Add user password reset and ability to disable an account

ansible/roles/win_user/defaults/main.yml

@@ -0,0 +1 @@
+user_action: create

ansible/roles/win_user/tasks/assert.yml

@@ -0,0 +1,80 @@
+---
+
+- name: Check User Action
+  ansible.builtin.assert:
+    that: 
+      - user_action is defined
+      - user_action is string
+      - user_action is in valid_actions
+    quiet: true
+
+- name: Check User information
+  block:
+    - name: Check Username
+      ansible.builtin.assert:
+        that:
+          - username is defined
+          - username is string
+          - username is not none
+          - username|length <= 20
+        quiet: true
+
+    - name: Check User Info 
+      ansible.builtin.assert:
+        that:
+          - study_code is defined
+          - password is defined 
+          - firstname is defined 
+          - lastname is defined 
+          - email is defined 
+          - user_role is defined 
+        quiet: true
+      when: user_action == 'create'
+
+- name: Check Study folder & group
+  block:
+    - name: Check AD group exists
+      win_domain_group:
+        name: "{{ study_code }}"
+        description: "{{ study_code }} study"
+        path: "ou=Project Groups,dc={{ win_project }},dc=loc"
+        scope: domainlocal
+        category: security
+        state: present
+      check_mode: true
+      changed_when: false
+      register: group
+      failed_when: group.created == true
+
+    - name: Check if Folder Created
+      win_stat:
+        path: "{{ study_folder }}"
+      register: folder
+      delegate_to: "{{ os_project }}-{{ win_project }}-fs01"
+      failed_when: folder.stat.exists == false
+
+- name: Verify User
+  block:
+    - name: Get User account status
+      win_domain_user:
+        name: "{{ username }}"
+        state: query
+      register: user
+
+    - name: Check user doesn't already exist
+      ansible.builtin.assert:
+        that:
+          - user.state == 'absent'
+        msg: "Trying to create a user that already exists."
+        quiet: true
+      when: user_action == 'create'
+
+    - name: Check user exist
+      ansible.builtin.assert:
+        that:
+          - user.state == 'present'
+        msg: "Trying to modify a user that doesn't exists."
+        quiet: true
+      when: user_action != 'create'
+
+

ansible/roles/win_user/tasks/check.yml

@@ -1,44 +0,0 @@
----
-- name: Check user
-  tags: check_user
-  block:
-    - name: Verify study group exists
-      win_domain_group:
-        name: "{{ study_code }}"
-        description: "{{ study_code }} study"
-        path: "ou=Project Groups,dc={{ win_project }},dc=loc"
-        scope: domainlocal
-        category: security
-        state: present
-      check_mode: true
-      changed_when: false
-      register: group
-
-    - name: Check if study folder already exists 
-      win_stat:
-        path: "{{ study_folder }}"
-      register: folder
-      delegate_to: "{{ os_project }}-{{ win_project }}-fs01"
-
-    - name: Verify User does not already exist
-      win_domain_user:
-        name: "{{ username }}"
-        state: query
-      register: user
-
-    - name: Duplicate User Detected
-      fail:
-        msg="This study has not been created yet"
-      when: group.created == true or
-            folder.stat.exists == false
-
-    - name: Duplicate User Detected
-      fail:
-        msg="This User already exists"
-      when: user.state == "present"
-
-
-
-
-
-

ansible/roles/win_user/tasks/create.yml

@@ -1,9 +1,8 @@
 ---
 - name: Create AD user
-  tags: create_user
   block:
     - name: Create user in AD
-      win_domain_user:
+      microsoft.ad.user:
         name: "{{ username }}"
         firstname: "{{ firstname }}"
         surname: "{{ lastname }}"

ansible/roles/win_user/tasks/disable.yml

@@ -0,0 +1,9 @@
+---
+- name: Disable AD user
+  block:
+    - name: Disable user in AD
+      microsoft.ad.user:
+        name: "{{ username }}"
+        path: ou=Project Users,dc={{ win_project }},dc=loc
+        state: present
+        enabled: no

ansible/roles/win_user/tasks/main.yml

@@ -1,3 +1,3 @@
 ---
-- import_tasks: check.yml
+- import_tasks: assert.yml
-- import_tasks: create.yml
+- import_tasks: "{{ user_action }}.yml"

ansible/roles/win_user/tasks/reset.yaml

@@ -0,0 +1,14 @@
+---
+- name: Reset AD user password
+  block:
+    - name: debug
+      debug:
+        var: password
+
+    - name: Reset AD user password
+      microsoft.ad.user:
+        name: "{{ username }}"
+        path: ou=Project Users,dc={{ win_project }},dc=loc
+        password: "{{ password }}"
+        password_expired: true
+        state: present

ansible/roles/win_user/vars/main.yml

@@ -1 +1,3 @@
-study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }}
+study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }}
+
+valid_actions: ["create", "reset", "disable"]