oci_user – Create,update and delete OCI user with specified group associations

New in version 2.5.

Synopsis

  • Creates OCI user, if not present, without any group associations
  • Creates OCI user, if not present, with ui password
  • Creates OCI user, if not present, with specified group associations
  • Update OCI user, if present, with a new description
  • Update OCI user, if present, with new group(s) associations
  • Update OCI user, if present, removing all group associations
  • Update OCI user, if present, and reset the ui password of the user
  • Unblock a blocked user
  • Delete OCI user, if present.

Requirements

The below requirements are needed on the host that executes this module.

Parameters

Parameter Choices/Defaults Comments
api_user
string
The OCID of the user, on whose behalf, OCI APIs are invoked. If not set, then the value of the OCI_USER_OCID environment variable, if any, is used. This option is required if the user is not specified through a configuration file (See config_file_location). To get the user's OCID, please refer https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm.
api_user_fingerprint
string
Fingerprint for the key pair being used. If not set, then the value of the OCI_USER_FINGERPRINT environment variable, if any, is used. This option is required if the key fingerprint is not specified through a configuration file (See config_file_location). To get the key pair's fingerprint value please refer https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm.
api_user_key_file
string
Full path and filename of the private key (in PEM format). If not set, then the value of the OCI_USER_KEY_FILE variable, if any, is used. This option is required if the private key is not specified through a configuration file (See config_file_location). If the key is encrypted with a pass-phrase, the api_user_key_pass_phrase option must also be provided.
api_user_key_pass_phrase
string
Passphrase used by the key referenced in api_user_key_file, if it is encrypted. If not set, then the value of the OCI_USER_KEY_PASS_PHRASE variable, if any, is used. This option is required if the key passphrase is not specified through a configuration file (See config_file_location).
auth_type
string
    Choices:
  • api_key ←
  • instance_principal
The type of authentication to use for making API requests. By default auth_type="api_key" based authentication is performed and the API key (see api_user_key_file) in your config file will be used. If this 'auth_type' module option is not specified, the value of the OCI_ANSIBLE_AUTH_TYPE, if any, is used. Use auth_type="instance_principal" to use instance principal based authentication when running ansible playbooks within an OCI compute instance.
blocked
-
    Choices:
  • yes
  • no
Change the state of an blocked user to unblocked.Only applied on existing blocked user. If the user is already unblocked, then blocked=no will not change the state. blocked=yes is not supported in this version.If the value is not specified explicitly, no action should be taken.
config_file_location
string
Path to configuration file. If not set then the value of the OCI_CONFIG_FILE environment variable, if any, is used. Otherwise, defaults to ~/.oci/config.
config_profile_name
string
The profile to load from the config file referenced by config_file_location. If not set, then the value of the OCI_CONFIG_PROFILE environment variable, if any, is used. Otherwise, defaults to the "DEFAULT" profile in config_file_location.
create_or_reset_ui_password
boolean
    Choices:
  • no ←
  • yes
Create UI password for an user who has no UI password or reset password of an user having UI password.
defined_tags
dictionary
Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see https://docs.us-phoenix-1.oraclecloud.com/Content/General/Concepts/resourcetags.htm.
delete_group_memberships
boolean
    Choices:
  • no ←
  • yes
Delete groups from existing memberships which are present in group memberships provided by user_groups. If delete_group_memberships=True, groups provided by user_groups would be deleted from existing group memberships, if they are part of existing group memberships. If they are not part of existing group memberships, they will be ignored. delete_group_memberships and purge_group_memberships are mutually exclusive.
description
-
Description of the user. The value could be an empty string. If not provided explicitly while creating an user, the value defaults to an empty string. Not required for state=absent
force
boolean
    Choices:
  • no ←
  • yes
If force='no' and if the user is part of a group, user will not be deleted. To delete a user associated with group(s), use state=yes.
freeform_tags
dictionary
Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see https://docs.us-phoenix-1.oraclecloud.com/Content/General/Concepts/resourcetags.htm.
name
- / required
Name of the user. Must be unique for a tenancy.
purge_group_memberships
boolean
    Choices:
  • no ←
  • yes
Purge groups from existing memberships which are not present in provided group memberships. If purge_group_memberships=False, provided groups would be appended to existing group memberships. purge_group_memberships and delete_group_memberships are mutually exclusive.
region
string
The Oracle Cloud Infrastructure region to use for all OCI API requests. If not set, then the value of the OCI_REGION variable, if any, is used. This option is required if the region is not specified through a configuration file (See config_file_location). Please refer to https://docs.us-phoenix-1.oraclecloud.com/Content/General/Concepts/regions.htm for more information on OCI regions.
state
-
    Choices:
  • present ←
  • absent
Create,update or delete user. For state=present, if the user does not exists, it gets created. If exists, it gets updated.. For state=absent, user gets deleted.
tenancy
string
OCID of your tenancy. If not set, then the value of the OCI_TENANCY variable, if any, is used. This option is required if the tenancy OCID is not specified through a configuration file (See config_file_location). To get the tenancy OCID, please refer https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm
user_groups
-
List of groups to which the user should be associated with.The specified groups must exist while running this task. If a specified group does not exist, this task would fail.If a user already exists, and their current group associations are different from the specified group associations, the task would change the user to ensure that the group associations of the user reflect the specified group associations.
user_id
-
Identifier of the User. Mandatory for delete and update.

aliases: id
wait
boolean
    Choices:
  • no
  • yes ←
Whether to wait for create or delete operation to complete.
wait_timeout
integer
Default:
1200
Time, in seconds, to wait when wait=yes.
wait_until
string
The lifecycle state to wait for the resource to transition into when wait=yes. By default, when wait=yes, we wait for the resource to get into ACTIVE/ATTACHED/AVAILABLE/PROVISIONED/ RUNNING applicable lifecycle state during create operation & to get into DELETED/DETACHED/ TERMINATED lifecycle state during delete operation.

Examples

# Note: These examples do not set authentication details.

# User creation or update
- name: Create User with ui password and  group memberships
  oci_user:
      name: 'ansible_user'
      description: 'Ansible  User'
      user_groups: ['ansible_group_A']
      freeform_tags:
            usert_type: 'admin'
      defined_tags:
          department:
              division: 'engineering'
      create_or_reset_ui_password: True
      state: 'present'

- name: Create user without group memberships
  oci_user:
      name: 'ansible_user'
      description: 'Ansible  User'
      create_or_reset_ui_password: True
      state: 'present'

- name: Reset ui password of an existing user
  oci_user:
      id: 'ocid1.user..abuwd'
      create_or_reset_ui_password: True
      state: 'present'

- name: Unblock User
  oci_user:
      id: 'ocid1.user..abuwd'
      blocked: 'no'
      state: 'present'
  register: result

- name: Update user with removing all group memberships
  oci_user:
      id: 'ocid1.user..abuwd'
      description: 'Ansible  User'
      user_groups: []
      state: 'present'

- name: Update user by replacing group memberships, after this
        operation user would become member of ansible_group_B
  oci_user:
      user_id: "ocid1.user..abuwd"
      description: 'Ansible User'
      purge_group_memberships: True
      user_groups: ['ansible_group_B']
      create_or_reset_ui_password: True
      state: 'present'

- name: Update user by deleting group memberships, after this
        operation user would not longer be a member of ansible_group_B
  oci_user:
      user_id: "ocid1.user..abuwd"
      description: 'Ansible User'
      delete_group_memberships: True
      user_groups: ['ansible_group_B']
      create_or_reset_ui_password: True
      state: 'present'

# Delete group
- name: Delete user with no force
  oci_user:
      id: 'ocid1.user..abuwd'
      state: 'absent'

- name: Delete user with  force
  oci_user:
      user_id: 'ocid1.user..abuwd'
      force: 'yes'
      state: 'absent'

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
user
complex
success
Attributes of the created/updated user. For delete, deleted user description will be returned.

Sample:
{'lifecycle_state': 'ACTIVE', 'inactive_status': 'None', 'description': 'Ansible User', 'compartment_id': 'ocidv1:tenancy:oc1:arz:1461274726633:aa', 'defined_tags': {'department': {'division': 'engineering'}}, 'freeform_tags': {'user_type': 'admin'}, 'time_created': '2017-11-04T14:45:27.358000+00:00', 'password': 'PJ+p>u1&u', 'id': 'ocid1.user.oc1..xxxxxEXAMPLExxxxx', 'name': 'ansible_user'}
  compartment_id
string
always
The identifier of the tenancy containing the user

Sample:
ocid1.tenancy.oc1.xzvf..oifds
  description
string
always
The description assigned to the user

Sample:
Ansible User
  id
string
always
Identifier of the user

Sample:
ocid1.user.oc1.axdf
  inactive_status
string
when user's lifecycle_state is INACTIVE
The detailed status of INACTIVE life cycle state

Sample:
None
  lifecycle_state
string
always
The current state of the user

Sample:
ACTIVE
  name
string
always
Name assigned to the user during creation

Sample:
ansible_user
  password
string
when create_or_reset_ui_password=True and a new user created and when create_or_reset_ui_password=True and new user created or an existing user is updated
The ui password of the user

Sample:
_09erf4
  time_created
datetime
always
Date and time when the user was created, in the format defined by RFC3339

Sample:
2016-08-25 21:10:29.600000


Status

  • This module is not guaranteed to have a backwards compatible interface. [preview]
  • This module is maintained by the Ansible Community. [community]

Authors

  • Debayan Gupta(@debayan_gupta)

Hint

If you notice any issues in this documentation you can edit this document to improve it.