The is_system_auditor boolean in controller_users role does not set is_platform_auditor attribute of user

[mikekuhlmann]

Summary

When trying to use the controller_users role to set the is_system_auditor boolean to true does not cause an error but does not set the is_platform_auditor attribute of the user.

Issue Type

• Bug Report

Ansible, Collection, Controller details

from yaml file:
  - username: ansible_auditor
    is_superuser: false
    is_system_auditor: true
    password: "xxx"

from api output of users:
            "username": "ansible_auditor",
            "email": "",
            "first_name": "",
            "last_name": "",
            "last_login": null,
            "password": "$encrypted$",
            "is_superuser": false,
            "is_platform_auditor": false,


console (paste below)
ansible --version
[core 2.18.7]

ansible-galaxy collection list
infra.aap_configuration 3.7.0

Controller version
4.6.16

• ansible installation method: one of source, pip, OS package, EE

OS / ENVIRONMENT

Desired Behavior

Actual Behavior

Please give some details of what is actually happening.
Include a [minimum complete verifiable example] with:

• playbook / task
• configuration file / list
• error

STEPS TO REPRODUCE

[djdanielsson]

can you give the var that you with

  - username: ansible_auditor
    is_superuser: false
    is_system_auditor: true
    password: "xxx"

[mikekuhlmann]

Sorry about that.

aap_user_accounts:

• username: ansible_auditor
  is_superuser: true
  is_system_auditor: false
  password: "xxx"

[djdanielsson]

what version of ansible.platform collection are you using?

[mikekuhlmann]

I am using ansible.platform:2.5.20250326 and ansible.controller:4.6.11 for the additional collections.

[djdanielsson]

I would update to the latest versions that are offered in console.redhat.com

[mikekuhlmann]

I have updated to the current ansible.platform (ansible.platform:2.6.20250924) and ansible.controller (ansible.controller:4.7.1) collections and using v3.7.0 of infra.aap_configuration collection. The is_platform_auditor is still being left set to false. There seems to be a disconnect between the role using is_system_auditor and the api using is_platform_auditor, maybe?

aap_user_accounts:

• username: ansible_auditor
  is_superuser: false
  is_system_auditor: true
  password: "xxx"

output from role for user ansible_auditor:
TASK [infra.aap_configuration.gateway_users : Users | Configuration]
...
ok: [localhost] => (item=Create/Update the Gateway user ansible_auditor) => {
"__gateway_user_accounts_item": {
"is_superuser": false,
"is_system_auditor": true,
"password": "***",
"username": "ansible_auditor"
},
"ansible_job_id": "j826240534605.5061",
"ansible_loop_var": "__gateway_user_accounts_item",
"changed": false,
"finished": 0,
"results_file": "/home/runner/.ansible_async/j826240534605.5061",
"started": 1
}

From api output from api/gateway/v1/users/ for the ansible_auditor user:
"username": "ansible_auditor",
"email": "",
"first_name": "",
"last_name": "",
"last_login": null,
"password": "$encrypted$",
"is_superuser": false,
"is_platform_auditor": false,

[djdanielsson]

ok I will see when I can find time to test this. one thing to note just FYI you might want to change your requirements file. something like this for AAP 2.5 because you technically pulled the collections for 2.6

  - name: infra.aap_configuration
  - name: ansible.controller
    version: '>=4.6.0,<4.7.0'
  - name: ansible.platform
    version: '>=2.5.0,<2.6.0'
  - name: ansible.eda
  - name: ansible.hub