Fix nxos_user purge deleting non-locally configured users.

changelogs/fragments/purged_user.yaml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - Fixes nxos_user purge deleting non-local users,ensuring only local users are removed.

plugins/modules/nxos_user.py

@@ -412,6 +412,19 @@ def update_objects(want, have):
     return updates
 
 
+def get_configured_usernames(module):
+    config_output = run_commands(
+        module,
+        [{"command": "show running-config | section ^username", "output": "text"}],
+    )
+    usernames = set()
+    for line in config_output[0].splitlines():
+        if line.startswith("username "):
+            username = line.split()[1]
+            usernames.add(username)
+    return usernames
+
+
 def main():
     """main entry point for module execution"""
     element_spec = dict(
@@ -457,9 +470,14 @@ def main():
     commands = map_obj_to_commands(update_objects(want, have), module)
 
     if module.params["purge"]:
-        want_users = [x["name"] for x in want]
-        have_users = [x["name"] for x in have]
-        for item in set(have_users).difference(want_users):
+        want_users = set([x["name"] for x in want])
+        have_users = set([x["name"] for x in have])
+
+        configured_usernames = get_configured_usernames(module)
+
+        non_local_users = have_users.difference(want_users).difference(configured_usernames)
+
+        for item in configured_usernames.difference(non_local_users):
             if item != "admin":
                 item = item.replace("\\", "\\\\")
                 commands.append("no username %s" % item)

tests/unit/modules/network/nxos/test_nxos_user.py

@@ -116,3 +116,58 @@ def test_nxos_hashed_password(self):
                 "username ansible password 5 $5$JFHICC$u.zXRUgprAkkYLiEns8VrhsNEIOj7FzVrn67tuJdtKB",
             ],
         )
+
+    def test_purge_with_non_local_users(self):
+        self.run_commands.side_effect = [
+            [
+                {
+                    "TABLE_template": {
+                        "ROW_template": [
+                            {
+                                "usr_name": "admin",
+                                "expire_date": "this user account has no expiry date",
+                                "TABLE_role": {"ROW_role": {"role": "network-admin"}},
+                            },
+                            {
+                                "usr_name": "ansible-test-1",
+                                "expire_date": "this user account has no expiry date",
+                                "TABLE_role": {"ROW_role": [{"role": "network-operator"}]},
+                            },
+                            {
+                                "usr_name": "ansible-test-2",
+                                "expire_date": "this user account has no expiry date",
+                                "TABLE_role": {"ROW_role": [{"role": "network-operator"}]},
+                            },
+                            {
+                                "usr_name": "domain\\remote-user",
+                                "expire_date": "this user account has no expiry date",
+                                "TABLE_role": {"ROW_role": [{"role": "network-operator"}]},
+                            },
+                        ],
+                    },
+                },
+            ],
+            [
+                "username admin password 5 $5$JFHICC$QwE password\n"
+                "username ansible-test-1 password 5 $5$JFHICC$abc password\n"
+                "username ansible-test-2 password 5 $5$JFHICC$def password\n",
+            ],
+        ]
+        set_module_args(dict(name="new-user", configured_password="ansible123", purge=True))
+        result = self.execute_module(
+            changed=True,
+            commands=[
+                "no username ansible-test-1",
+                "no username ansible-test-2",
+                "username new-user",
+                "username new-user password ansible123",
+                # domain\remote-user should NOT be in the commands list as it's preserved
+            ],
+        )
+        expected_commands = [
+            "no username ansible-test-1",
+            "no username ansible-test-2",
+            "username new-user",
+            "username new-user password ansible123",
+        ]
+        self.assertEqual(sorted(result["commands"]), sorted(expected_commands))