ansible-collection/playbooks/misc/ili-add-user-access.yml

---
- name: ILI - Add user to server AD group from Jira ticket
  hosts: all
  gather_facts: false
  connection: local
  collections:
    - community.general

  # lookforjira_issue_key is provided by the AAP survey as an extra variable
  # Credentials (service_user_ccta/dmz23/dmz24, schrodingers_password,
  # lookforjira_api_token) are injected by AAP credential types.

  roles:
    - lookforjira

  tasks:
    - name: Extract fields from Jira description
      ansible.builtin.set_fact:
        # The Jira form has the field label on one line and the value on the next.
        # regex_findall captures the value line after the label. The [ ]* matches
        # any trailing spaces after the colon before the newline. [^\n]+ ensures
        # we only capture non-empty lines, so empty fields return no match.
        # | first gets the value, | default('') handles the case where the field
        # is empty (no match found).
        server_ccta: >-
          {{ jira_result.meta.fields.description
             | regex_findall('Oplys Servernavne - CCTA:[ ]*\n([^\n]+)')
             | first | default('') | trim }}
        server_dmz23: >-
          {{ jira_result.meta.fields.description
             | regex_findall('Oplys Servernavne? - DMZ23:[ ]*\n([^\n]+)')
             | first | default('') | trim }}
        server_dmz24: >-
          {{ jira_result.meta.fields.description
             | regex_findall('Oplys Servernavne - DMZ24:[ ]*\n([^\n]+)')
             | first | default('') | trim }}
        admin_user: >-
          {{ jira_result.meta.fields.description
             | regex_findall('W-nummer eller DMZ-bruger:[ ]*\n(\S+)')
             | first | default('') | trim }}

    - name: Show user
      ansible.builtin.debug:
        msg: "User: {{ admin_user }}"
      when: admin_user != ''

    # ── CCTA ─────────────────────────────────────────────────────────────────
    - name: Determine jump host for CCTA
      ansible.builtin.set_fact:
        dc_domain: "EXAMPLE-CORP.COM"
      when: server_ccta != '' and admin_user != ''

    - name: Include determine-jump-host role for CCTA
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_ccta != '' and admin_user != ''

    - name: Show CCTA group
      ansible.builtin.debug:
        msg: "User: {{ admin_user }} -> Group: {{ server_ccta.split('.')[0] }} via {{ winjump_host }}"
      when: server_ccta != '' and admin_user != ''

    - name: Add user to CCTA server AD group
      microsoft.ad.group:
        identity: "{{ server_ccta.split('.')[0] }}"
        members:
          add:
            - "{{ admin_user }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_ccta }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_ccta != '' and admin_user != ''
      register: group_result_ccta
      failed_when: false

    - name: Warn if CCTA AD group does not exist
      ansible.builtin.debug:
        msg: "WARNING: AD group {{ server_ccta.split('.')[0] }} not found - group may need to be created first"
      when: group_result_ccta is defined and group_result_ccta.failed | default(false)

    # ── DMZ23 ────────────────────────────────────────────────────────────────
    - name: Determine jump host for DMZ23
      ansible.builtin.set_fact:
        dc_domain: "DMZ23.EXAMPLE.COM"
      when: server_dmz23 != '' and admin_user != ''

    - name: Include determine-jump-host role for DMZ23
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_dmz23 != '' and admin_user != ''

    - name: Show DMZ23 group
      ansible.builtin.debug:
        msg: "User: {{ admin_user }} -> Group: {{ server_dmz23.split('.')[0] }} via {{ winjump_host }}"
      when: server_dmz23 != '' and admin_user != ''

    - name: Add user to DMZ23 server AD group
      microsoft.ad.group:
        identity: "{{ server_dmz23.split('.')[0] }}"
        members:
          add:
            - "{{ admin_user }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_dmz23 }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_dmz23 != '' and admin_user != ''
      register: group_result_dmz23
      failed_when: false

    - name: Warn if DMZ23 AD group does not exist
      ansible.builtin.debug:
        msg: "WARNING: AD group {{ server_dmz23.split('.')[0] }} not found - group may need to be created first"
      when: group_result_dmz23 is defined and group_result_dmz23.failed | default(false)

    # ── DMZ24 ────────────────────────────────────────────────────────────────
    - name: Determine jump host for DMZ24
      ansible.builtin.set_fact:
        dc_domain: "DMZ.EXAMPLE.COM"
      when: server_dmz24 != '' and admin_user != ''

    - name: Include determine-jump-host role for DMZ24
      ansible.builtin.include_role:
        name: determine-jump-host
      when: server_dmz24 != '' and admin_user != ''

    - name: Show DMZ24 group
      ansible.builtin.debug:
        msg: "User: {{ admin_user }} -> Group: {{ server_dmz24.split('.')[0] }} via {{ winjump_host }}"
      when: server_dmz24 != '' and admin_user != ''

    - name: Add user to DMZ24 server AD group
      microsoft.ad.group:
        identity: "{{ server_dmz24.split('.')[0] }}"
        members:
          add:
            - "{{ admin_user }}"
      delegate_to: "{{ winjump_host }}"
      vars:
        ansible_user: "{{ service_user_dmz24 }}"
        ansible_password: "{{ schrodingers_password }}"
        ansible_connection: ssh
        ansible_shell_type: powershell
      when: server_dmz24 != '' and admin_user != ''
      register: group_result_dmz24
      failed_when: false

    - name: Warn if DMZ24 AD group does not exist
      ansible.builtin.debug:
        msg: "WARNING: AD group {{ server_dmz24.split('.')[0] }} not found - group may need to be created first"
      when: group_result_dmz24 is defined and group_result_dmz24.failed | default(false)