User creation for protected zone

ansible/roles/win_user/tasks/assert.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: Check User Action
+- name: Check User Action is valid
   ansible.builtin.assert:
     that: 
       - user_action is defined
@@ -19,10 +19,11 @@
           - username|length <= 20
         quiet: true
 
-    - name: Check User Info 
+    - name: Check User Info [CREATE]
       ansible.builtin.assert:
         that:
           - study_code is defined
+        # - username checked already
           - password is defined 
           - firstname is defined 
           - lastname is defined 
@@ -31,6 +32,31 @@
         quiet: true
       when: user_action == 'create'
 
+    - name: Check User Info [RESET]
+      ansible.builtin.assert:
+        that:
+        # - username checked already
+          - password is defined
+        quiet: true
+      when: user_action == 'reset'
+
+    - name: Check User Info [DISABLE]
+      ansible.builtin.assert:
+        that:
+        # - username checked already
+          - study_code is defined # so can be removed from group (WIP)
+          - user_role is defined  # so can be removed from group (WIP)
+        quiet: true
+      when: user_action == 'disable'
+
+    - name: Check User Info [MODIFY]
+      ansible.builtin.assert:
+        that:
+          - study_code is defined
+          - user_role is defined  
+        quiet: true
+      when: user_action == 'modify'
+
 - name: Check Study folder & group
   block:
     - name: Check AD group exists

ansible/roles/win_user/tasks/create.yml

@@ -9,11 +9,15 @@
         description: "{{ user_role }} - {{ study_code }}"
         path: ou=Project Users,dc={{ win_project }},dc=loc
         groups:
-          - "{{ study_code }}"
-          - Remote Desktop Users
+          add:
+            - "{{ study_code }}"
+            - Remote Desktop Users
         email: "{{ email }}"
         attributes:
-          HomeDirectory: "{{ study_folder }}"
+          add:
+            HomeDirectory: "{{ study_folder }}"
         password: "{{ password }}"
         password_expired: true
-        state: present
+        state: present
+
+    - import_tasks: exporter.yml # referece exporter so modify can be more general purpose

ansible/roles/win_user/tasks/exporter.yml

@@ -0,0 +1,25 @@
+---
+- name: Modify Export Access
+  block:
+    - name: Add user to exporter group 
+      microsoft.ad.user:
+        name: "{{ username }}"
+        description: "{{ user_role }} - {{ study_code }}"
+        path: ou=Project Users,dc={{ win_project }},dc=loc
+        groups:
+          add:
+            - "{{ exporter_group }}"
+        state: present
+      when: user_role == 'Exporter'
+
+    - name: Remove user from exporter group 
+      microsoft.ad.user:
+        name: "{{ username }}"
+        description: "{{ user_role }} - {{ study_code }}"
+        path: ou=Project Users,dc={{ win_project }},dc=loc
+        groups:
+          remove:
+            - "{{ exporter_group }}"
+        state: present
+      when: user_role != 'Exporter'
+  when: project_zone == 'protected'

ansible/roles/win_user/tasks/modify.yml

@@ -0,0 +1,2 @@
+---
+- import_tasks: exporter.yml

ansible/roles/win_user/tasks/reset.yaml

@@ -1,10 +1,6 @@
 ---
 - name: Reset AD user password
   block:
-    - name: debug
-      debug:
-        var: password
-
     - name: Reset AD user password
       microsoft.ad.user:
         name: "{{ username }}"

ansible/roles/win_user/vars/main.yml

@@ -1,3 +1,4 @@
 study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }}
+exporter_group: "{{ study_code }}-exporter"
 
-valid_actions: ["create", "reset", "disable"]
+valid_actions: ["create", "reset", "disable", "modify"]