---
  - name: set vars
    ansible.builtin.set_fact:
      firstname: "{{ item.firstname }}"
      lastname: "{{ item.lastname }}"
      email: "{{ item.email }}"
      group: "{{ item.group | default ('') }}"
      dn: "uid={{ item[ nlu_dn_attribute ] |lower }},ou={{ org }},{{ ldap_base }}"
      password: "{{ (item.password=='')| ternary(lookup('community.general.random_string', min_lower=1, min_upper=1, special=false,min_numeric=1, length=14), item.password ) }}"

  - name: "add ldap account {{dn }}"
    community.general.ldap_entry:
      bind_dn: "{{ ldap_binddn }}"
      bind_pw: "{{ ldap_bindpwd }}"
      dn: "{{ dn }} "
      state: present
      objectClass:
         - inetorgperson
         - inetLocalMailRecipient
      attributes:
        givenName: "{{ firstname }}"
        sn: "{{ lastname | default( firstname ) }}"
        cn: "{{ firstname }}"
        mail: "{{ email }}"
        PreferredDeliveryMethod: any
        displayName: "{{ firstname }} {{ lastname }}"
        userPassword: "{{ password }}"
    register: result

  - name: debug
    ansible.builtin.debug:
      msg: "group is =={{ group }}=="

  - name: "add account to group"
    when: group != ""
    community.general.ldap_attrs:
      dn: "cn={{ group }},ou={{ org }},{{ ldap_base }}"
      bind_dn: "{{ ldap_binddn }}"
      bind_pw: "{{ ldap_bindpwd }}"
      attributes:
        member: "{{ dn }}"

  - name: "account recap"
    ansible.builtin.lineinfile:
      path: "tmppassword.csv"
      state: present
      create: true
      line: "{{ firstname | lower }},{{ password }}"
    delegate_to: localhost
    become: false
    when: result.changed