oci_user - Create,update and delete OCI user with specified group associations¶

New in version 2.5.

Synopsis
- Requirements
Parameters
Notes
Examples
Return Values
Status
- Author

Synopsis ¶

Creates OCI user, if not present, without any group associations
Creates OCI user, if not present, with ui password
Creates OCI user, if not present, with specified group associations
Update OCI user, if present, with a new description
Update OCI user, if present, with new group(s) associations
Update OCI user, if present, removing all group associations
Update OCI user, if present, and reset the ui password of the user
Unblock a blocked user
Delete OCI user, if present.

Requirements ¶

The below requirements are needed on the host that executes this module.

python >= 2.6
Python SDK for Oracle Cloud Infrastructure https://oracle-cloud-infrastructure-python-sdk.readthedocs.io

Parameters ¶

Parameter	Choices/Defaults	Comments
api_user		The OCID of the user, on whose behalf, OCI APIs are invoked. If not set, then the value of the OCI_USER_OCID environment variable, if any, is used. This option is required if the user is not specified through a configuration file (See `config_file_location`). To get the user's OCID, please refer https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm.
api_user_fingerprint		Fingerprint for the key pair being used. If not set, then the value of the OCI_USER_FINGERPRINT environment variable, if any, is used. This option is required if the key fingerprint is not specified through a configuration file (See `config_file_location`). To get the key pair's fingerprint value please refer https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm.
api_user_key_file		Full path and filename of the private key (in PEM format). If not set, then the value of the OCI_USER_KEY_FILE variable, if any, is used. This option is required if the private key is not specified through a configuration file (See `config_file_location`). If the key is encrypted with a pass-phrase, the `api_user_key_pass_phrase` option must also be provided.
api_user_key_pass_phrase		Passphrase used by the key referenced in `api_user_key_file`, if it is encrypted. If not set, then the value of the OCI_USER_KEY_PASS_PHRASE variable, if any, is used. This option is required if the key passphrase is not specified through a configuration file (See `config_file_location`).
auth_type	Choices: api_key ← instance_principal	The type of authentication to use for making API requests. By default `auth_type="api_key"` based authentication is performed and the API key (see api_user_key_file) in your config file will be used. If this 'auth_type' module option is not specified, the value of the OCI_ANSIBLE_AUTH_TYPE, if any, is used. Use `auth_type="instance_principal"` to use instance principal based authentication when running ansible playbooks within an OCI compute instance.
blocked	Choices: yes no	Change the state of an blocked user to unblocked.Only applied on existing blocked user. If the user is already unblocked, then blocked=no will not change the state. blocked=yes is not supported in this version.If the value is not specified explicitly, no action should be taken.
config_file_location		Path to configuration file. If not set then the value of the OCI_CONFIG_FILE environment variable, if any, is used. Otherwise, defaults to ~/.oci/config.
config_profile_name	Default: DEFAULT	The profile to load from the config file referenced by `config_file_location`. If not set, then the value of the OCI_CONFIG_PROFILE environment variable, if any, is used. Otherwise, defaults to the "DEFAULT" profile in `config_file_location`.
create_or_reset_ui_password bool	Choices: no ← yes	Create UI password for an user who has no UI password or reset password of an user having UI password.
defined_tags		Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see https://docs.us-phoenix-1.oraclecloud.com/Content/General/Concepts/resourcetags.htm.
description		Description of the user. The value could be an empty string. If not provided explicitly while creating an user, the value defaults to an empty string. Not required for state=absent
force bool	Choices: no ← yes	If force='no' and if the user is part of a group, user will not be deleted. To delete a user associated with group(s), use state=yes.
freeform_tags		Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see https://docs.us-phoenix-1.oraclecloud.com/Content/General/Concepts/resourcetags.htm.
name required		Name of the user. Must be unique for a tenancy.
purge_group_memberships bool	Choices: no ← yes	Purge groups from existing memberships which are not present in provided group memberships. If purge_group_memberships=False, provided groups would be appended to existing group memberships.
region		The Oracle Cloud Infrastructure region to use for all OCI API requests. If not set, then the value of the OCI_REGION variable, if any, is used. This option is required if the region is not specified through a configuration file (See `config_file_location`). Please refer to https://docs.us-phoenix-1.oraclecloud.com/Content/General/Concepts/regions.htm for more information on OCI regions.
state	Choices: present ← absent	Create,update or delete user. For state=present, if the user does not exists, it gets created. If exists, it gets updated.. For state=absent, user gets deleted.
tenancy		OCID of your tenancy. If not set, then the value of the OCI_TENANCY variable, if any, is used. This option is required if the tenancy OCID is not specified through a configuration file (See `config_file_location`). To get the tenancy OCID, please refer https://docs.us-phoenix-1.oraclecloud.com/Content/API/Concepts/apisigningkey.htm
user_groups		List of groups to which the user should be associated with.The specified groups must exist while running this task. If a specified group does not exist, this task would fail.If a user already exists, and their current group associations are different from the specified group associations, the task would change the user to ensure that the group associations of the user reflect the specified group associations.
user_id		Identifier of the User. Mandatory for delete and update. aliases: id
wait bool	Choices: no yes ←	Whether to wait for create or delete operation to complete.
wait_timeout	Default: 1200	Time, in seconds, to wait when wait=yes.
wait_until		The lifecycle state to wait for the resource to transition into when wait=yes. By default, when wait=yes, we wait for the resource to get into ACTIVE/ATTACHED/AVAILABLE/PROVISIONED/ RUNNING applicable lifecycle state during create operation & to get into DELETED/DETACHED/ TERMINATED lifecycle state during delete operation.

Notes ¶

Note

For OCI python sdk configuration, please refer to https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/configuration.html

Examples ¶

# Note: These examples do not set authentication details.

# User creation or update
- name: Create User with ui password and  group memberships
  oci_user:
      name: 'ansible_user'
      description: 'Ansible  User'
      user_groups: ['ansible_group_A']
      freeform_tags:
            usert_type: 'admin'
      defined_tags:
          department:
              division: 'engineering'
      create_or_reset_ui_password: True
      state: 'present'

- name: Create user without group memberships
  oci_user:
      name: 'ansible_user'
      description: 'Ansible  User'
      create_or_reset_ui_password: True
      state: 'present'

- name: Reset ui password of an existing user
  oci_user:
      id: 'ocid1.user..abuwd'
      create_or_reset_ui_password: True
      state: 'present'

- name: Unblock User
  oci_user:
      id: 'ocid1.user..abuwd'
      blocked: 'no'
      state: 'present'
  register: result

- name: Update user with removing all group memberships
  oci_user:
      id: 'ocid1.user..abuwd'
      description: 'Ansible  User'
      user_groups: []
      state: 'present'

- name: Update user by replacing group memberships, after this
        operation user would become member of ansible_group_B
  oci_user:
      user_id: "ocid1.user..abuwd"
      description: 'Ansible User'
      purge_group_memberships: True
      user_groups: ['ansible_group_B']
      create_or_reset_ui_password: True
      state: 'present'

# Delete group
- name: Delete user with no force
  oci_user:
      id: 'ocid1.user..abuwd'
      state: 'absent'

- name: Delete user with  force
  oci_user:
      user_id: 'ocid1.user..abuwd'
      force: 'yes'
      state: 'absent'

Return Values ¶

Common return values are documented here, the following are the fields unique to this module:

Key		Returned	Description
user complex		success	Attributes of the created/updated user. For delete, deleted user description will be returned. Sample: {'lifecycle_state': 'ACTIVE', 'inactive_status': 'None', 'description': 'Ansible User', 'compartment_id': 'ocidv1:tenancy:oc1:arz:1461274726633:aa', 'defined_tags': {'department': {'division': 'engineering'}}, 'freeform_tags': {'user_type': 'admin'}, 'time_created': '2017-11-04T14:45:27.358000+00:00', 'password': 'PJ+p>u1&u', 'id': 'ocid1.user.oc1..xxxxxEXAMPLExxxxx', 'name': 'ansible_user'}
	lifecycle_state string	always	The current state of the user Sample: ACTIVE
	inactive_status string	when user's lifecycle_state is INACTIVE	The detailed status of INACTIVE life cycle state Sample: None
	description string	always	The description assigned to the user Sample: Ansible User
	compartment_id string	always	The identifier of the tenancy containing the user Sample: ocid1.tenancy.oc1.xzvf..oifds
	time_created datetime	always	Date and time when the user was created, in the format defined by RFC3339 Sample: 2016-08-25 21:10:29.600000
	password string	when create_or_reset_ui_password=True and a new user created and when create_or_reset_ui_password=True and new user created or an existing user is updated	The ui password of the user Sample: _09erf4
	id string	always	Identifier of the user Sample: ocid1.user.oc1.axdf
	name string	always	Name assigned to the user during creation Sample: ansible_user

Status ¶

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Author ¶

Debayan Gupta(@debayan_gupta)

Hint

If you notice any issues in this documentation you can edit this document to improve it.