title: Setting password idempotently for linux user in ansible
body: <p>While attempting to manage users password using module <code>user</code> I'm getting password changed notice every single time when playbook is being executed and this behaviour does not depend on ansible version (tested on all major 2.0 - 2.5), target distribution (tested on stable CentOS, Debian and Ubuntu) or <code>update_password</code> option.</p>
  
  <pre><code>- name: This is in vault in real playbook of course
    set_fact:
      testuser_password : '123456'
  
  - name: Manage test user
    user:
      name: testuser
      uid: 1001
      state: present
      password: "{{ testuser_password |password_hash('sha512')}}"
  </code></pre>
  
  <p>Task named "Manage test user" is always marked changed. To avoid that I'm using this weird construction</p>
  
  <pre><code>- name: This is in vault in real playbook of course
    set_fact:
      testuser_password : '123456'
  
  - name: Check if user exists
    shell: "getent shadow testuser | awk -F: '{ print $2}'"
    changed_when: false
    check_mode: false
    register: userexists
  
  - name: Get salt for existing password
    shell: "getent shadow testuser | awk -F$ '{ print $3}'"
    changed_when: false
    check_mode: false
    register: passwordsalt
    when: userexists.stdout != ""
  
  - name: Encrypt local password with salt
    set_fact:
      localsaltedpass: "{{ testuser_password |password_hash('sha512', passwordsalt.stdout )}}"
    when: userexists.stdout != ""
  
  - name: Update remote password
    user:
      name: "testuser"
      uid: 1001
      password: "{{ testuser_password |password_hash('sha512')}}"
    when: 
      - userexists.stdout != ""
      - userexists.stdout != localsaltedpass
  
  - name: Create test user if it does not exist
    user:
      name: "testuser"
      uid: 1001
      state: present
      password: "{{ testuser_password |password_hash('sha512')}}"
    when: userexists.stdout == ""
  </code></pre>
  
  <p>While this approach solves the problem it does not look pretty well for me. Are there any ideas how to manage users passwords idempotently in a right way?</p>