Ability to specify exact list of groups for user (and revoke user from any other groups)

[Vanav]

SUMMARY

Currently there seems to be no way to specify exact list of groups for user. You can only grant or revoke individual groups, without ability to revoke all groups from user.

There should be something like append in user module (https://docs.ansible.com/ansible/latest/collections/ansible/builtin/user_module.html#parameter-append), that allows to choose, if list of groups should be exact and exclusive.

Use case 1: revoke all groups from user.
Use case 2: user should be only in specified groups (and removed from any other groups).

ISSUE TYPE

• Feature Idea

COMPONENT NAME

community.postgresql.postgresql_membership and community.postgresql.postgresql_user.

[hunleyd]

thanks for your suggestion @Vanav ! I think this feature makes a lot of sense and we'll try to get it implemented in the near term.

[Andersson007]

thanks for your suggestion @Vanav ! I think this feature makes a lot of sense and we'll try to get it implemented in the near term.

Agreed! @Vanav thanks for reporting the issue!
For folks who wanna pick it up, fyi we have the Quick start guide.
Whoever's gonna implement it, please put it explicitly here to avoid parallel work.

[Andersson007]

I took a look, folks, and am happy to pick it up:)

Use case 2

1. First thing that came to mind is introduction of a new parameter, for example, called mode or group_match (please suggest your options if it doesn't sound good to you).
It'll have several choices:
- When it's not specified (a default behavior), it means it'll work as now. If i understand correctly it appends groups when state is present and subtracts groups when state is absent.
- exact will work as described in Use case 2

2. OR we can make group_match boolean.
- False by default will mean it'll work as now
- True will work as described in Use case 2

Use case 1

1. We could add the revoke-all choice to the state argument.

Update: it should work similarly for both the modules, so i guess a new parameter called group_mode is the only option. It'll have choices:

• none (default) will work as now
• exact will work as described in Use case 2
• remove-all will work as in Use case 1

@Vanav @hunleyd @jchancojr what do you folks think? (needless to say that if you know better options, please suggest)

[hunleyd]

I don't understand the difference between exact and remove-all. For postgresql_membership, if I specify exact and groups: '', shouldn't that be the same as remove-all? And as for postgresql_user, I'd actually remove the ability to assign groups and just have it create/remove users (KISS). We seem to have a lot of redundancy in our modules and personally I'd like to simplify that away (we did similar in #227 ).

My $0.02

[Andersson007]

I don't understand the difference between exact and remove-all. For postgresql_membership, if I specify exact and groups: '', shouldn't that be the same as remove-all? And as for postgresql_user, I'd actually remove the ability to assign groups and just have it create/remove users (KISS). We seem to have a lot of redundancy in our modules and personally I'd like to simplify that away (we did similar in #227 ).

My $0.02

good catch
so @hunleyd would you like to deprecate it as in #227 and add an issue to the milestone?

[hunleyd]

sure, i can do that today/tomorrow

[Andersson007]

I merged the PR
@Vanav thanks for bringing this up! @hunleyd thanks for taking part in the discussion!