# vmware_local_role_manager – Manage local roles on an ESXi host

New in version 2.5.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- This module can be used to manage local roles on an ESXi host.

## Requirements

The below requirements are needed on the host that executes this module.

- python >= 2.6
- PyVmomi

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---

action
string
added in 2.8

Choices:
- add
- remove
- set ←

This parameter is only valid while updating an existing role with privileges.
`add` will add the privileges to the existing privilege list.
`remove` will remove the privileges from the existing privilege list.
`set` will replace the privileges of the existing privileges with user defined list of privileges.

force_remove
boolean

Choices:
- no ←
- yes

If set to `False` then prevents the role from being removed if any permissions are using it.

hostname string |  | The hostname or IP address of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_HOST` will be used instead. Environment variable support added in Ansible 2.6.
local_privilege_ids list | Default: [] | The list of privileges that role needs to have. Please see https://docs.vmware.com/en/VMware-vSphere/6.0/com.vmware.vsphere.security.doc/GUID-ED56F3C4-77D0-49E3-88B6-B99B8B437B62.html
local_role_name string / required |  | The local role name to be managed.
password string |  | The password of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_PASSWORD` will be used instead. Environment variable support added in Ansible 2.6. aliases: pass, pwd
port integer added in 2.5 | Default: 443 | The port number of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_PORT` will be used instead. Environment variable support added in Ansible 2.6.
proxy_host string added in 2.9 |  | Address of a proxy that will receive all HTTPS requests and relay them. The format is a hostname or a IP. If the value is not specified in the task, the value of environment variable `VMWARE_PROXY_HOST` will be used instead. This feature depends on a version of pyvmomi greater than v6.7.1.2018.12
proxy_port integer added in 2.9 |  | Port of the HTTP proxy that will receive all HTTPS requests and relay them. If the value is not specified in the task, the value of environment variable `VMWARE_PROXY_PORT` will be used instead.

state
string

Choices:
- present ←
- absent

Indicate desired state of the role.
If the role already exists when `state=present`, the role info is updated.

username string |  | The username of the vSphere vCenter or ESXi server. If the value is not specified in the task, the value of environment variable `VMWARE_USER` will be used instead. Environment variable support added in Ansible 2.6. aliases: admin, user

validate_certs
boolean

Choices:
- no
- yes ←

Allows connection when SSL certificates are not valid. Set to `false` when certificates are not trusted.
If the value is not specified in the task, the value of environment variable `VMWARE_VALIDATE_CERTS` will be used instead.
Environment variable support added in Ansible 2.6.
If set to `yes`, please make sure Python >= 2.7.9 is installed on the given machine.

## Notes

Note

- Tested on ESXi 6.5
- Be sure that the ESXi user used for login, has the appropriate rights to create / delete / edit roles

## Examples

    - name: Add local role to ESXi
      vmware_local_role_manager:
        hostname: '{{ esxi_hostname }}'
        username: '{{ esxi_username }}'
        password: '{{ esxi_password }}'
        local_role_name: vmware_qa
        state: present
      delegate_to: localhost

    - name: Add local role with privileges to ESXi
      vmware_local_role_manager:
        hostname: '{{ esxi_hostname }}'
        username: '{{ esxi_username }}'
        password: '{{ esxi_password }}'
        local_role_name: vmware_qa
        local_privilege_ids: [ 'Folder.Create', 'Folder.Delete']
        state: present
      delegate_to: localhost

    - name: Remove local role from ESXi
      vmware_local_role_manager:
        hostname: '{{ esxi_hostname }}'
        username: '{{ esxi_username }}'
        password: '{{ esxi_password }}'
        local_role_name: vmware_qa
        state: absent
      delegate_to: localhost

    - name: Add a privilege to an existing local role
      vmware_local_role_manager:
        hostname: '{{ esxi_hostname }}'
        username: '{{ esxi_username }}'
        password: '{{ esxi_password }}'
        local_role_name: vmware_qa
        local_privilege_ids: [ 'Folder.Create' ]
        action: add
      delegate_to: localhost

    - name: Remove a privilege to an existing local role
      vmware_local_role_manager:
        hostname: '{{ esxi_hostname }}'
        username: '{{ esxi_username }}'
        password: '{{ esxi_password }}'
        local_role_name: vmware_qa
        local_privilege_ids: [ 'Folder.Create' ]
        action: remove
      delegate_to: localhost

    - name: Set a privilege to an existing local role
      vmware_local_role_manager:
        hostname: '{{ esxi_hostname }}'
        username: '{{ esxi_username }}'
        password: '{{ esxi_password }}'
        local_role_name: vmware_qa
        local_privilege_ids: [ 'Folder.Create' ]
        action: set
      delegate_to: localhost

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
local_role_name string | always | Name of local role
new_privileges list | always | List of privileges
old_privileges list | on update | List of privileges of role before the update
privileges list | always | List of privileges
privileges_previous list | on update | List of privileges of role before the update
role_id integer | always | ESXi generated local role id
role_name string | always | Name of local role

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Abhijeet Kasurde (@Akasurde)
- Christian Kotte (@ckotte)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.