ansible - 如何从任务中搜索 json 输出

Question

我有一个使用 powershell 从 windows 2012 中提取用户和组的剧本，并将其转换为 json。

我得到以下输出

[
    {
        "Group": "Appsupp",
        "Members": [
            "WIN-U97DIQUENUM\\appsuport",
            "WIN-U97DIQUENUM\\userfirst"
        ]
    },
    {
        "Group": "DBAdministrators",
        "Members": {}
    },
    {
        "Group": "Techsupp",
        "Members": {}
    },
    {
        "Group": "Access Control Assistance Operators",
        "Members": {}
    },
    {
        "Group": "Administrators",
        "Members": "WIN-U97DIQUENUM\\Administrator"
    },
    {
        "Group": "Backup Operators",
        "Members": {}
    },
    {
        "Group": "Certificate Service DCOM Access",
        "Members": {}
    },
    {
        "Group": "Cryptographic Operators",
        "Members": {}
    },
    {
        "Group": "Distributed COM Users",
        "Members": {}
    },
    {
        "Group": "Event Log Readers",
        "Members": {}
    },
    {
        "Group": "Guests",
        "Members": "WIN-U97DIQUENUM\\Guest"
    },
    {
        "Group": "Hyper-V Administrators",
        "Members": {}
    },
    {
        "Group": "IIS_IUSRS",
        "Members": "NT AUTHORITY\\IUSR"
    },
    {
        "Group": "Network Configuration Operators",
        "Members": {}
    },
    {
        "Group": "Performance Log Users",
        "Members": {}
    },
    {
        "Group": "Performance Monitor Users",
        "Members": {}
    },
    {
        "Group": "Power Users",
        "Members": {}
    },
    {
        "Group": "Print Operators",
        "Members": {}
    },
    {
        "Group": "RDS Endpoint Servers",
        "Members": {}
    },
    {
        "Group": "RDS Management Servers",
        "Members": {}
    },
    {
        "Group": "RDS Remote Access Servers",
        "Members": {}
    },
    {
        "Group": "Remote Desktop Users",
        "Members": {}
    },
    {
        "Group": "Remote Management Users",
        "Members": {}
    },
    {
        "Group": "Replicator",
        "Members": {}
    },
    {
        "Group": "Users",
        "Members": [
            "NT AUTHORITY\\Authenticated Users",
            "NT AUTHORITY\\INTERACTIVE",
            "WIN-U97DIQUENUM\\userfirst",
            "WIN-U97DIQUENUM\\usersecond",
            "WIN-U97DIQUENUM\\appsupport",
            "WIN-U97DIQUENUM\\techsupport",
            "WIN-U97DIQUENUM\\sqlserveruser"
        ]
    }
]

我希望将用户与我从服务器中提取的数据进行比较。例如，我想知道 appsupport 用户是否存在以及它属于哪个组。

我试过下面的 json_query。仅供引用，getgroup.stdout 是从服务器拉取信息的任务的注册结果。

    - debug:
        msg: "{{ getgroup.stdout | from_json | json_query('guser') }}"
      vars:
        guser: "[?Members.contains(@, `appsupport`)].Group"

我得到的是一个空结果(虽然此方法适用于其他 json)。我做错了什么？

我假设问题出在我的对象中的 Members 键，因为它包含一个空字典、一个字符串或一个字符串列表，如下面所选示例中所述。

单个字符串:

{
    "Group": "IIS_IUSRS",
    "Members": "NT AUTHORITY\\IUSR"
},

列表:

{
    "Group": "Users",
    "Members": [
        "NT AUTHORITY\\Authenticated Users",
        "NT AUTHORITY\\INTERACTIVE",
        "WIN-U97DIQUENUM\\userfirst",
        "WIN-U97DIQUENUM\\usersecond",
        "WIN-U97DIQUENUM\\appsupport",
        "WIN-U97DIQUENUM\\techsupport",
        "WIN-U97DIQUENUM\\sqlserveruser"
    ]
}

空字典:

{
    "Group": "Replicator",
    "Members": {}
}

当我使用 json_query('[].Members[*]') 时，它只返回最新的成员，而不是所有的 Members。

在这种情况下，如何从我的 json 结果中选择在 Members 字段中具有特定用户的对象？

Answer 1

没有json_query。

为了测试，给定文件中的输出，读取它并将成员转换为列表，例如

    - set_fact:
        output: "{{ lookup('file', 'test.data')|from_yaml }}"
    - set_fact:
        mlist: "{{ mlist|d([]) +
                   [item|combine({'Members': _Members|from_yaml})] }}"
      loop: "{{ output }}"
      vars:
        _Members: |-
          {% if item.Members is mapping %}
          {{ item.Members.keys()|list }}
          {% elif item.Members is string %}
          [{{ item.Members }}]
          {% else %}
          {{ item.Members }}
          {% endif %}
    - debug:
        var: mlist

给予

  mlist:
  - Group: Appsupp
    Members:
    - WIN-U97DIQUENUM\appsuport
    - WIN-U97DIQUENUM\userfirst
  - Group: DBAdministrators
    Members: []
  - Group: Techsupp
    Members: []
  - Group: Access Control Assistance Operators
    Members: []
  - Group: Administrators
    Members:
    - WIN-U97DIQUENUM\Administrator
  - Group: Backup Operators
    Members: []
  - Group: Certificate Service DCOM Access
    Members: []
  - Group: Cryptographic Operators
    Members: []
  - Group: Distributed COM Users
    Members: []
  - Group: Event Log Readers
    Members: []
  - Group: Guests
    Members:
    - WIN-U97DIQUENUM\Guest
  - Group: Hyper-V Administrators
    Members: []
  - Group: IIS_IUSRS
    Members:
    - NT AUTHORITY\IUSR
  - Group: Network Configuration Operators
    Members: []
  - Group: Performance Log Users
    Members: []
  - Group: Performance Monitor Users
    Members: []
  - Group: Power Users
    Members: []
  - Group: Print Operators
    Members: []
  - Group: RDS Endpoint Servers
    Members: []
  - Group: RDS Management Servers
    Members: []
  - Group: RDS Remote Access Servers
    Members: []
  - Group: Remote Desktop Users
    Members: []
  - Group: Remote Management Users
    Members: []
  - Group: Replicator
    Members: []
  - Group: Users
    Members:
    - NT AUTHORITY\Authenticated Users
    - NT AUTHORITY\INTERACTIVE
    - WIN-U97DIQUENUM\userfirst
    - WIN-U97DIQUENUM\usersecond
    - WIN-U97DIQUENUM\appsupport
    - WIN-U97DIQUENUM\techsupport
    - WIN-U97DIQUENUM\sqlserveruser

现在，您可以搜索成员，例如

    - debug:
        msg: "{{ mlist|selectattr('Members', 'contains', my_user) }}"
      vars:
        my_user: 'WIN-U97DIQUENUM\Administrator'

给予

  msg:
  - Group: Administrators
    Members:
    - WIN-U97DIQUENUM\Administrator

---

接下来，创建一个包含所有成员及其所属组的字典

    - set_fact:
        members: "{{ members|d({})|combine({item: _groups}) }}"
      loop: "{{ mlist|map(attribute='Members')|flatten|unique }}"
      vars:
        _groups: "{{ mlist|selectattr('Members', 'contains', item)|
                          map(attribute='Group')|
                          list }}"
    - debug:
        var: members

给予

  members:
    NT AUTHORITY\Authenticated Users:
    - Users
    NT AUTHORITY\INTERACTIVE:
    - Users
    NT AUTHORITY\IUSR:
    - IIS_IUSRS
    WIN-U97DIQUENUM\Administrator:
    - Administrators
    WIN-U97DIQUENUM\Guest:
    - Guests
    WIN-U97DIQUENUM\appsuport:
    - Appsupp
    WIN-U97DIQUENUM\appsupport:
    - Users
    WIN-U97DIQUENUM\sqlserveruser:
    - Users
    WIN-U97DIQUENUM\techsupport:
    - Users
    WIN-U97DIQUENUM\userfirst:
    - Appsupp
    - Users
    WIN-U97DIQUENUM\usersecond:
    - Users

那么，搜索就很简单了，例如

    - debug:
        msg: "{{ my_user }} is member of the group(s): {{ members[my_user] }}"
      vars:
        my_user: 'WIN-U97DIQUENUM\Administrator'

给予

  msg: 'WIN-U97DIQUENUM\Administrator is member of the group(s): [''Administrators'']'

---

可以在成员中搜索，例如

    - debug:
        msg: "{{ my_user }} is member of the group(s): {{ _groups }}"
      vars:
        my_user: appsuport
        _keys: "{{ members.keys()|list|select('search', my_user)|list }}"
        _groups: "{{ _keys|map('extract', members)|flatten }}"

给予

  msg: 'appsuport is member of the group(s): [''Appsupp'']'