user – Manage user accounts¶

Synopsis
Parameters
Notes
See Also
Examples
Return Values
Status

Synopsis ¶

Manage user accounts and user attributes.
For Windows targets, use the win_user module instead.

Parameters ¶

Parameter	Choices/Defaults	Comments
append boolean	Choices: no ← yes	If `yes`, add the user to the groups specified in `groups`. If `no`, user will only be added to the groups specified in `groups`, removing them from all other groups. Mutually exclusive with `local`
authorization string added in 2.8		Sets the authorization of the user. Does nothing when used with other platforms. Can set multiple authorizations using comma separation. To delete all authorizations, use `authorization=''`. Currently supported on Illumos/Solaris.
comment string		Optionally sets the description (aka GECOS) of user account.
create_home boolean	Choices: no yes ←	Unless set to `no`, a home directory will be made for the user when the account is created or if the home directory does not exist. Changed from `createhome` to `create_home` in Ansible 2.5. aliases: createhome
expires float		An expiry time for the user in epoch, it will be ignored on platforms that do not support this. Currently supported on GNU/Linux, FreeBSD, and DragonFlyBSD. Since Ansible 2.6 you can remove the expiry time specify a negative value. Currently supported on GNU/Linux and FreeBSD.
force boolean	Choices: no ← yes	This only affects `state=absent`, it forces removal of the user and associated directories on supported platforms. The behavior is the same as `userdel --force`, check the man page for `userdel` on your system for details and support. When used with `generate_ssh_key=yes` this forces an existing key to be overwritten.
generate_ssh_key boolean	Choices: no ← yes	Whether to generate a SSH key for the user in question. This will not overwrite an existing SSH key unless used with `force=yes`.
group string		Optionally sets the user's primary group (takes a group name).
groups list		List of groups user will be added to. When set to an empty string `''`, the user is removed from all groups except the primary group. Before Ansible 2.3, the only input format allowed was a comma separated string. Mutually exclusive with `local`
hidden boolean added in 2.6	Choices: no yes	macOS only, optionally hide the user from the login window and system preferences. The default will be `yes` if the system option is used.
home path		Optionally set the user's home directory.
local boolean added in 2.4	Choices: no ← yes	Forces the use of "local" command alternatives on platforms that implement it. This is useful in environments that use centralized authentification when you want to manipulate the local users (i.e. it uses `luseradd` instead of `useradd`). This will check `/etc/passwd` for an existing account before invoking commands. If the local account database exists somewhere other than `/etc/passwd`, this setting will not work properly. This requires that the above commands as well as `/etc/passwd` must exist on the target host, otherwise it will be a fatal error. Mutually exclusive with `groups` and `append`
login_class string		Optionally sets the user's login class, a feature of most BSD OSs.
move_home boolean	Choices: no ← yes	If set to `yes` when used with `home:` , attempt to move the user's old home directory to the specified directory if it isn't there already and the old home exists.
name string / required		Name of the user to create, remove or modify. aliases: user
non_unique boolean	Choices: no ← yes	Optionally when used with the -u option, this option allows to change the user ID to a non-unique value.
password string		Optionally set the user's password to this crypted value. On macOS systems, this value has to be cleartext. Beware of security issues. To create a disabled account on Linux systems, set this to `'!'` or `''`. To create a disabled account on OpenBSD, set this to `'************'`. See https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module for details on various ways to generate these password values.
password_lock boolean added in 2.6	Choices: no yes	Lock the password (`usermod -L`, `usermod -U`, `pw lock`). Implementation differs by platform. This option does not always mean the user cannot login using other methods. This option does not disable the user, only lock the password. This must be set to `False` in order to unlock a currently locked password. The absence of this parameter will not unlock a password. Currently supported on Linux, FreeBSD, DragonFlyBSD, NetBSD, OpenBSD.
profile string added in 2.8		Sets the profile of the user. Does nothing when used with other platforms. Can set multiple profiles using comma separation. To delete all the profiles, use `profile=''`. Currently supported on Illumos/Solaris.
remove boolean	Choices: no ← yes	This only affects `state=absent`, it attempts to remove directories associated with the user. The behavior is the same as `userdel --remove`, check the man page for details and support.
role string added in 2.8		Sets the role of the user. Does nothing when used with other platforms. Can set multiple roles using comma separation. To delete all roles, use `role=''`. Currently supported on Illumos/Solaris.
seuser string		Optionally sets the seuser type (user_u) on selinux enabled systems.
shell string		Optionally set the user's shell. On macOS, before Ansible 2.5, the default shell for non-system users was `/usr/bin/false`. Since Ansible 2.5, the default shell for non-system users on macOS is `/bin/bash`. On other operating systems, the default shell is determined by the underlying tool being used. See Notes for details.
skeleton string		Optionally set a home skeleton directory. Requires `create_home` option!
ssh_key_bits integer	Default: "default set by ssh-keygen"	Optionally specify number of bits in SSH key to create.
ssh_key_comment string	Default: "ansible-generated on $HOSTNAME"	Optionally define the comment for the SSH key.
ssh_key_file path		Optionally specify the SSH key filename. If this is a relative filename then it will be relative to the user's home directory. This parameter defaults to .ssh/id_rsa.
ssh_key_passphrase string		Set a passphrase for the SSH key. If no passphrase is provided, the SSH key will default to having no passphrase.
ssh_key_type string	Default: "rsa"	Optionally specify the type of SSH key to generate. Available SSH key types will depend on implementation present on target host.
state string	Choices: absent present ←	Whether the account should exist or not, taking action if the state is different from what is stated.
system boolean	Choices: no ← yes	When creating an account `state=present`, setting this to `yes` makes the user a system account. This setting cannot be changed on existing users.
uid integer		Optionally sets the UID of the user.
update_password string	Choices: always ← on_create	`always` will update passwords if they differ. `on_create` will only set the password for newly created users.

Notes ¶

Note

There are specific requirements per platform on user management utilities. However they generally come pre-installed with the system and Ansible will require they are present at runtime. If they are not, a descriptive error message will be shown.
On SunOS platforms, the shadow file is backed up automatically since this module edits it directly. On other platforms, the shadow file is backed up by the underlying tools used by this module.
On macOS, this module uses dscl to create, modify, and delete accounts. dseditgroup is used to modify group membership. Accounts are hidden from the login window by modifying /Library/Preferences/com.apple.loginwindow.plist.
On FreeBSD, this module uses pw useradd and chpass to create, pw usermod and chpass to modify, pw userdel remove, pw lock to lock, and pw unlock to unlock accounts.
On all other platforms, this module uses useradd to create, usermod to modify, and userdel to remove accounts.

Examples ¶

- name: Add the user 'johnd' with a specific uid and a primary group of 'admin'
  user:
    name: johnd
    comment: John Doe
    uid: 1040
    group: admin

- name: Add the user 'james' with a bash shell, appending the group 'admins' and 'developers' to the user's groups
  user:
    name: james
    shell: /bin/bash
    groups: admins,developers
    append: yes

- name: Remove the user 'johnd'
  user:
    name: johnd
    state: absent
    remove: yes

- name: Create a 2048-bit SSH key for user jsmith in ~jsmith/.ssh/id_rsa
  user:
    name: jsmith
    generate_ssh_key: yes
    ssh_key_bits: 2048
    ssh_key_file: .ssh/id_rsa

- name: Added a consultant whose account you want to expire
  user:
    name: james18
    shell: /bin/zsh
    groups: developers
    expires: 1422403387

- name: Starting at Ansible 2.6, modify user, remove expiry time
  user:
    name: james18
    expires: -1

Return Values ¶

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
append boolean	When state is 'present' and the user exists	Whether or not to append the user to groups Sample: True
comment string	When user exists	Comment section from passwd file, usually the user name Sample: Agent Smith
create_home boolean	When user does not exist and not check mode	Whether or not to create the home directory Sample: True
force boolean	When state is 'absent' and user exists	Whether or not a user account was forcibly deleted
group integer	When user exists	Primary user group ID Sample: 1001
groups string	When `groups` is not empty and `state` is 'present'	List of groups of which the user is a member Sample: chrony,apache
home string	When `state` is 'present'	Path to user's home directory Sample: /home/asmith
move_home boolean	When `state` is 'present' and user exists	Whether or not to move an existing home directory
name string	always	User account name Sample: asmith
password string	When `state` is 'present' and `password` is not empty	Masked value of the password Sample: NOT_LOGGING_PASSWORD
remove boolean	When `state` is 'absent' and user exists	Whether or not to remove the user account Sample: True
shell string	When `state` is 'present'	User login shell Sample: /bin/bash
ssh_fingerprint string	When `generate_ssh_key` is `True`	Fingerprint of generated SSH key Sample: 2048 SHA256:aYNHYcyVm87Igh0IMEDMbvW0QDlRQfE0aJugp684ko8 ansible-generated on host (RSA)
ssh_key_file string	When `generate_ssh_key` is `True`	Path to generated SSH private key file Sample: /home/asmith/.ssh/id_rsa
ssh_public_key string	When `generate_ssh_key` is `True`	Generated SSH public key file Sample: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC95opt4SPEC06tOYsJQJIuN23BbLMGmYo8ysVZQc4h2DZE9ugbjWWGS1/pweUGjVstgzMkBEeBCByaEf/RJKNecKRPeGd2Bw9DCj/bn5Z6rGfNENKBmo 618mUJBvdlEgea96QGjOwSB7/gmonduC7gsWDMNcOdSE3wJMTim4lddiBx4RgC9yXsJ6Tkz9BHD73MXPpT5ETnse+A3fw3IGVSjaueVnlUyUmOBf7fzmZbhlFVXf2Zi2rFTXqvbdGHKkzpw1U8eB8xFPP7y d5u1u0e6Acju/8aZ/l17IDFiLke5IzlqIMRTEbDwLNeO84YQKWTm9fODHzhYe0yvxqLiK07 ansible-generated on host'
stderr string	When stderr is returned by a command that is run	Standard error from running commands Sample: Group wheels does not exist
stdout string	When standard output is returned by the command that is run	Standard output from running commands
system boolean	When `system` is passed to the module and the account does not exist	Whether or not the account is a system account Sample: True
uid integer	When `UID` is passed to the module	User ID of the user account Sample: 1044

Status ¶

This module is guaranteed to have backward compatible interface changes going forward. [stableinterface]
This module is maintained by the Ansible Core Team. [core]

Red Hat Support¶

More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.

Authors¶

Stephen Fromm (@sfromm)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.

user – Manage user accounts¶

Synopsis¶

Parameters¶

Notes¶

See Also¶

Examples¶

Return Values¶

Status¶