From e437314a39f62282cde54b5a1a8de79bc59bc270 Mon Sep 17 00:00:00 2001
From: Julien D <150942337+jdaln@users.noreply.github.com>
Date: Tue, 28 Jul 2026 18:47:32 +0200
Subject: [PATCH] fix: password reset only for new users

---
 roles/users_add/handlers/main.yml | 10 ++++++++--
 roles/users_add/tasks/main.yml    |  1 +
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/roles/users_add/handlers/main.yml b/roles/users_add/handlers/main.yml
index 4270504..1c323f8 100644
--- a/roles/users_add/handlers/main.yml
+++ b/roles/users_add/handlers/main.yml
@@ -1,7 +1,13 @@
 # Suppress ansible-lint var-naming warning for third-party role variables
 # noqa: var-naming[no-role-prefix]
+# Only force a password change on accounts that were just created. update_password:
+# on_create means existing users' password hashes are never rewritten, so we must not
+# reset their password-aging either (that would prompt them to change their password at
+# next login). Filtering on .changed restricts chage -d 0 to newly-created accounts.
 - name: Force password change on first login
-  ansible.builtin.command: "chage -d 0 {{ item.username }}"
-  loop: "{{ users_add_userlist | default([]) }}"
+  ansible.builtin.command: "chage -d 0 {{ item.name }}"
+  loop: "{{ users_add_created.results | default([]) | selectattr('changed') | list }}"
+  loop_control:
+    label: "{{ item.name }}"
   register: chage_output  # This will register the output of the command to a variable
   changed_when: "'Password aging updated' in chage_output.stdout"
diff --git a/roles/users_add/tasks/main.yml b/roles/users_add/tasks/main.yml
index 9157f02..244677c 100644
--- a/roles/users_add/tasks/main.yml
+++ b/roles/users_add/tasks/main.yml
@@ -17,6 +17,7 @@
       # Initial password required for sudo - must be changed on first login
     update_password: on_create  # This ensures the password is only set when the user is created
   loop: "{{ users_add_userlist | default([]) }}"
+  register: users_add_created  # Per-user result; handler uses .changed to chage only new accounts
   notify:
     - Force password change on first login
   no_log: true  # Prevent password hashes from being logged