Using microsoft.ad.group to set members of a group does not work when both groups are in different OUs about microsoft.ad

[jborean93]

Looks like the problem isn't the OU but the length of the group name. The lookup code has a check to see if the input value is between 1-20 characters and if so search by sAMAccountName

microsoft.ad/plugins/module_utils/_ADObject.psm1

Lines 562 to 564 in 55831e6

	elseif ($Identity -match '^(?:[^:*?""<>|\/\\]+\\)?(?<username>[^;:""<>|?,=\*\+\\\(\)]{1,20})$') {
	$getParams.LDAPFilter = "(sAMAccountName=$($Matches.username))"
	}

As TEST-MS-SQL-Server-abc-Administratoren exceeds 20 characters it's just going to try and find it by DistinguishedName which won't work. The following is a quick reproducer:

- hosts: ...
  gather_facts: false

  tasks:
  - block:
    - name: create OU1
      microsoft.ad.ou:
        name: OU1
        state: present
      register: ou1

    - name: create OU2
      microsoft.ad.ou:
        name: OU2
        state: present
      register: ou2

    - name: create Group1
      microsoft.ad.group:
        name: Group1
        path: '{{ ou1.distinguished_name }}'
        scope: domainlocal
      register: group1

    - name: create Group2
      microsoft.ad.group:
        name: Group2-ReallyLongGroupNameHere
        path: '{{ ou2.distinguished_name }}'
        scope: domainlocal

    - name: add Group2 to Group1
      microsoft.ad.group:
        identity: Group1
        members:
          set:
          - Group2-ReallyLongGroupNameHere

    - name: get group membership
      microsoft.ad.object_info:
        identity: '{{ group1.object_guid }}'
        properties: member

    always:
    - name: remove example OUs
      microsoft.ad.ou:
        name: '{{ item }}'
        state: absent
      loop:
      - OU1
      - OU2

When I change the regex from {1,20} to just + then the example above works. This is interesting because the docs for the sAMAccountName attribute states the maximum length is 20 characters but either that's out of date or just wrong. I'll have a play around and see what the next steps forward should be.

As a workaround you can use the distinguishedName, securityIdentifier, objectGuid, or userPrincipalName of the group in the yaml definition.

[jborean93]

This has been fixed with #95