Ansible play for creating user not setting password

Question

Try to set a password randomly and create user with it:

vars:

users:
  - username: myuser
    password: "{{ 99999999999999 | random | to_uuid }}"

role:

- name : Add user accounts
  user:
    name: "{{ item.username }}"
    shell: /bin/bash
    groups: sudo,users,admin,adm,ubuntu
    password: '{{ item.password | password_hash("sha512") }}'
  become: true
  with_items: "{{ users }}"

- name: Store users' password in file
  copy:
    content: "{{ item.password }}"
    dest: /home/{{ item.username }}/password.txt
    mode: 0600
    owner: "{{ item.username }}"
  become: true
  with_items: "{{ users }}"

This is provisioned from an OSX ansible workstation, and the instance the user account is provisioned on is an Ubuntu 14.04 instance.

These steps complete without error, and the password.txt is created in the users home folder and populated with a uuid string, which I would expect to be the password. There is also a sha512-like string added to /etc/shadow for the relevant user.

/home/myuser/password.txt:

df81ab5c-c06c-5a2c-b08a-28d52b3a2f6f

/etc/shadow:

myuser:$6$rounds=656000$YKieOBXtL6UKP0lO$5zgyi9D9tmbINkoDVL0EghbCCYInKdyPJ2UFnrDFLAQkB2x7sWBrjKS0uTySvcDGF6jUN1noMvaVD9jp/Dxx71:17193:0:99999:7:::

/var/log/auth.log after su myuser failure:

pam_unix(su:auth): authentication failure; logname=ubuntu uid=1000 euid=0 tty=/dev/pts/1 ruser=ubuntu rhost=  user=myuser
pam_authenticate: Authentication failure
FAILED su for myuser by ubuntu
- /dev/pts/1 ubuntu:myuser

The result however is that the password doesn't work with commands such as sudo -i as the user, or su myuser from another account.

I've read that OSX vs Linux can result in incompatible keys, but as far as I can tell one of passlib's (which |password_hash('sha512') selling points is cross-platform compatibility.

Am I using these tasks/filters correctly or am I missing something?

Answer 1

I just wanted to throw this out there after working on it for 5 years and 9 months. :) I don't know if it had anything to do with the filter, but I have always installed the community.general collection in galaxy and used this filter to generate password, and everything works perfectly. Again, 5 years after this question was asked.

---
  - name: Test
    hosts: localhost
    vars:
      username: "Jimmy"
      password: lookup('community.general.random_string', base64=true)
    tasks:
      - name : Add user accounts
        user:
          name: "{{ username }}"
          password: '{{ password | password_hash("sha512") }}'
        become: true