When managing Linux user accounts with Ansible, a common requirement is to add users to supplementary groups while preserving their existing group memberships. The naive approach using the groups parameter would actually replace all current group assignments, which isn't what we want in most cases.

The Ansible user module has two key parameters for group management:

- group: Sets the primary group
- groups: Replaces ALL secondary groups

This becomes problematic when you only want to add a user to additional groups like sudo or docker without affecting their current group memberships.

Ansible provides the append parameter specifically for this use case:

- name: Add user to sudo group without removing existing groups
  ansible.builtin.user:
    name: developer
    groups: sudo
    append: yes

Here's a full playbook demonstrating multiple scenarios:

- hosts: all
  become: yes
  tasks:
    # Add user to multiple secondary groups
    - name: Add webadmin to sudo and www-data groups
      ansible.builtin.user:
        name: webadmin
        groups: sudo,www-data
        append: yes
    
    # Combine with primary group assignment
    - name: Create dbuser with primary group and secondary access
      ansible.builtin.user:
        name: dbuser
        group: postgres
        groups: backup,monitoring
        append: yes
        shell: /bin/bash

When working with group modifications:

• The changes take effect immediately without requiring a logout
• For existing users, always include append: yes unless you intend to replace all groups
• Group names are case-sensitive in most Linux distributions
• Changes may not reflect in current shell sessions until re-authentication

You can verify the group assignments with this task:

- name: Verify group membership
  ansible.builtin.shell: "id {{ username }}"
  register: user_info
  changed_when: false

- name: Display group information
  ansible.builtin.debug:
    var: user_info.stdout

When managing user permissions in Linux systems through Ansible, a common requirement is to add users to supplementary groups (like sudo, docker, or www-data) while preserving their existing group memberships. The naive approach using the user module's groups parameter would replace all current group assignments.

The user module provides two approaches for this:

# Method 1: Using append=yes
- name: Add user to sudo group (append mode)
  ansible.builtin.user:
    name: deploy_user
    groups: sudo
    append: yes

# Method 2: Explicit group list with append
- name: Add user to multiple supplemental groups
  ansible.builtin.user:
    name: dev_user
    groups: "{{ ['docker', 'www-data'] }}"
    append: yes

For more complex scenarios, consider these patterns:

# Dynamic group management with variables
- name: Configure user groups from variables
  ansible.builtin.user:
    name: "{{ username }}"
    groups: "{{ additional_groups }}"
    append: "{{ append_groups | default(true) }}"

# Conditional group assignment
- name: Add admin users to sudo group
  ansible.builtin.user:
    name: "{{ item }}"
    groups: sudo
    append: yes
  loop: "{{ admin_users }}"
  when: "'admin' in item.tags"

Always verify your changes:

- name: Verify group membership
  ansible.builtin.command: groups {{ username }}
  register: group_result
  changed_when: false

- name: Display current groups
  ansible.builtin.debug:
    var: group_result.stdout

• Missing append: yes when intending to preserve groups
• Not considering system-created groups (like username primary group)
• Case sensitivity in group names
• Group existence prerequisite (always ensure groups exist first)