diff --git a/changelogs/fragments/user-fix-zero-negative-expiration.yaml b/changelogs/fragments/user-fix-zero-negative-expiration.yaml new file mode 100644 index 00000000000..f122b66e2fd --- /dev/null +++ b/changelogs/fragments/user-fix-zero-negative-expiration.yaml @@ -0,0 +1,2 @@ +bugfixes: + - user - properly remove expiration when set to a negative value (https://github.com/ansible/ansible/issues/47114) diff --git a/lib/ansible/modules/system/user.py b/lib/ansible/modules/system/user.py index aa5743bdf2f..8ac33316af9 100644 --- a/lib/ansible/modules/system/user.py +++ b/lib/ansible/modules/system/user.py @@ -662,7 +662,7 @@ class User(object): current_expires = int(self.user_password()[1]) if self.expires < time.gmtime(0): - if current_expires > 0: + if current_expires >= 0: cmd.append('-e') cmd.append('') else: @@ -670,7 +670,7 @@ class User(object): current_expire_date = time.gmtime(current_expires * 86400) # Current expires is negative or we compare year, month, and day only - if current_expires <= 0 or current_expire_date[:3] != self.expires[:3]: + if current_expires < 0 or current_expire_date[:3] != self.expires[:3]: cmd.append('-e') cmd.append(time.strftime(self.DATE_FORMAT, self.expires)) @@ -1136,7 +1136,9 @@ class FreeBsdUser(User): current_expires = int(self.user_password()[1]) - if self.expires < time.gmtime(0): + # If expiration is negative or zero and the current expiration is greater than zero, disable expiration. + # In OpenBSD, setting expiration to zero disables expiration. It does not expire the account. + if self.expires <= time.gmtime(0): if current_expires > 0: cmd.append('-e') cmd.append('0')