When automating user management with Ansible, you might encounter situations where the traditional approach of adding users to the 'sudo' group doesn't work as expected. This typically happens because:

• The sudo group might be named differently (wheel/admin/sudoers) depending on the Linux distribution
• The group might not exist in some minimal installations
• Ansible's user module has specific requirements for group handling

Here's a robust solution that works across different distributions:

- name: Ensure user has sudo privileges
  become: yes
  lineinfile:
    path: /etc/sudoers
    line: "{{ username }} ALL=(ALL) NOPASSWD:ALL"
    validate: 'visudo -cf %s'
    state: present
  tags: sudo

A more modular approach that's preferred in modern systems:

- name: Add sudo permissions via sudoers.d
  become: yes
  copy:
    dest: /etc/sudoers.d/{{ username }}
    content: "{{ username }} ALL=(ALL) NOPASSWD:ALL\n"
    mode: 0440
    validate: 'visudo -cf %s'

For systems where the sudo group exists but has a different name:

- name: Add user to sudo group (distribution-agnostic)
  become: yes
  user:
    name: "{{ username }}"
    groups: "{{ ansible_facts['distribution'] | lower | replace(' ', '_') }}_{{ 'admin' if ansible_facts['os_family'] == 'Debian' else 'wheel' }}"
    append: yes

Here's a full implementation with error handling:

- hosts: all
  become: yes
  vars:
    username: deploy_user
  tasks:
    - name: Check if sudo group exists
      command: grep -q '^sudo:' /etc/group
      register: sudo_group_exists
      ignore_errors: yes
      changed_when: false

    - name: Add user to sudo group if exists
      user:
        name: "{{ username }}"
        groups: sudo
        append: yes
      when: sudo_group_exists.rc == 0

    - name: Ensure sudo privileges via sudoers.d
      copy:
        dest: /etc/sudoers.d/{{ username }}
        content: "{{ username }} ALL=(ALL) NOPASSWD:ALL\n"
        mode: 0440
        validate: 'visudo -cf %s'

When granting sudo privileges:

• Always use NOPASSWD judiciously - only for specific service accounts
• Consider restricting commands with granular sudo rules
• Regularly audit your sudoers configuration

When automating user management with Ansible, a common pain point emerges: the playbook fails when attempting to add users to the sudo group. This typically occurs because different Linux distributions use varying group names for sudo privileges.

# This commonly fails due to group name variations
- name: Add user to sudo (may fail)
  ansible.builtin.user:
    name: deploy_user
    groups: sudo
    append: yes

Here's a robust approach that works across major Linux flavors:

- name: Ensure sudo privileges for user
  ansible.builtin.user:
    name: deploy_user
    groups: "{{ 'sudo' if ansible_distribution in ['Ubuntu', 'Debian'] else 'wheel' }}"
    append: yes

For maximum control, consider modifying the sudoers file directly:

- name: Add user to sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    line: "deploy_user ALL=(ALL) NOPASSWD:ALL"
    validate: "visudo -cf %s"
    state: present

Ansible 2.8+ provides a specialized module for this purpose:

- name: Configure sudo privileges securely
  ansible.builtin.sudoers:
    name: deploy_user
    command: ALL
    user: deploy_user
    runas: ALL
    nopasswd: true
    state: present

For environments requiring custom sudo configurations:

- name: Create custom sudoers.d file
  ansible.builtin.copy:
    dest: /etc/sudoers.d/99_deploy_user
    content: |
      # Managed by Ansible
      deploy_user ALL=(ALL:ALL) NOPASSWD: /usr/bin/apt, /usr/bin/systemctl
    owner: root
    group: root
    mode: "0440"
    validate: "visudo -cf %s"