How to add ssh keys via Ansible when AuthorizedKeysFile is set?

How can I get Ansible to populate the correct file when my /etc/ssh/sshd_config has AuthorizedKeysFile set to /etc/ssh/authorized_keys/%u? Ansible seems to ignore the setting and places keys in $HOME/.ssh/authorized_keys

playbook:

---
- hosts: all
  vars:
  vars_files:
    - ../group_vars/ssh_root_authorized_keys.yml
  gather_facts: false

  tasks:
    - name: Set up multiple authorized keys
      authorized_key:
        user: root
        state: present
        key: '{{ item.key }}'
      with_items: "{{ root_auth_keys }}"

ssh_root_authorized_keys.yml

root_auth_keys:
  - name: backup@host
    key : "{{ lookup('file', '../group_vars/pubkeys/[email protected]') }}"

  - name: nagios@host
    key : "{{ lookup('file', '../group_vars/pubkeys/[email protected]') }}"

There are a couple of steps to prepare this functionality. First, get the value of the parameter. There might be more options, e.g. by default

shell> sudo sshd -T | grep authorizedkeysfile
authorizedkeysfile .ssh/authorized_keys .ssh/authorized_keys2

For example, get the first one

    - shell: sshd -T | grep authorizedkeysfile
      register: result
      become: true
    - set_fact:
        AuthorizedKeysFile: "{{ (result.stdout|split)[1] }}"

gives

  AuthorizedKeysFile: .ssh/authorized_keys

The parameter AuthorizedKeysFile may contain %u and %h. See Location of the Authorized Keys File

%h will be replaced by the home directory of the user being authenticated, and %u by the login name of the user

Prepare the database of the home directories

    - getent:
        database: passwd

By default, the module getent stores the database passwd in the dictionary getent_passwd. Home is the 4th attribute, e.g.

    - debug:
        var: getent_passwd['root'][4]

gives

  getent_passwd['root'][4]: /root

Now, given the data

    auth_keys:
      root: [key1, key2, key3]

you can test the functionality

    - shell: sshd -T | grep authorizedkeysfile
      register: result
      become: true
    - set_fact:
        AuthorizedKeysFile: "{{ (result.stdout|split)[1] }}"
    - getent:
        database: passwd
    - debug:
        msg: |
          path: {{ _path }}
          keys: {{ item.value }}
      loop: "{{ auth_keys|dict2items }}"
      vars:
        _user: "{{ item.key }}"
        _home: "{{ getent_passwd[item.key][4] }}"
        _akf: "{{ AuthorizedKeysFile|regex_replace('%u', _user)|
                                     regex_replace('%h', _home) }}"
        _path: "{{ (_akf.0 == '/')|ternary(_akf, [_home, _akf]|join('/')) }}"

gives

  msg: |-
    path: /root/.ssh/authorized_keys
    keys: ['key1', 'key2', 'key3']

If you change the parameter

shell> sudo sshd -T | grep authorizedkeysfile
authorizedkeysfile /etc/ssh/authorized_keys/%u

the play will get the correct location of the authorized keys file

  msg: |-
    path: /etc/ssh/authorized_keys/root
    keys: ['key1', 'key2', 'key3']