microsoft.ad.group module : Set members list

[arnydbois]

SUMMARY
The process fails when you try to list multiple group members. Some groups are not found by the module although it was previously created by it.
microsoft.ad.group module – Manage Active Directory group objects module has an option under the members attribute: to set an groups list

ISSUE TYPE

• Bug Report

COMPONENT NAME
microsoft.ad.group module

ANSIBLE VERSION
ansible [core 2.16.4]
config file = None
python version = 3.11.2 (main, Mar 13 2023, 12:18:29)
jinja version = 3.1.3
libyaml = True

COLLECTION VERSION
microsoft.ad collection (version 1.4.1)

CONFIGURATION

- name: Creat ADDC groups whith members
  microsoft.ad.group:
    name: "{{ item.name }}"
    description : "{{ item.description }}"
    scope: "{{ item.scope }}"
    path: "{% if item.path != '' %}OU={{ item.path }},{{ fqdn_path }}{% else %}{{ group_fqdn_path }}{% endif %}"
    state: present
    members:
      set: "{{ item.member_of.split(',') }}"    
    protect_from_deletion: true
  loop: "{{ site_ADDC_groups }}"

site_ADDC_groups:
  - { UID: 'GRP_001', name: "GG_F_{{site_name}}_ADMIN-EAR-RW", scope: "global", path: "", description: "Administrateurs Reseau (Switch/Firewall/NTP)", member_of: ""}
  - { UID: 'GRP_038', name: "GG_F_{{site_name}}_PDT-RO", scope: "global", path: "", description: "Groupe d'authentification radius des postes de travail", member_of: "GG-NoLogon"}
  - { UID: 'GRP_039', name: "GG_F_{{site_name}}_SERVICE-RW", scope: "global", path: "", description: "Groupe des comptes de service", member_of: "GG-NoLogon,Utilisateurs du domaine"}
  - { UID: 'GRP_040', name: "GG_F_{{site_name}}_ADMIN-ITNI-RW", scope: "global", path: "", description: "Administrateurs System ITNI", member_of: "GG_F_{{site_name}}_ADMIN-EAR-RW,Admins du domaine"}

it also tested with

    members:
      set: 
        - "GG-NoLogon"
        - "GG_F_{{site_name}}_ADMIN-EAR-RW"

OS / ENVIRONMENT
Debian 12

STEPS TO REPRODUCE
Somes groups are working and others are not find
use upper configuration to reproduce probleme, add for exemple GG_F_{{site_name}}_ADMIN-EAR-RW in the group list

ACTUAL RESULTS

some groups are working like

ok: [DR3SP-MULIWX01V] => (item={'UID': 'GRP_005', 'name': 'GG_F_ULI_ADMIN-AD-RW', 'scope': 'global', 'path': '', 'description': 'Administrateurs du domaine', 'member_of': 'Admins du domaine'})
ok: [DR3SP-MULIWX01V] => (item={'UID': 'GRP_038', 'name': 'GG_F_ULI_PDT-RO', 'scope': 'global', 'path': '', 'description': "Groupe d'authentification radius des postes de travail", 'member_of': 'GG-NoLogon'})

some groups doesn't work

failed: [DR3SP-MULIWX01V] (item={'UID': 'GRP_039', 'name': 'GG_F_ULI_SERVICE-RW', 'scope': 'global', 'path': '', 'description': 'Groupe des comptes de service', 'member_of': 'GG-NoLogon,Utilisateurs du domaine'}) => {"ansible_loop_var": "item", "changed": false, "distinguished_name": "CN=GG_F_ULI_SERVICE-RW,OU=Groupes,DC=ULI-3SP,DC=local", "item": {"UID": "GRP_039", "description": "Groupe des comptes de service", "member_of": "GG-NoLogon,Utilisateurs du domaine", "name": "GG_F_ULI_SERVICE-RW", "path": "", "scope": "global"}, "msg": "Failed to find the following ad objects for group members: 'Utilisateurs du domaine'", "object_guid": "b900f8a3-8dcc-4bb8-8fd0-b9750c641838"}
failed: [DR3SP-MULIWX01V] (item={'UID': 'GRP_040', 'name': 'GG_F_ULI_ADMIN-ITNI-RW', 'scope': 'global', 'path': '', 'description': 'Administrateurs System ITNI', 'member_of': 'GG_F_ULI_ADMIN-EAR-RW,Admins du domaine'}) => {"ansible_loop_var": "item", "changed": false, "distinguished_name": "CN=GG_F_ULI_ADMIN-ITNI-RW,OU=Groupes,DC=ULI-3SP,DC=local", "item": {"UID": "GRP_040", "description": "Administrateurs System ITNI", "member_of": "GG_F_ULI_ADMIN-EAR-RW,Admins du domaine", "name": "GG_F_ULI_ADMIN-ITNI-RW", "path": "", "scope": "global"}, "msg": "Failed to find the following ad objects for group members: 'GG_F_ULI_ADMIN-EAR-RW'", "object_guid": "cbc22327-476a-4665-96cc-59a880e8de2f"}

[jborean93]

I believe #94 and #63 might be the cause of this issue here. The failing group names in your output are all over longer than 20 characters which the code erroneously believed wasn't a valid sAMAccountName and then treated it as a distinguishedName. The PR #95 removed the character length check allowing the membership here to include groups where the name is longer than 20 characters and the release from today v1.5.0 includes the changes from that PR.

The workarounds if you cannot update is to specify the group in one of the following values

• It's objectGuid
• It's distinguisedName
• It's securityIdentifier, or
• It's userPrincipalName

The last one is probably the easiest to specify as the GUID and SID are more machine friendly values while the DN is a bit hard to work with across various domains.

[Yannik]

@jborean93 Had the same issue, upgrading to 1.5.0 fixed it. I believe this can be closed.

[jborean93]

Thanks for confirming!