[quanah]

Summary

Assisted-by: Claude Opus 5.5. Drafted with AI assistance; the commit carries the same trailer.

The users role sent change_me as the password of every entry in controller_user_accounts without one, and because ctrliq.ascender.user defaults update_secrets to true, it overwrote existing passwords on every run. This leaves controller_user_default_password unset by default (commented out in roles/users/defaults/main.yml), which matches default: None in the role's argument spec. With it unset, the task's existing default(omit, true) sends no password. Setting the variable explicitly still applies it.

This is the fix merged in redhat-cop/infra.aap_configuration#1457 (for redhat-cop/infra.aap_configuration#1456), which also comments the default out rather than setting it to ""; the same change is open against infra.controller_configuration as redhat-cop/infra.controller_configuration#176.

Breaking change: an entry that creates a new account without a password used to get change_me; now no password is sent, and the API decides. On current ctrliq/ascender main it rejects that with Password required for new User. (ctrliq/ascender#1089, PR ctrliq/ascender#1090, proposes allowing a local user without a password). To keep the old behavior, declare password on new accounts or set controller_user_default_password.

Changelog fragment: changelogs/fragments/users-default-password.yml (security_fixes, breaking_changes).

New test tests/unit/test_role_users.py runs the real role from the checkout with ansible-playbook --check against a stub ctrliq.ascender.user that reports whether a password reached it. It needs no controller and no database. Cases: an entry without a password sends none; a declared password is sent, alongside an entry without one; an explicit controller_user_default_password is still applied.

Closes #332

Type of Change

• Bug fix
• New feature or enhancement
• Breaking change
• Documentation / tooling

Component

users role (roles/users/defaults/main.yml)

Checklist

• Sanity tests pass (ansible-test sanity): all sanity tests on the touched files (python 3.13, ansible-core 2.21.5, without --docker); the full collection wasn't run
• Linting passes (ruff, yamllint, ansible-lint): ruff check plugins/ and on the new test, yamllint on the role and fragment, ansible-lint on the whole repo (production profile, 0 failures)
• Changelog fragment added (if user-facing change)
• Documentation updated (if applicable): the README and argument spec already describe the new default

Unit tests, run the way CI does (python 3.13, PostgreSQL 15, ascender main 90de5acf installed):

# with this change
tests/unit/test_role_users.py + test_user.py:  9 passed
tests/unit/ (all):  167 passed, 1 failed  (test_completeness, which fails the same way on main)

# main with only the new test
tests/unit/test_role_users.py + test_user.py:  2 failed, 7 passed
tests/unit/ (all):  3 failed, 165 passed

# ansible-core 2.16.19 (the collection's minimum), python 3.12, test_role_users.py only
with this change: 3 passed;  main: 2 failed, 1 passed

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.