Snapshot Ansible Module for ACI Collection 2.3 and newer gets "bad signature" error with cert based authenication

[metalhead4711]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

• Cert based authentication is not working with collections newer that 2.3 for at least "aci_snapshot" (maybe also others), but we normally only use "aci_snapshot" and "aci_rest".
• We did a test with "aci_epg", that was also working.

Affected Module Name(s):

• at least "aci_snapshot" (maybe other are affected,

• APIC version and APIC Platform

• tested with different ACI Version in the 5.2.x range with on-prem APICs. It is also reproducable with the current DevNet Sandbox ACI Simulator. > working till collection version 2.2, not working beginning with version 2.3.

Collection versions

• cisco.aci 2.3.0 and newer, Output below with version 2.6.0

Output/ Error message

*<!--- TASK [aci_snapshot : Create a Snapshot] **** fatal: [localhost]: FAILED! => {"changed": true, "error": {"code": "403", "text": "bad signature"}, "job_details": {"attributes": {"childAction": "", "dn": "uni/backupst/jobs-[uni/fabric/configexp-config_backup]", "lastJobName": "2023-04-28T07-26-37", "lcOwn": "local", "modTs": "2023-04-28T07:26:37.714+00:00", "monPolDn": "", "name": "config_backup", "nameAlias": "", "pDn": "uni/fabric/configexp-config_backup", "status": ""}}, "msg": "APIC Error 403: bad signature"}

---> *

Expected Behavior

• Prior to v2.3 (for example with collection 2.2.0) cert based authentication is working with that module.

Actual Behavior

• actually with 2.3 or newer we are getting "bad signature"

Playbook tasks to Reproduce

*

• name: create login function for apic login set_fact: aci_login: &aci_login username: '{{ ACI_USER }}' private_key: '{{ APIC_PRIVATE_KEY }}' certificate_name: '{{ APIC_CERT_NAME }}' use_proxy: '{{ ACI_USE_PROXY }}' validate_certs: '{{ ACI_CERT_VALIDATION }}' use_ssl: "{{ APIC_USE_SSL }}"

• name: Create a Snapshot cisco.aci.aci_config_snapshot: <<: *aci_login hostname: "{{ item.value.APIC }}" state: present export_policy: config_backup max_count: 10 description: "Backup Rollout - {{ REASON }}" delegate_to: localhost

Important Factoids

References

• 0000

[shrsr]

@metalhead4711 I was able to reproduce the issue on versions: 2.4.0 and greater but not on 2.3.0 Can you please confirm that you're indeed facing this issue on v2.3.0?

[shrsr]

@metalhead4711 Can you please confirm that you're indeed facing this issue on v2.3.0?

[metalhead4711]

Hi, haven't seen the notification last week.

You are right, 2.3 works. It is not working beginning with version 2.4. Sorry for that.

[shrsr]

Thanks for confirming this.