Adding entry to end of line Ansible SLES 12

Question

On SLES 12 server. Trying to append to this entry in my /etc/security/pam_winbind.conf file with this extra entry S-1-5-21-84296906-944397292-530207130-587119.

The line is

require_membership_of=S-1-5-21-84296906-944397292-530207130-496773,S-1-5-21-84296906-944397292-530207130-71056,S-1-5-21-84296906-944397292-530207130-218591

My playbook

---
- name: Configuring ad_access_filter for RHEL systems.
  hosts: smt-test
  become: yes

  tasks:
  - name: Taking Backup.
    copy:
      src: /etc/security/pam_winbind.conf
      dest: /etc/security/pam_winbind.conf.backup
      remote_src: yes

  - name: Add HQCloud to the sssd.conf file
    lineinfile:
      path: /etc/security/pam_winbind.conf
      backrefs: yes
      regexp: '(^*2185915*)$'
      line: '\1,S-1-5-21-84296906-944397292-530207130-587119'

  - name: Add HQCloudScapeSupp to the sudoers file.
    lineinfile:
      path: /etc/sudoers
      line: 'HQCloudScapeSupp ALL=(ALL) NOPASSWD: ALL'

  - name: Restarting WinBind Service
    service:
      name: winbind
      state: restarted

Since the pam_winbind.conf will be different on each server, how do I just add that entry to the end of that line regardless of the other memberships?

Answer 1

There are a few problems with your approach IMO

1. It might be possible to do add your membership line with only a regex and backrefences but achieving idempotence will be a real pain. Indeed, you actually need to add your required membership if it does not already exist anywhere in the string (it might be present but not in last position). If it is already present anywhere, you should not touch anything.
2. You are making a backup of your file separately where the lineinfile module can do this automatically for you and only when there is a change
3. you are unconditionally restarting your service where it should only restart when something has actually changed requiring a restart.

The below playbook addresses the above issues:

---
- name: Configuring ad_access_filter for RHEL systems.
  hosts: smt-test
  become: yes

  vars:
    config_file: /etc/security/pam_winbind.conf
    required_member: S-1-5-21-84296906-944397292-530207130-587119
    search_needle: require_membership_of=
    search_regexp: "^{{ search_needle }}(.*)$"


  tasks:
    - name: slurp file content to get existing membership entries
      slurp:
        path: "{{ config_file }}"
      register: slurped_file

    - name: Add HQCloud to the sssd.conf file if it does not exist + backup if any change
      vars:
        file_content_lines: "{{ (slurped_file.content | b64decode).splitlines() }}"
        requirement_line: "{{ file_content_lines | select('match', search_needle) | first }}"
        existing_members: "{{ (requirement_line | regex_replace(search_regexp, '\\g<1>')).split(',') | map('trim') }}"
        wanted_members: "{{ existing_members | union([required_member]) }}"
      lineinfile:
        path: "{{ config_file }}"
        regexp: "{{ search_regexp }}"
        backup: true
        line: "{{ search_needle }}{{ wanted_members | join(',') }}"

    - name: Add HQCloudScapeSupp to the sudoers file.
      lineinfile:
        path: /etc/sudoers
        line: 'HQCloudScapeSupp ALL=(ALL) NOPASSWD: ALL'
      # Not really sure this is needed
      notify: Restart winbind

  handlers:
    - name: Restart winbind
      service:
        name: winbind
        state: restarted