Users: Add the ability to revoke user accounts

Signed-off-by: Zack Cerza <zack@redhat.com>

diff --git a/roles/users/README.rst b/roles/users/README.rst
index c91e9e22adc564b589977389e4e091541f959c80..092c1b3cd8bd6ffafa5b18e5ea1d91bc304ac1a6 100644 (file)
--- a/roles/users/README.rst
+++ b/roles/users/README.rst
@@ -23,6 +23,10 @@ When adding a user, these steps are performed for each user:
 - Adds the user's public key to ~/.ssh/authorized_keys (tags: pubkeys)
 
 
+This role also supports revoking user access by removing all users in the
+``revoked_users`` variable.
+
+
 Usage
 +++++
 
@@ -73,13 +77,20 @@ A list of usernames to filter ``managed_users`` and ``managed_admin_users`` by::
 
     users: []
 
+A list of usernames whose access is to be revoked::
+
+    revoked_users: []
+
 Tags
 ++++
 
 Available tags are listed below:
 
 users
-    Perform only user creation tasks, ssh keys will not be updated.
+    Perform only user creation/removal tasks; ssh keys will not be updated.
+
+revoke
+    Perform only user removal tasks.
 
 pubkeys
     Perform only authorized keys tasks, users will not be created but all
@@ -91,8 +102,6 @@ TODO
 - Allow management of the UID for each user
 
 - Allow management of the shell for each user
- 
-- Add the ability to remove or revoke user access
 
 - Ensure that the sudo group exists with the correct permissions. We currently depend on it
   being created already by other playbooks (ansible_managed.yml) or created by cobbler

diff --git a/roles/users/defaults/main.yml b/roles/users/defaults/main.yml
index f73a2a0416877678660436008c36e9800ab79f8d..522dc174fb974892ca8edf79dff94f2d4c5ad325 100644 (file)
--- a/roles/users/defaults/main.yml
+++ b/roles/users/defaults/main.yml
@@ -18,3 +18,6 @@ managed_admin_users: []
 # both managed_users and managed_admin_users would be filtered
 # to only contain the information for 'user1'.
 users: []
+
+# A list of users whose access is to be revoked. These accounts will be deleted.
+revoked_users: []

diff --git a/roles/users/tasks/main.yml b/roles/users/tasks/main.yml
index 714cd1dbed0eebc9739d887adae58f1c18b0e629..12f266c8a1425ae5f7665532301675d33f54fd06 100644 (file)
--- a/roles/users/tasks/main.yml
+++ b/roles/users/tasks/main.yml
@@ -50,3 +50,22 @@
   delay: 5
   tags:
     - pubkeys
+
+- name: Filter the revoked_users list
+  set_fact:
+    revoked_users:
+        "[{% for user in revoked_users %}
+            {% if user in users %}'{{ user }}',{%endif%}
+        {%endfor%}]"
+  when: users|length > 0
+  tags:
+    - always
+
+- name: Remove revoked users
+  user:
+    name: "{{ item }}"
+    state: absent
+  with_items: revoked_users
+  tags:
+    - user
+    - revoke