aci_aaa_user: Setting user password is not idempotent

[dagwieers]

ISSUE TYPE

• Bug Report

COMPONENT NAME

aci_aaa_user

ANSIBLE VERSION

v2.5

SUMMARY

Due to an inconsistency in the APIC REST API, a task that sets the password of a locally-authenticated user is not idempotent. The APIC will complain with message Password history check: user dag should not use previous 5 passwords.

  aaaUser:
    attributes:
      name: dag
      pwd: S0me!Pwd

{
    "aaaUser": {
        "attributes": {
            "name": "dag",
            "pwd": "S0me!Pwd"
        }
    }
}

This seems to be a bug in the APIC as according to APIC REST API documentation:

Standard REST methods are supported on the API, which includes POST, GET, and DELETE operations through HTTP. The POST and DELETE methods are idempotent, meaning that there is no additional effect if they are called more than once with the same input parameters. The GET method is nullipotent, meaning that it can be called zero or more times without making any changes (or that it is a read-only operation).

The APIC in this case should really be testing whether the provided password is identical to the existing password, before testing it against the password history.

The vendor is notified of this inconsistency.

[ansibot]

cc @brunocalogero @jmcgill298 @schunduri
click here for bot help

[ansibot]

Files identified in the description:

• lib/ansible/modules/network/aci/aci_aaa_user.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @mtorelli @rsmeyers @smnmtzgr
click here for bot help

[ansibot]

cc @koladiya
click here for bot help

[ansibot]

cc @devarshishah3 @fadallar
click here for bot help

[ansibot]

cc @aciguru
click here for bot help

[aciguru]

Issue moved to

CiscoDevNet/ansible-aci#26