method: publickey\r\ndebug1: Trying private key: /home/ansible/.ssh/identity\r\ndebug3: no such identity: /home/ansible/.ssh/identity: No such file or directory\r\ndebug1: Offering RSA public key: /home/ansible/.ssh/id_rsa\r\ndebug3: send_pubkey_test\r\ndebug2: we sent a publickey packet, wait for reply\r\ndebug1: Server accepts key: pkalg ssh-rsa blen 279\r\ndebug2: input_userauth_pk_ok: fp 23:23:fa:43:d7:bb:09:0c:cd:be:1b:85:aa:48:72:d0\r\ndebug3: sign_and_send_pubkey: RSA 23:23:fa:43:d7:bb:09:0c:cd:be:1b:85:aa:48:72:d0\r\ndebug1: key_parse_private2: missing begin marker\r\ndebug1: read PEM private key done: type RSA\r\ndebug1: Enabling compression at level 6.\r\ndebug1: Authentication succeeded (publickey).\r\nAuthenticated to server ([10.30.6.242]:22).\r\ndebug1: setting up multiplex master socket\r\ndebug3: muxserver_listen: temporary control path /home/ansible/.ansible/cp/827e06aeba.CdHkoloOJP6Xe8wb\r\ndebug2: fd 4 setting O_NONBLOCK\r\ndebug3: fd 4 is O_NONBLOCK\r\ndebug3: fd 4 is O_NONBLOCK\r\ndebug1: channel 0: new [/home/ansible/.ansible/cp/827e06aeba]\r\ndebug3: muxserver_listen: mux listener channel 0 fd 4\r\ndebug2: fd 3 setting TCP_NODELAY\r\ndebug3: packet_set_tos: set IP_TOS 0x08\r\ndebug1: control_persist_detach: backgrounding master process\r\ndebug2: control_persist_detach: background process is 15150\r\ndebug2: fd 4 setting O_NONBLOCK\r\ndebug1: forking to background\r\ndebug1: Entering interactive session.\r\ndebug2: set_control_persist_exit_time: schedule exit in 90 seconds\r\ndebug1: multiplexing control connection\r\ndebug2: fd 5 setting O_NONBLOCK\r\ndebug3: fd 5 is O_NONBLOCK\r\ndebug1: channel 1: new [mux-control]\r\ndebug3: channel_post_mux_listener: new mux channel 1 fd 5\r\ndebug3: mux_master_read_cb: channel 1: hello sent\r\ndebug2: set_control_persist_exit_time: cancel scheduled exit\r\ndebug3: mux_master_read_cb: channel 1 packet type 0x00000001 len 4\r\ndebug2: process_mux_master_hello: channel 1 slave version 4\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_master_read_cb: channel 1 packet type 0x10000004 len 4\r\ndebug2: process_mux_alive_check: channel 1: alive check\r\ndebug3: mux_client_request_alive: done pid = 15152\r\ndebug3: mux_client_request_session: session request sent\r\ndebug3: mux_master_read_cb: channel 1 packet type 0x10000002 len 177\r\ndebug2: process_mux_new_session: channel 1: request tty 0, X 0, agent 0, subsys 0, term "vt220", cmd "/bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oeclakddmuojlwurlnqaljnulbngfhsd; /usr/bin/python\'"\'"\' && sleep 0\'", env 0\r\ndebug3: process_mux_new_session: got fds stdin 6, stdout 7, stderr 8\r\ndebug2: fd 6 setting O_NONBLOCK\r\ndebug2: fd 7 setting O_NONBLOCK\r\ndebug2: fd 8 setting O_NONBLOCK\r\ndebug1: channel 2: new [client-session]\r\ndebug2: process_mux_new_session: channel_new: 2 linked to control channel 1\r\ndebug2: channel 2: send open\r\ndebug2: callback start\r\ndebug2: client_session2_setup: id 2\r\ndebug1: Sending command: /bin/sh -c \'sudo -H -S -n -u root /bin/sh -c \'"\'"\'echo BECOME-SUCCESS-oeclakddmuojlwurlnqaljnulbngfhsd; /usr/bin/python\'"\'"\' && sleep 0\'\r\ndebug2: channel 2: request exec confirm 1\r\ndebug3: mux_session_confirm: sending success reply\r\ndebug2: callback done\r\ndebug2: channel 2: open confirm rwindow 0 rmax 32768\r\ndebug1: mux_client_request_session: master session id: 2\r\ndebug2: channel 2: rcvd adjust 2097152\r\ndebug2: channel_input_status_confirm: type 99 id 2\r\ndebug2: exec request accepted on channel 2\r\ndebug2: channel 2: read<=0 rfd 6 len 0\r\ndebug2: channel 2: read failed\r\ndebug2: channel 2: close_read\r\ndebug2: channel 2: input open -> drain\r\ndebug2: channel 2: ibuf empty\r\ndebug2: channel 2: send eof\r\ndebug2: channel 2: input drain -> closed\r\ndebug2: channel 2: rcvd eof\r\ndebug2: channel 2: output open -> drain\r\ndebug2: channel 2: obuf empty\r\ndebug2: channel 2: close_write\r\ndebug2: channel 2: output drain -> closed\r\ndebug2: channel 2: send close\r\ndebug1: client_input_channel_req: channel 2 rtype exit-status reply 0\r\ndebug3: mux_exit_message: channel 2: exit message, exitval 1\r\ndebug2: channel 2: rcvd close\r\ndebug3: channel 2: will not send data after close\r\ndebug2: channel 2: is dead\r\ndebug2: channel 2: gc: notify user\r\ndebug3: mux_master_session_cleanup_cb: entering for channel 2\r\ndebug2: channel 1: rcvd close\r\ndebug2: channel 1: output open -> drain\r\ndebug2: channel 1: close_read\r\ndebug2: channel 1: input open -> closed\r\ndebug2: channel 2: gc: user detached\r\ndebug2: channel 2: is dead\r\ndebug2: channel 2: garbage collecting\r\ndebug1: channel 2: free: client-session, nchannels 3\r\ndebug3: channel 2: status: The following connections are open:\r\n #2 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)\r\n\r\ndebug2: channel 1: obuf empty\r\ndebug2: channel 1: close_write\r\ndebug3: mux_client_read_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 1\r\ndebug2: channel 1: output drain -> closed\r\ndebug2: channel 1: is dead (local)\r\ndebug2: channel 1: gc: notify user\r\ndebug3: mux_master_control_cleanup_cb: entering for channel 1\r\ndebug2: channel 1: gc: user detached\r\ndebug2: channel 1: is dead (local)\r\ndebug2: channel 1: garbage collecting\r\ndebug1: channel 1: free: mux-control, nchannels 2\r\ndebug3: channel 1: status: The following connections are open:\r\n\r\ndebug2: set_control_persist_exit_time: schedule exit in 90 seconds\r\n')
server | FAILED! => {
"changed": false,
"cmd": "/ u s r / b i n / c h p a s s w d ' ' - e ' ' - c",
"failed": true,
"invocation": {
"module_args": {
"append": false,
"comment": null,
"createhome": true,
"expires": null,
"force": false,
"generate_ssh_key": null,
"group": null,
"groups": null,
"home": null,
"login_class": null,
"move_home": false,
"name": "unxtst01",
"non_unique": false,
"password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
"remove": false,
"seuser": null,
"shell": null,
"skeleton": null,
"ssh_key_bits": 0,
"ssh_key_comment": "ansible-generated on server",
"ssh_key_file": null,
"ssh_key_passphrase": null,
"ssh_key_type": "rsa",
"state": "present",
"system": false,
"uid": null,
"update_password": "always"
}
},
"msg": "[Errno 13] Permission denied",
"rc": 13
}

Issue 2:
---
- hosts: localhost
tasks:
- name: test task
debug: msg=test
when: False
when: True
when: False

Test task is skipped in this configuration, but if you comment out the last line, it is launched. Experiments showed, that only last when statement is considered by ansible. I see two ways to fix this:

make multiple when statements work with 'AND' logic

return error if multiple when statements are used