json - Ansible: parsing/concatenating output of getent module

Question

I try to set up chroot for sftp users, so that they can see user/group names on ls -l as per this article. To this end I need to get output of getent command and place it into /chroots/{{ user.username }}/etc/passwd file.

I try to use Ansible to replace this command getent passwd sftpuser > /chroots/sftpuser/etc/passwd as follows:

- name: get {{ user.username }} user info
  getent:
    database: passwd
    key: "{{ user.username }}"

- debug:
    var: getent_passwd

- name: create /chroots/{{ user.username }}/etc/passwd file
  lineinfile:
    path: /chroots/{{ user.username }}/etc/passwd
    line: "{{ getent_passwd | from_json }}"
    state: present
    create: yes
    owner: root
    group: root
    mode: '0644'

The 'getent_passwd' looks as follows:

ok: [cf1] => {
    "getent_passwd": {
        "testuser1": [
            "x", 
            "1001", 
            "1002", 
            "", 
            "/home/testuser1", 
            "/usr/sbin/nologin"
        ]
    }
}

But I get this error: FAILED! => {"failed": true, "msg": "Unexpected templating type error occurred on ({{ getent_passwd | from_json }}): expected string or buffer"}

1. What is the proper way to get those values supplied by getent_passwd into one flat string joined by ":"?
2. Is it safe to use genent module with key: "root" this way instead of echo "root:x:0:0:not really root:::" >> /chroots/sftpuser/etc/passwd?
3. one can run getent passwd user1 user2 - is it possible to supply two keys to the ansible's getent module somehow?

Answer 1

What is the proper way to get those values supplied by getent_passwd into one flat string joined by ":"?

For example using a Jinja2 template with join filter:

- debug:
    msg: "{{ user.username }}:{{getent_passwd[user.username]|join(':')}}"

One can run getent passwd user1 user2 - is it possible to supply two keys to the ansible's getent module somehow?

No. Either a single one or all.

Use an outer loop to request values in the first case, or filter the resulting list in the second.