Issue 1:
ISSUE TYPE

bug report

COMPONENT NAME

authorized_key module

ANSIBLE VERSION

2.4.2

CONFIGURATION

No changes from defaults

OS / ENVIRONMENT

manager: Ubuntu 14.04.5 LTS

managed host: CentOS Linux release 7.4.1708 (Core)

SUMMARY

:**

I have a set of tasks that removes local users and removes their authorized_keys file using the authorized_key module.

If I run a play that first deletes the user when the authorized_keys module attempts to remove the key it fails with the error message:

failed: [centos1] (item={u'comment': u'ALMDG Joe Bloggs', u'state': u'absent', u'user': u'joebloggs', u'groups': u'admins'}) => {"changed": false, "item": {"comment": "Joe Bloggs", "groups": "admins", "state": "absent", "user": "joebloggs"}, "msg": "Failed to lookup user joebloggs: 'getpwnam(): name not found: joebloggs'"}
**

STEPS TO REPRODUCE

**

- create an inventory with the following contents:

[centos7test]
centos1 ansible_ssh_pass=vagrant ansible_ssh_user=vagrant ansible_ssh_private_key_file=.vagrant/machines/centos1/virtualbox//private_key

[vagrant_security_management:children]
centos7test

- create a playbook with the following contents:

---
- hosts: centos7test
gather_facts: yes
become: yes
roles:
- role: security-management-linux

- create a file /group_vars/vagrant_security_management.yml with the following contents

#==========================================================
# Groups
# To add the group to servers set the state to present
# To remove the group from servers set the state to absent
#==========================================================
almdc_groups:
- { name: almdc_admins, comment: "Admins Group", state: present }

#==========================================================
# To add them to servers set the state to present
# To remove them from servers set the state to absent
#==========================================================
almdc_users:
- { user: chriskinsella, comment: "Chris Kinsella", groups: "almdc_admins", state: present }
- { user: joebloggs, comment: "Joe Bloggs" , groups: "almdc_admins", state: present }

- create a role "security-management-linux" with the following file:
roles/security-management-linux/tasks/main.yml

---
- name: Main | Manage Groups
include_tasks: groups.yml
- name: Main | Onboard & Offboard Users by adding/removing user accounts, home directories and ssh keys
include_tasks: users.yml

- create /roles/security-management-linux/tasks/groups.yml

---
- name: Groups | Create groups
group:
name: "{{ item.name }}"
state: "{{ item.state }}"
with_items:
- "{{ almdc_groups }}"

- create /roles/security-management-linux/tasks/users.yml

---

# Notice the “expires” line in the YAML file below.
# It’s the time the account should be expired from.
# It’s in Epoch time.
# To get the NOW time in this format, go to “http://www.epochconverter.com/”.

- name: Users | Create ALMDG Users in almdc_users
user:
createhome: yes
comment: "{{ item.comment }}"
expires: 1609459199 # Set to 2020-12-31 23:59:59
groups: "{{ item.groups }}"
name: "{{ item.user }}"
shell: "/bin/bash"
state: "{{ item.state }}"
remove: yes
with_items:
- "{{ almdc_users }}"

- name: Users | Manage SSH Public Keys
authorized_key:
key: "{{ lookup('file', 'files/' + item.user + '.pub') }}"
user: "{{ item.user }}"
comment: "{{ item.user }}"
manage_dir: yes
state: present #"{{ item.state }}"
with_items:
- "{{ almdc_users }}"

- create 2 ssh keypairs for the users (can be anything) and copy the contents of the .pub files to these files:

roles/security-management-linux/files/chriskinsella.pub
roles/security-management-linux/files/joebloggs.pub

- Run the play via:

ansible-playbook security-management.yml -i alm-inventory-vagrant-security_management.ini

- the group, 2 users and authorized_keys populated correctly

- modify the file /group_vars/vagrant_security_management.yml with the following contents setting almdc_users.user=joebloggs state to absent

#==========================================================
# Groups
# To add the group to servers set the state to present
# To remove the group from servers set the state to absent
#==========================================================
almdc_groups:
- { name: almdc_admins, comment: "Admins Group", state: present }

#==========================================================
# To add them to servers set the state to present
# To remove them from servers set the state to absent
#==========================================================
almdc_users:
- { user: chriskinsella, comment: "Chris Kinsella", groups: "almdc_admins", state: present }
- { user: joebloggs, comment: "Joe Bloggs" , groups: "almdc_admins", state: absent }

- Run the play again via:

ansible-playbook security-management.yml -i alm-inventory-vagrant-security_management.ini

- the group and chriskinsella user remain unaffected.
- the joebloggs user is deleted but the "- name: Users | Manage SSH Public Keys" task gives the following error

failed: [centos1] (item={u'comment': u'ALMDG Joe Bloggs', u'state': u'absent', u'user': u'joebloggs', u'groups': u'almdc_admins'}) => {"changed": false, "item": {"comment": "ALMDG Joe Bloggs", "groups": "almdc_admins", "state": "absent", "user": "joebloggs"}, "msg": "Failed to lookup user joebloggs: 'getpwnam(): name not found: joebloggs'"}

**

EXPECTED RESULTS

**

the "Users | Manage SSH Public Keys]" task should:

continue on the user not existing as we are Setting state to absent for the key

remove the ssh key from /home/users/joebloggs/.ssh/authorized_keys if it is present and the file exists

thanks

Chris

Issue 2:
ISSUE TYPE

bug report

COMPONENT NAME

authorized_key module

ANSIBLE VERSION

1.9.1

CONFIGURATION

No changes from defaults

OS / ENVIRONMENT

Both manager and managed host are Ubuntu 14.04

SUMMARY

:**

I have a set of tasks that create local users and manage their authorized_keys file using the authorized_key module. If I run a play containing these tasks in check mode against a brand-new managed host, the user creation is skipped as expected, but the authorized_key module fails because the user doesn't exist:

**

STEPS TO REPRODUCE

**

Create a play with the following contents:

---
- hosts: localhost
become: yes
- tasks
- name: Manage nonexistent user's ssh keys
authorized_key:
user: some_user_that_dont_exist
key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSxrCsbXg6bXZglxShkbSQoOHAU6/1M+K+jRgv8qvQ3sEYDD1s1Rsjj+M5iBS94ZIGEujkMdKm/DjdymMbyQMYm0z8EfMBF6BCuHCwqP89TmXNd01Su9YajMB7C6E8RsbUh7MsMRuLd7EoXqHwCqUVNo8Pywdgcfnfmxy+O/KdyQNyhct8gjxcESlSys4FJiey5saRW3HOvuYcwlC4YGHD1ikW18p09NAhRR1pZf1AKp4gVsBduzONfj3t4rLi/9WW1SoMJAQ5IynK/856GBRy4HX1BtoHxEQfORCVFtPLprHLTfS7nFMoNMyFvYgJsFh90DQxAtYWXFEaRm7zh/Qt

Execute the playbook with the following command:

> ansible-playbook <play> -vvv --check

**

EXPECTED RESULTS

**

I'm not 100% sure, but they should be successful.

**

ACTUAL RESULTS

:**

<localhost> ESTABLISH CONNECTION FOR USER: <user>
<localhost> REMOTE_MODULE authorized_key key='ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSxrCsbXg6bXZglxShkbSQoOHAU6/1M+K+jRgv8qvQ3sEYDD1s1Rsjj+M5iBS94ZIGEujkMdKm/DjdymMbyQMYm0z8EfMBF6BCuHCwqP89TmXNd01Su9YajMB7C6E8RsbUh7MsMRuLd7EoXqHwCqUVNo8Pywdgcfnfmxy+O/KdyQNyhct8gjxcESlSys4FJiey5saRW3HOvuYcwlC4YGHD1ikW18p09NAhRR1pZf1AKp4gVsBduzONfj3t4rLi/9WW1SoMJAQ5IynK/856GBRy4HX1BtoHxEQfORCVFtPLprHLTfS7nFMoNMyFvYgJsFh90DQxAtYWXFEaRm7zh/Qt' user=some_user_that_dont_exist CHECKMODE=True
<localhost> EXEC /bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1434226493.05-198959850076873 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1434226493.05-198959850076873 && echo $HOME/.ansible/tmp/ansible-tmp-1434226493.05-198959850076873'
<localhost> PUT /tmp/tmpX7FWmW TO /home/<user>/.ansible/tmp/ansible-tmp-1434226493.05-198959850076873/authorized_key
<localhost> /bin/sh -c 'sudo -k && sudo -H -S -p "[sudo via ansible, key=aibazwkoommurhcmfiulnxkntybmefsg] password: " -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-aibazwkoommurhcmfiulnxkntybmefsg; LANG=en_US.UTF-8 LC_CTYPE=en_US.UTF-8 /usr/bin/python /home/<user>/.ansible/tmp/ansible-tmp-1434226493.05-198959850076873/authorized_key; rm -rf /home/<user>/.ansible/tmp/ansible-tmp-1434226493.05-198959850076873/ >/dev/null 2>&1'"'"''
failed: [localhost] => (item=({'is_admin': True, 'name': 'some_user_that_dont_exist'}, 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSxrCsbXg6bXZglxShkbSQoOHAU6/1M+K+jRgv8qvQ3sEYDD1s1Rsjj+M5iBS94ZIGEujkMdKm/DjdymMbyQMYm0z8EfMBF6BCuHCwqP89TmXNd01Su9YajMB7C6E8RsbUh7MsMRuLd7EoXqHwCqUVNo8Pywdgcfnfmxy+O/KdyQNyhct8gjxcESlSys4FJiey5saRW3HOvuYcwlC4YGHD1ikW18p09NAhRR1pZf1AKp4gVsBduzONfj3t4rLi/9WW1SoMJAQ5IynK/856GBRy4HX1BtoHxEQfORCVFtPLprHLTfS7nFMoNMyFvYgJsFh90DQxAtYWXFEaRm7zh/Qt')) => {"failed": true, "item": [{"is_admin": true, "name": "some_user_that_dont_exist"}, "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSxrCsbXg6bXZglxShkbSQoOHAU6/1M+K+jRgv8qvQ3sEYDD1s1Rsjj+M5iBS94ZIGEujkMdKm/DjdymMbyQMYm0z8EfMBF6BCuHCwqP89TmXNd01Su9YajMB7C6E8RsbUh7MsMRuLd7EoXqHwCqUVNo8Pywdgcfnfmxy+O/KdyQNyhct8gjxcESlSys4FJiey5saRW3HOvuYcwlC4YGHD1ikW18p09NAhRR1pZf1AKp4gVsBduzONfj3t4rLi/9WW1SoMJAQ5IynK/856GBRy4HX1BtoHxEQfORCVFtPLprHLTfS7nFMoNMyFvYgJsFh90DQxAtYWXFEaRm7zh/Qt"]}
msg: Failed to lookup user some_user_that_dont_exist: 'getpwnam(): name not found: some_user_that_dont_exist'

Copied from original issue: ansible/ansible-modules-core#1515