win_domain_user - ability to clear an attribute about community.windows

[jborean93]

From @nwchandler on Feb 26, 2020 18:25

It’s been a while since I worked on this module, but I think I remember testing this behavior. Is it possible to remove an attribute by omitting it from the dictionary? So for example, instead of street: “” will it remove the attribute if you do not include the line with street at all?

[jborean93]

From @thylocene on Feb 27, 2020 02:27

Hi Nick,

We need to include the attributes because of the automation but the issue
we have is that we cannot use street: '' for the scenario where the street
attribute is not provided since it is optional (creating a new user
account). With Set-Aduser PowerShell module to clear an attribute you have
to use $null. We have no way to do that with the existing module
See https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-aduser?view=win10-ps
https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-aduser?view=win10-ps
e.g.

To clear all values:
-Certificates $Null

On Thu, Feb 27, 2020 at 2:25 AM Nick Chandler [email protected]
wrote:

It’s been a while since I worked on this module, but I think I remember
testing this behavior. Is it possible to remove an attribute by omitting it
from the dictionary? So for example, instead of street: “” will it remove
the attribute if you do not include the line with street at all?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/ansible/ansible/issues/67764?email_source=notifications&email_token=AA6YHU4S5BI2MBZ4ELP4SF3RE2X3JA5CNFSM4K34DPS2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENBKVNI#issuecomment-591571637,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AA6YHUYOS7A4C5C3CR2WAA3RE2X3JANCNFSM4K34DPSQ
.

[jborean93]

From @nwchandler on Feb 28, 2020 22:12

The scenario makes sense, I think. You have to include optional settings in the playbook in case they are passed in, but they might not all be passed in.

It seems like we could check for an empty string and, instead of passing that through to Set-ADUser we could pass $null instead.

I wonder if this is a pattern adopted (or problem solved) elsewhere in other modules already. Perhaps @jborean93 or others may know off hand?

[coltonhughes]

Was there any update on this? Im experiencing this same issue and would like to know if there are any further comments.

[RichBrumpton]

I'm experiencing the same issue, I need to be able to leave values alone using omit as appropriate, but there are some others that I need to actively blank out.

[igorfraa]

Experiencing the same issue.

[draganmudric]

Same issues here. Any update on this?

[jborean93]

No updates except what's already here. This is a community driven collection so if you wish to see any changes on this front it needs to come from the community.

[jborean93]

The win_domain_user module has been deprecated by #516 in favour of microsoft.ad.user. See the migration guide for more info on how to change your code to use the newer module.

The microsoft.ad.user module can clear attributes by either setting it to null or an empty list.