win_user groups list should accept SIDs

[jantari]

SUMMARY

When running a win_user task and specifying groups, it is currently very cumbersome to deal with Windows' internationalized group names because groups does not accept SIDs (or well, treats them as group names and fails to match them)

ISSUE TYPE

• Feature Idea

COMPONENT NAME

ansible.windows.win_user

ADDITIONAL INFORMATION

• How the feature will be solved: I will submit a PR with a proposed solution for discussion
• Why it is needed: So the win_user module can reliably create users with group assignments on Windows systems
• What would it solve: It would solve the problem that currently any and all playbooks or roles utilizing win_user with groups are either only compatible with one OS language or use lengthy win_shell tasks with register each time to determine the proper localized group name from an SID first

What you have to do now:

- name: Get name of S-1-5-32-545 group
  win_shell: |
    $sid = New-Object -TypeName System.Security.Principal.SecurityIdentifier -ArgumentList 'S-1-5-32-545'
    $GroupSIDBinary = New-Object byte[] -ArgumentList $sid.BinaryLength
    $sid.GetBinaryForm($GroupSIDBinary, 0)

    $ADSI = [ADSI]"WinNT://$env:COMPUTERNAME"
    $ADSI.Children |
      Where SchemaClassName -eq 'Group' |
      Where { ($_.objectSid | Foreach-Object { [System.Linq.Enumerable]::SequenceEqual([byte[]]$GroupSIDBinary, [byte[]]$_) }) -contains $true } |
      Select -ExpandProperty Name
  register: usersgroup
  changed_when: false

- debug:
    var: usersgroup

- name: Create test user
  win_user:
    name: testy
    fullname: testy
    description: testy
    password_expired: no
    password_never_expires: yes
    user_cannot_change_password: yes
    state: present
    groups:
      - "{{ usersgroup.stdout }}"

What I would like to be able to do instead:

- name: Create test user
  win_user:
    name: testy
    fullname: testy
    description: testy
    password_expired: no
    password_never_expires: yes
    user_cannot_change_password: yes
    state: present
    groups:
      - S-1-5-32-545

PR with proposed fix: #154

[panki27]

Great workaround resolving the SID to a groupname - can't wait for this to be implemented. Thanks!