Module user : Unable to manage local system user when it exists in LDAP, even if option "local" is set to "yes"

[pierre8778]

ISSUE TYPE

• Bug Report

COMPONENT NAME

module: user

ANSIBLE VERSION

ansible 2.4.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/usr/share/my_modules', u'/local/ansible/data/plugins/custom_modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, May  3 2017, 07:55:04) [GCC 4.8.5 20150623 (Red Hat 4.8.5-14)] 

CONFIGURATION

ANSIBLE_SSH_CONTROL_PATH(/etc/ansible/ansible.cfg) = %(directory)s/%%h-%%r
DEFAULT_CALLBACK_PLUGIN_PATH(/etc/ansible/ansible.cfg) = [u'/usr/share/ansible/plugins/callback', u'/local/ansible/data/plugins/callback']
DEFAULT_CALLBACK_WHITELIST(/etc/ansible/ansible.cfg) = ['timer', 'profile_tasks', 'my_log_plays']
DEFAULT_GATHERING(/etc/ansible/ansible.cfg) = explicit
DEFAULT_KEEP_REMOTE_FILES(env: ANSIBLE_KEEP_REMOTE_FILES) = True
DEFAULT_MANAGED_STR(/etc/ansible/ansible.cfg) = #! ANSIBLE MANAGED: {file} modified by {uid} on {host} !#
DEFAULT_MODULE_PATH(/etc/ansible/ansible.cfg) = [u'/usr/share/my_modules', u'/local/ansible/data/plugins/custom_modules']
DEFAULT_REMOTE_TMP(/etc/ansible/ansible.cfg) = /tmp/.ansible-${USER}/tmp
HOST_KEY_CHECKING(/etc/ansible/ansible.cfg) = False
RETRY_FILES_SAVE_PATH(/etc/ansible/ansible.cfg) = /tmp/.ansible-e821580-retry

OS / ENVIRONMENT

Ansible server : RHEL 7.4
Managed servers: RHEL 6.x and 7.x

SUMMARY

Unable to manage (add/remove) a local system user when it exists in LDAP, even if option "local" is set to "yes"

STEPS TO REPRODUCE

• Configure a managed server to use a LDAP source along the /etc/passwd file to autenticate users
• Create a user "testUser" in your LDAP
• Try to create the same user but in the local /etc/passwd file of your managed server with Ansible :

- name: Test creation of local user
  hosts: TEST
  become: True
  gather_facts: False

  tasks:
  - name: Create local user testUser
    user:
      comment: "Test user"
      createhome: true
      name: "testUser"
      password: "xxxxx"
      shell: "/bin/bash"
      state: "present"
      local: true

EXPECTED RESULTS

• User "testUser" should be present in /etc/passwd file on the target server

ACTUAL RESULTS

• If no password is set in module arguments, Ansible tells user exists
• If a password is set for the user to create in module arguments (example above), the user creation fails with rc=3 and error message "User testUser does not exists"

ansible-playbook -i hosts test_luser.yml -Kk

After a quick look in the user module file, I found that the Python function responsible of checking for user existence uses pwd.getpwnam(). But this Python function does not distinguish between local and LDAP users. Then I wrote a little patch to make this function looking for the user to create/remove in /etc/passwd if "local" argument is set to "yes". The attached ZIP file contains the modified module and a diff patch file.
ansible_user_patch.zip

[ansibot]

Files identified in the description:

• lib/ansible/modules/system/user.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @sfromm
click here for bot help

[ansibot]

cc @samdoran
click here for bot help

[samdoran]

Duplicate of #50947