From d3206c219c3bc3981a45b22d70f4c15128b906ac Mon Sep 17 00:00:00 2001
From: abrown38 <a.brown@epcc.ed.ac.uk>
Date: Thu, 6 Mar 2025 10:48:04 +0000
Subject: [PATCH] Create win_admin role to create admin users

---
 ansible/playbooks/win_admin.yml           |  9 +++++++
 ansible/roles/win_admin/defaults/main.yml |  1 +
 ansible/roles/win_admin/tasks/assert.yml  | 29 +++++++++++++++++++++++
 ansible/roles/win_admin/tasks/create.yml  | 24 +++++++++++++++++++
 ansible/roles/win_admin/tasks/main.yml    |  5 ++++
 ansible/roles/win_admin/vars/main.yml     |  2 ++
 6 files changed, 70 insertions(+)
 create mode 100644 ansible/playbooks/win_admin.yml
 create mode 100644 ansible/roles/win_admin/defaults/main.yml
 create mode 100644 ansible/roles/win_admin/tasks/assert.yml
 create mode 100644 ansible/roles/win_admin/tasks/create.yml
 create mode 100644 ansible/roles/win_admin/tasks/main.yml
 create mode 100644 ansible/roles/win_admin/vars/main.yml

diff --git a/ansible/playbooks/win_admin.yml b/ansible/playbooks/win_admin.yml
new file mode 100644
index 0000000..565b172
--- /dev/null
+++ b/ansible/playbooks/win_admin.yml
@@ -0,0 +1,9 @@
+---
+- hosts: "meta-name_dc01"
+  gather_facts: false
+  vars_files:
+    - ../vars/common.yml
+    - ../vars/connection.yml
+  roles:
+    - role: win_admin
+      tags: win_admin
diff --git a/ansible/roles/win_admin/defaults/main.yml b/ansible/roles/win_admin/defaults/main.yml
new file mode 100644
index 0000000..d6224b7
--- /dev/null
+++ b/ansible/roles/win_admin/defaults/main.yml
@@ -0,0 +1 @@
+user_action: create
diff --git a/ansible/roles/win_admin/tasks/assert.yml b/ansible/roles/win_admin/tasks/assert.yml
new file mode 100644
index 0000000..0a91747
--- /dev/null
+++ b/ansible/roles/win_admin/tasks/assert.yml
@@ -0,0 +1,29 @@
+---
+- name: Check User Action is valid
+  ansible.builtin.assert:
+    that: 
+      - user_action is defined
+      - user_action is string
+      - user_action is in valid_actions
+    quiet: true
+
+- name: Check User information
+  block:
+    - name: Check Username
+      ansible.builtin.assert:
+        that:
+          - username is defined
+          - username is string
+          - username is not none
+          - username|length <= 20
+        quiet: true
+
+    - name: Check User Info [CREATE]
+      ansible.builtin.assert:
+        that:
+          - password is defined 
+          - firstname is defined 
+          - lastname is defined 
+        quiet: true
+      when: user_action == 'create'
+
diff --git a/ansible/roles/win_admin/tasks/create.yml b/ansible/roles/win_admin/tasks/create.yml
new file mode 100644
index 0000000..cb4fd53
--- /dev/null
+++ b/ansible/roles/win_admin/tasks/create.yml
@@ -0,0 +1,24 @@
+---
+name: Create AD Admin 
+block:
+  - name: Create user in AD
+    microsoft.ad.user:
+      name: "{{ username }}"
+      firstname: "{{ firstname }}"
+      surname: "{{ lastname }}"
+      groups:
+        add:
+          - "{{ domain_admin_group }}"
+
+        password: "{{ password }}"
+        password_expired: false
+        state: present
+
+rescue:
+  - name: Removing failed User
+    microsoft.ad.user:
+      name: "{{ username }}"
+      state: absent
+
+  - name: Trigger Failure
+    ansible.builtin.fail:
diff --git a/ansible/roles/win_admin/tasks/main.yml b/ansible/roles/win_admin/tasks/main.yml
new file mode 100644
index 0000000..e47c7b2
--- /dev/null
+++ b/ansible/roles/win_admin/tasks/main.yml
@@ -0,0 +1,5 @@
+---
+- import_tasks: assert.yml
+- import_tasks: "{{ user_action }}.yml"
+
+
diff --git a/ansible/roles/win_admin/vars/main.yml b/ansible/roles/win_admin/vars/main.yml
new file mode 100644
index 0000000..7d69f36
--- /dev/null
+++ b/ansible/roles/win_admin/vars/main.yml
@@ -0,0 +1,2 @@
+valid_actions: ["create", "reset", "disable", "enable", "modify"]
+domain_admin_group: "Domain Admins"