microsoft.ad.group module : Set members to an empty list about microsoft.ad

[arnydbois]

Following Powershell remove groups if it's configure with an empty list

- name: remove groups members
  ansible.windows.win_powershell:
    script: |
      [CmdletBinding()]
      param (
          [String]
          $groups_name    
      )
      
      #Remove existing Group
      $Groups = (Get-ADGroup $groups_name -Properties Member).Member
      Remove-ADGroupMember -Identity $groups_name -Members $Groups -Confirm:$false 
          
    parameters:
      groups_name: "{{ item.name }}" 
  
  loop: "{{ site_ADDC_groups }}"
  when: item.member_of == ''

[jborean93]

The problem here is that the members/set option is set to be a list type with string elements. Traditionally in Ansible the argument validation will convert the value to a list if a single value was specified for example foo: bar would become foo: ['bar']. The same applies to an empty string where foo: "" becomes foo: [""].

This is a problem because the code will see this list, go through each member and try to find the group's identity which in this case will be an empty string.

The best way to specify an empty list as the value is to just use an empty list like so

- name: Creat ADDC groups whith members
  microsoft.ad.group:
    name: "{{ item.name }}"
    description : "{{ item.description }}"
    scope: "{{ item.scope }}"
    path: "{{ group_fqdn_path }}"
    state: present
    members:
      set: []
    protect_from_deletion: true
  loop: "{{ site_ADDC_groups }}"

I'll leave this open as I think the code should probably just ignore empty strings for these values or at the very least it should document this scenario to help others who might come across it.