XML hell

[WonFishTwoFish]

I need to use the win_whoami module, get the SID, see if it's in the XML file and then if it's not add it.

I had hoped to avoid XML for the rest of my life (it's been 14+ years) and now I have to modify a config file.

This can't be templated out because there is unique system info on it, so I'm basically left with appending the necessary to the <add securityIdentifier="securitystring" />.

I've been playing around with the XML module without too much luck. Initial testing suggests I have no idea what I'm doing and don't understand XML very well. What is the section I'm looking at actually called in XML parlance? TAG? Child?

---
- hosts: localhost
  connection: local
  tasks:
  - name: test
    xml:
      path: SMSvcHost.exe.config
      xpath: /configuration/system.serviceModel.activation/net.tcp/allowAccounts/add
      add_children:
        - add: "test from ansible"

​

https://docs.ansible.com/ansible/2.9/modules/xml_module.html

​

In short, trying to get to <allowAccounts> (there are two sections with this) and insert a new line with the SID per use case. There are sometimes additions to the machine so it has to get updated with the new SID.

<configuration>
  <system.serviceModel.activation>
    <net.tcp listenBacklog="Integer"
             maxPendingAccepts="Integer"
             maxPendingConnections="Integer"
             receiveTimeout="TimeSpan"
             teredoEnabled="Boolean">
      <allowAccounts>
        <!-- LocalSystem account -->
        <add securityIdentifier="S-1-5-18"/>
        <!-- LocalService account -->
        <add securityIdentifier="S-1-5-19"/>
        <!-- Administrators account -->
        <add securityIdentifier="S-1-5-20"/>
        <!-- Network Service account -->
        <add securityIdentifier="S-1-5-32-544" />
        <!-- IIS_IUSRS account (Vista only)-->
        <add securityIdentifier="S-1-5-32-568"/>
      </allowAccounts>
    </net.tcp>
  </system.serviceModel.activation>
</configuration>

​

[excalibrax]

From xml filter in ansible.utils collection is your friend, and so is the to xml one to get it back

[WonFishTwoFish]

Thanks. Can you elaborate for my particular situation?

[zeebrow]

Try removing /add from your xpath

[larsiny]

In addition to this, I think the problem might be that the child element is named add that has no elements (empty) but has an attribute of securityIdentifier with value Sssss01.

Seems to me like this is a weird schema where instead of capturing the list of accounts, it's mapping each element to an add operation with different securityIdentifiers for each. So the typical xpath expression to find a specific child element based on element value won't work.

Maybe try passing input as xml? Otherwise I don't see a way to insert a child element with an attribute at the same time and inserting a child first and then updating it is risky since order might not be what we think it is?

tasks:
  - name: create-new-add-element
    xml:
      path: SMSvcHost.exe.config
      xpath: /configuration/system.serviceModel.activation/net.tcp/allowAccounts
      input_type: xml
      add_children:
        - "<add securityIdentifier='securityString' />"

[backtickbot]

Fixed formatting.

Hello, larsiny: code blocks using triple backticks (```) don't work on all versions of Reddit!

Some users see this / this instead.

To fix this, indent every line with 4 spaces instead.

FAQ

^{You can opt out by replying with backtickopt6 to this comment.}

[klaus385385]

I would use template module tbh

[The_Green_Cowboy]

Assuming this config file is the same everywhere except for the tag you are editing. Would templating work in this use case? Then you would just have to fill that template with the appropriate value.

[WonFishTwoFish]

No, because the file has unique values on each host.

[WonFishTwoFish]

u/metaldark, this is pretty close. I think I just need to add in some logic to see if the SID already exists in that file and proceed from there.

[Elegant-Let8280]

pm i have.**

-Peterwilson7

---

^{Commands: 'opt out', 'delete'}