---
- name: Install sshpass
  package:
    name:
      - sshpass
    state: present

- name: Set password for test
  ansible.builtin.set_fact:
    test_pw: myTest!pw

- name: Create locked_user
  user:
    name: locked_user
    password: "{{ test_pw | password_hash('sha512') }}"

- name: Create ssh-client-keypair
  community.crypto.openssh_keypair:
    path: /root/.ssh/locked_user_id
    type: ed25519
    state: present
  register: generated_key

- name: Add ssh-public-key to locked_user
  ansible.posix.authorized_key:
    user: locked_user
    key: "{{ generated_key.public_key }}"
    state: present

- name: Check successful login with password
  ansible.builtin.shell:
    cmd: sshpass -p {{ test_pw }} ssh locked_user@localhost echo "success"

- name: Check successful login with ssh key
  ansible.builtin.shell:
    cmd: ssh -i /root/.ssh/locked_user_id locked_user@localhost echo "success"

- name: Set password change date for locked_user
  ansible.builtin.shell:
    cmd: chage -d 2020-01-01 locked_user

- name: Check unsuccessful login with password
  ansible.builtin.shell:
    cmd: sshpass -p {{ test_pw }} ssh locked_user@localhost echo "success"
  register: output
  ignore_errors: true

- name: Assert check unsuccessful login
  ansible.builtin.assert:
    that:
      - output.rc | int == 1
      - "'WARNING: Your password has expired.' in output.stderr"
      - "'success' not in output.stdout"

- name: Check successful login with ssh key
  ansible.builtin.shell:
    cmd: ssh -i /root/.ssh/locked_user_id locked_user@localhost echo "success"