Repository: ansible/ansible

Issue:
nxos_snmp_user removes encryption if user and encryption already configured
##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
nxos_snmp_user

##### ANSIBLE VERSION
```
ansible 2.5.0 (devel 857d0fd62e) last updated 2018/01/28 12:20:25 (GMT -400)
  config file = None
  configured module search path = ['/home/chip/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/chip/projects/gs/ansible/dev/ansible/lib/ansible
  executable location = /home/chip/projects/gs/ansible/dev/ansible/bin/ansible
  python version = 3.5.2 (default, Nov 23 2017, 16:37:01) [GCC 5.4.0 20160609]
```

##### CONFIGURATION
None

##### OS / ENVIRONMENT
N/A

##### SUMMARY
If an snmp user is already configured with encryption and the module option 'encrypt' is set to True, then encryption will be removed from the user. Subsequent run will add it back.  Next run will remove it again.

This seems to happen when the set().difference() is done on the 'existing' and 'proposed' dicts.  They both have an encryption: 'aes-128' item, therefore there is no difference.  When the delta is sent to the configure_snmp_user() function, "encrypt" is set to None, and therefore gets removed.

##### STEPS TO REPRODUCE
Create playbook as indicated below.  Run the play and the user is created. Run it again and encryption is removed.  Run it again and encryption is put back.  Run once more, encryption is again removed.

<!--- Paste example playbooks or commands between quotes below -->
```yaml
---
# file: testcase.yml
- hosts: all
  become: False
  gather_facts: False
  connection: local
  vars:
    cli:
      username: admin
      password: admin
      host: "{{ inventory_hostname }}"

  tasks:
    - name: NXOS | Set SNMPv3 User
      nxos_snmp_user:
        provider: "{{ cli }}"
        user: testuser
        group: testgroup
        pwd: AuthenticationPassword1
        authentication: sha
        privacy: PrivacyPassword1
        encrypt: True
        state: present
      register: snmpv3_user_output

    - name: Debug SNMPv3 User
      debug:
        var: snmpv3_user_output

```



##### EXPECTED RESULTS
Expected no change.  I know the task is not idempotent.  It kind of has to be that way due to password hashing.  Did not expect encryption to be removed

##### ACTUAL RESULTS
**First Run: Create the user**
```
(venv) [15:20:47|chip@beast:~/projects/gs/ansible/dev/snmpv3]
:ansible-playbook -vvv testcase.yml 
ansible-playbook 2.5.0 (devel 857d0fd62e) last updated 2018/01/28 12:20:25 (GMT -400)
  config file = /home/chip/projects/gs/ansible/dev/snmpv3/ansible.cfg
  configured module search path = ['/home/chip/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/chip/projects/gs/ansible/dev/ansible/lib/ansible
  executable location = /home/chip/projects/gs/ansible/dev/ansible/bin/ansible-playbook
  python version = 3.5.2 (default, Nov 23 2017, 16:37:01) [GCC 5.4.0 20160609]
Using /home/chip/projects/gs/ansible/dev/snmpv3/ansible.cfg as config file
Parsed /home/chip/projects/gs/ansible/dev/snmpv3/inventory inventory source with ini plugin

PLAYBOOK: testcase.yml *****************************************************************************************************************************************************************************************************
1 plays in testcase.yml

PLAY [all] *****************************************************************************************************************************************************************************************************************
META: ran handlers

TASK [NXOS | Set SNMPv3 User] **********************************************************************************************************************************************************************************************
task path: /home/chip/projects/gs/ansible/dev/snmpv3/testcase.yml:15
<nxos-1> using connection plugin network_cli (was local)
Using module file /home/chip/projects/gs/ansible/dev/ansible/lib/ansible/modules/network/nxos/nxos_snmp_user.py
<nxos-1> ESTABLISH LOCAL CONNECTION FOR USER: chip
<nxos-1> EXEC /bin/sh -c 'echo ~ && sleep 0'
<nxos-1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/chip/.ansible/tmp/ansible-tmp-1517170890.9215395-94915088996529 `" && echo ansible-tmp-1517170890.9215395-94915088996529="` echo /home/chip/.ansible/tmp/ansible-tmp-1517170890.9215395-94915088996529 `" ) && sleep 0'
<nxos-1> PUT /home/chip/.ansible/tmp/ansible-local-24411utr4nkdv/tmp_7a03rm0 TO /home/chip/.ansible/tmp/ansible-tmp-1517170890.9215395-94915088996529/nxos_snmp_user.py
<nxos-1> EXEC /bin/sh -c 'chmod u+x /home/chip/.ansible/tmp/ansible-tmp-1517170890.9215395-94915088996529/ /home/chip/.ansible/tmp/ansible-tmp-1517170890.9215395-94915088996529/nxos_snmp_user.py && sleep 0'
<nxos-1> EXEC /bin/sh -c '/usr/bin/python /home/chip/.ansible/tmp/ansible-tmp-1517170890.9215395-94915088996529/nxos_snmp_user.py && sleep 0'
changed: [nxos-1] => {
    "changed": true,
    "commands": [
        "snmp-server user testuser testgroup auth sha AuthenticationPassword1 priv aes-128 PrivacyPassword1"
    ],
    "failed": false,
    "invocation": {
        "module_args": {
            "authentication": "sha",
            "encrypt": true,
            "group": "testgroup",
            "host": "nxos-1",
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "port": null,
            "privacy": "PrivacyPassword1",
            "provider": {
                "host": "nxos-1",
                "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
                "port": null,
                "ssh_keyfile": null,
                "timeout": null,
                "transport": "cli",
                "use_proxy": true,
                "use_ssl": null,
                "username": "admin",
                "validate_certs": null
            },
            "pwd": "AuthenticationPassword1",
            "ssh_keyfile": null,
            "state": "present",
            "timeout": null,
            "transport": "cli",
            "use_proxy": true,
            "use_ssl": null,
            "user": "testuser",
            "username": "admin",
            "validate_certs": null
        }
    }
}

TASK [Debug SNMPv3 User] ***************************************************************************************************************************************************************************************************
task path: /home/chip/projects/gs/ansible/dev/snmpv3/testcase.yml:27
ok: [nxos-1] => {
    "failed": false,
    "snmpv3_user_output": {
        "changed": true,
        "commands": [
            "snmp-server user testuser testgroup auth sha AuthenticationPassword1 priv aes-128 PrivacyPassword1"
        ],
        "failed": false
    }
}
META: ran handlers
META: ran handlers

PLAY RECAP *****************************************************************************************************************************************************************************************************************
nxos-1                     : ok=2    changed=1    unreachable=0    failed=0   
```

**2nd Run: Play removes encryption**
```
(venv) [15:21:36|chip@beast:~/projects/gs/ansible/dev/snmpv3]
:ansible-playbook -vvv testcase.yml 
ansible-playbook 2.5.0 (devel 857d0fd62e) last updated 2018/01/28 12:20:25 (GMT -400)
  config file = /home/chip/projects/gs/ansible/dev/snmpv3/ansible.cfg
  configured module search path = ['/home/chip/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/chip/projects/gs/ansible/dev/ansible/lib/ansible
  executable location = /home/chip/projects/gs/ansible/dev/ansible/bin/ansible-playbook
  python version = 3.5.2 (default, Nov 23 2017, 16:37:01) [GCC 5.4.0 20160609]
Using /home/chip/projects/gs/ansible/dev/snmpv3/ansible.cfg as config file
Parsed /home/chip/projects/gs/ansible/dev/snmpv3/inventory inventory source with ini plugin

PLAYBOOK: testcase.yml *****************************************************************************************************************************************************************************************************
1 plays in testcase.yml

PLAY [all] *****************************************************************************************************************************************************************************************************************
META: ran handlers

TASK [NXOS | Set SNMPv3 User] **********************************************************************************************************************************************************************************************
task path: /home/chip/projects/gs/ansible/dev/snmpv3/testcase.yml:15
<nxos-1> using connection plugin network_cli (was local)
Using module file /home/chip/projects/gs/ansible/dev/ansible/lib/ansible/modules/network/nxos/nxos_snmp_user.py
<nxos-1> ESTABLISH LOCAL CONNECTION FOR USER: chip
<nxos-1> EXEC /bin/sh -c 'echo ~ && sleep 0'
<nxos-1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/chip/.ansible/tmp/ansible-tmp-1517170917.8430233-241256271522010 `" && echo ansible-tmp-1517170917.8430233-241256271522010="` echo /home/chip/.ansible/tmp/ansible-tmp-1517170917.8430233-241256271522010 `" ) && sleep 0'
<nxos-1> PUT /home/chip/.ansible/tmp/ansible-local-245128h_fpjyn/tmp5zt6ojpr TO /home/chip/.ansible/tmp/ansible-tmp-1517170917.8430233-241256271522010/nxos_snmp_user.py
<nxos-1> EXEC /bin/sh -c 'chmod u+x /home/chip/.ansible/tmp/ansible-tmp-1517170917.8430233-241256271522010/ /home/chip/.ansible/tmp/ansible-tmp-1517170917.8430233-241256271522010/nxos_snmp_user.py && sleep 0'
<nxos-1> EXEC /bin/sh -c '/usr/bin/python /home/chip/.ansible/tmp/ansible-tmp-1517170917.8430233-241256271522010/nxos_snmp_user.py && sleep 0'
changed: [nxos-1] => {
    "changed": true,
    "commands": [
        "snmp-server user testuser testgroup auth sha AuthenticationPassword1 priv PrivacyPassword1"
    ],
    "failed": false,
    "invocation": {
        "module_args": {
            "authentication": "sha",
            "encrypt": true,
            "group": "testgroup",
            "host": "nxos-1",
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "port": null,
            "privacy": "PrivacyPassword1",
            "provider": {
                "host": "nxos-1",
                "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
                "port": null,
                "ssh_keyfile": null,
                "timeout": null,
                "transport": "cli",
                "use_proxy": true,
                "use_ssl": null,
                "username": "admin",
                "validate_certs": null
            },
            "pwd": "AuthenticationPassword1",
            "ssh_keyfile": null,
            "state": "present",
            "timeout": null,
            "transport": "cli",
            "use_proxy": true,
            "use_ssl": null,
            "user": "testuser",
            "username": "admin",
            "validate_certs": null
        }
    }
}

TASK [Debug SNMPv3 User] ***************************************************************************************************************************************************************************************************
task path: /home/chip/projects/gs/ansible/dev/snmpv3/testcase.yml:27
ok: [nxos-1] => {
    "failed": false,
    "snmpv3_user_output": {
        "changed": true,
        "commands": [
            "snmp-server user testuser testgroup auth sha AuthenticationPassword1 priv PrivacyPassword1"
        ],
        "failed": false
    }
}
META: ran handlers
META: ran handlers

PLAY RECAP *****************************************************************************************************************************************************************************************************************
nxos-1                     : ok=2    changed=1    unreachable=0    failed=0   
```

3rd Run: Encryption is put back on
```
(venv) [15:22:03|chip@beast:~/projects/gs/ansible/dev/snmpv3]
:ansible-playbook -vvv testcase.yml 
ansible-playbook 2.5.0 (devel 857d0fd62e) last updated 2018/01/28 12:20:25 (GMT -400)
  config file = /home/chip/projects/gs/ansible/dev/snmpv3/ansible.cfg
  configured module search path = ['/home/chip/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/chip/projects/gs/ansible/dev/ansible/lib/ansible
  executable location = /home/chip/projects/gs/ansible/dev/ansible/bin/ansible-playbook
  python version = 3.5.2 (default, Nov 23 2017, 16:37:01) [GCC 5.4.0 20160609]
Using /home/chip/projects/gs/ansible/dev/snmpv3/ansible.cfg as config file
Parsed /home/chip/projects/gs/ansible/dev/snmpv3/inventory inventory source with ini plugin

PLAYBOOK: testcase.yml *****************************************************************************************************************************************************************************************************
1 plays in testcase.yml

PLAY [all] *****************************************************************************************************************************************************************************************************************
META: ran handlers

TASK [NXOS | Set SNMPv3 User] **********************************************************************************************************************************************************************************************
task path: /home/chip/projects/gs/ansible/dev/snmpv3/testcase.yml:15
<nxos-1> using connection plugin network_cli (was local)
Using module file /home/chip/projects/gs/ansible/dev/ansible/lib/ansible/modules/network/nxos/nxos_snmp_user.py
<nxos-1> ESTABLISH LOCAL CONNECTION FOR USER: chip
<nxos-1> EXEC /bin/sh -c 'echo ~ && sleep 0'
<nxos-1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/chip/.ansible/tmp/ansible-tmp-1517170944.1207404-235417128640636 `" && echo ansible-tmp-1517170944.1207404-235417128640636="` echo /home/chip/.ansible/tmp/ansible-tmp-1517170944.1207404-235417128640636 `" ) && sleep 0'
<nxos-1> PUT /home/chip/.ansible/tmp/ansible-local-24621cc6hzo65/tmpykqfdimn TO /home/chip/.ansible/tmp/ansible-tmp-1517170944.1207404-235417128640636/nxos_snmp_user.py
<nxos-1> EXEC /bin/sh -c 'chmod u+x /home/chip/.ansible/tmp/ansible-tmp-1517170944.1207404-235417128640636/ /home/chip/.ansible/tmp/ansible-tmp-1517170944.1207404-235417128640636/nxos_snmp_user.py && sleep 0'
<nxos-1> EXEC /bin/sh -c '/usr/bin/python /home/chip/.ansible/tmp/ansible-tmp-1517170944.1207404-235417128640636/nxos_snmp_user.py && sleep 0'
changed: [nxos-1] => {
    "changed": true,
    "commands": [
        "no snmp-server user testuser",
        "snmp-server user testuser testgroup auth sha AuthenticationPassword1 priv aes-128 PrivacyPassword1"
    ],
    "failed": false,
    "invocation": {
        "module_args": {
            "authentication": "sha",
            "encrypt": true,
            "group": "testgroup",
            "host": "nxos-1",
            "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "port": null,
            "privacy": "PrivacyPassword1",
            "provider": {
                "host": "nxos-1",
                "password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
                "port": null,
                "ssh_keyfile": null,
                "timeout": null,
                "transport": "cli",
                "use_proxy": true,
                "use_ssl": null,
                "username": "admin",
                "validate_certs": null
            },
            "pwd": "AuthenticationPassword1",
            "ssh_keyfile": null,
            "state": "present",
            "timeout": null,
            "transport": "cli",
            "use_proxy": true,
            "use_ssl": null,
            "user": "testuser",
            "username": "admin",
            "validate_certs": null
        }
    }
}

TASK [Debug SNMPv3 User] ***************************************************************************************************************************************************************************************************
task path: /home/chip/projects/gs/ansible/dev/snmpv3/testcase.yml:27
ok: [nxos-1] => {
    "failed": false,
    "snmpv3_user_output": {
        "changed": true,
        "commands": [
            "no snmp-server user testuser",
            "snmp-server user testuser testgroup auth sha AuthenticationPassword1 priv aes-128 PrivacyPassword1"
        ],
        "failed": false
    }
}
META: ran handlers
META: ran handlers

PLAY RECAP *****************************************************************************************************************************************************************************************************************
nxos-1                     : ok=2    changed=1    unreachable=0    failed=0   

```



Discussion:
Files identified in the description:
* [lib/ansible/modules/network/nxos/nxos_snmp_user.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/network/nxos/nxos_snmp_user.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @jedelman8 @kedarX @mikewiebe @privateip @rahushen @rcarrillocruz @trishnaguha
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->

Resolving patch:
diff --git a/lib/ansible/modules/network/nxos/nxos_snmp_user.py b/lib/ansible/modules/network/nxos/nxos_snmp_user.py
--- a/lib/ansible/modules/network/nxos/nxos_snmp_user.py
+++ b/lib/ansible/modules/network/nxos/nxos_snmp_user.py
@@ -289,9 +289,6 @@ def main():
                 reset = True
                 proposed['encrypt'] = 'aes-128'
 
-            elif encrypt:
-                proposed['encrypt'] = 'aes-128'
-
             delta = dict(set(proposed.items()).difference(existing.items()))
 
             if delta.get('pwd'):
@@ -300,6 +297,9 @@ def main():
             if delta:
                 delta['group'] = group
 
+            if delta and encrypt:
+                delta['encrypt'] = 'aes-128'
+
             command = config_snmp_user(delta, user, reset, new)
             commands.append(command)
 


Test patch: