[microsoft.ad.user] Add parameter to fail, ignore or warn if the account performing the action does not have the permissions required to modify the AD Group

[tarmael]

SUMMARY

Fixes #140

Adds sub-parameter to groups
permissions_failure_action

Options:

• fail
• ignore
• warn

Default: fail

This feature prevents microsoft.ad.user from failing when attempting to add or remove a user from a group that the domain_username user does not have permissions to modify if ignore or warn is specified.

Similar to the lookup_failure_action feature that prevents failures when attempting to add a group that does not exist,

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

groups:
permissions_failure_action:

ADDITIONAL INFORMATION

Before:
"exception": "Insufficient access rights to perform the operation\r\nAt line:458 char:25
+                         Set-ADObject -Identity $member -Add @{
+                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (CN=Restricted_Group...mydomain,DC=com:ADObject) [Set-ADObject], ADException

After:
  "warnings": [
    "Cannot add group 'CN=Restricted_Group,OU=Groups,DC=mydomain,DC=com'. You do not have the required permissions, skipping: Insufficient access rights to perform the operation"
  ],

[softwarefactory-project-zuul]

Build failed.
https://ansible.softwarefactory-project.io/zuul/buildset/b1bdcdca68434454a27202d81c1d656a

❌ ansible-galaxy-importer FAILURE in 5m 22s
✔️ build-ansible-collection SUCCESS in 5m 36s

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/f5b6d89ecec840a19a707beb8aa0bef3

✔️ ansible-galaxy-importer SUCCESS in 3m 31s
✔️ build-ansible-collection SUCCESS in 5m 57s

[jborean93]

Thanks for the fantastic PR. The only thing missing is the changelog fragment. Are you able to add one under changelogs/fragments https://docs.ansible.com/ansible/latest/community/development_process.html#creating-changelog-fragments. Thist particular change would be under the minor_changes key.

Something like

minor_changes:
  - >-
    microsoft.ad.user - Added ``groups.permissions_failure_action`` to control the behaviour when failing to modify the user's groups -
    https://github.com/ansible-collections/microsoft.ad/issues/140

Feel free to modify the message in any way you prefer.

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/f7e5338486bd44e4a3b55b34f2b206ce

✔️ ansible-galaxy-importer SUCCESS in 3m 41s
✔️ build-ansible-collection SUCCESS in 5m 15s

[tarmael]

Thanks for this, I've added the changelogs fragment

That official doc you linked doesn't feel very intuitive to read for newcomers, so I hope this is correct :)

[softwarefactory-project-zuul]

Build succeeded.
https://ansible.softwarefactory-project.io/zuul/buildset/ee6b7a4d8ea74ce6997a7c17aa76bcd3

✔️ ansible-galaxy-importer SUCCESS in 2m 53s
✔️ build-ansible-collection SUCCESS in 5m 14s

[jborean93]

Thanks for working on this!

[jborean93]

That official doc you linked doesn't feel very intuitive to read for newcomers, so I hope this is correct :

What you have looks good. I’ll try and pass along the feedback to the docs team.