ansibullbot
commented
2 months ago Files identified in the description:
If these files are incorrect, please update the component name section of the description or use the !component bot command.
Closed tsgsh closed 2 months ago
ansibullbot
commented
2 months ago Files identified in the description:
If these files are incorrect, please update the component name section of the description or use the !component bot command.
ansibullbot
commented
2 months ago cc @jtyr click here for bot help
felixfontein
commented
2 months ago Since handling vault encrypted passwords is done entirely by ansible-core and the module has no part in it at all, this looks like a problem with ansible-core or your playbook. The module arguments are serialized as JSON and send to the module, which includes the bind_pw argument as a string.
One interesting part is:
TASK [debug] *********************************************************************************************************
Monday 16 September 2024 15:23:31 +0100 (0:00:00.021) 0:00:02.046 ******
ok: [alice] =>
openldap_password: openldap_password
TASK [debug] *********************************************************************************************************
Monday 16 September 2024 15:23:31 +0100 (0:00:00.021) 0:00:02.068 ******
ok: [alice] =>
vault_password: |-
openldap_passwordThis indicates that the two strings are not identical. Check out the code of the community.general.yaml callback: https://github.com/ansible-collections/community.general/blob/main/plugins/callback/yaml.py#L54-L76
My guess is that there's some whitespace - maybe a trailing newline? Try to run it without using the community.general.yaml callback, that should make it easier to compare the actual strings.
If you look at the task that generates the vaulted password file:
- name: Create the vaulted variable
command:
cmd: >-
ansible-vault
encrypt_string
--stdin-name vault_password
--output test.pw.yml
--vault-pass-file vault.pw
stdin: "{{ openldap_password }}"A newline is always added to stdin, unless you explicitly tell the command module not to do that by adding stdin_add_newline: false (https://docs.ansible.com/ansible/latest/collections/ansible/builtin/command_module.html#parameter-stdin_add_newline).
Maybe try that?
tsgsh
commented
2 months ago Thanks for the quick response. I had compared the two strings in the "real" version of this problem, which is spread over two different roles and they were being reported as being equal. However, you are right, in the test case, they aren't equal and there is a trailing newline so I introduced that problem trying to isolate a different one.. Arguably a problem with the community.general.yaml callback and it should report it as:
ok: [alice] =>
vault_password: |
openldap_password
instead of
ok: [alice] =>
vault_password: |-
openldap_password
but obviously not a problem with ldap_entry.
Thanks for your help.
Summary
When a string variable created using
ansible-vaultis used as a bind password (bind_pw:) forldap_entryit fails with the error messageeven if the variable is correct. There appears to be a difference in how vaulted and non-vaulted string variables are presented that ldap_entry cannot parse correctly in the former case. There is a "clue" in that a debug of the vaulted variable is always presented as a literal block scalar rather than on the same line:
There doesn't appear to be a workaround through maniuplating the string (I've tried adding a null string, slicing it twice and combining the slides, reversing it twice, converting to a list and taking the zeroeth entry), setting another variable to match it (including setting a fact), or even editing the vault file to place the entry on a single line instead of the literal block scalar generated by
ansible-vault. None of these change the result of the above debug or stop the error fromldap-entry.Issue Type
Bug Report
Component Name
ldap_entry
Ansible Version
Community.general Version
Configuration
OS / Environment
Control host and target are both on AlmaLinux 9.4. OpenLDAP packages are:
Steps to Reproduce
Expected Results
I expected the task named "Attempt this with the insecure password" to complete without error because the values of
openldap_passwordandvault_passwordare different YAML representations of the same string and the task named "Attempt this with the insecure password" works correctly and the only difference between the two is which of those two ostensibly identical strings is used.Actual Results
Code of Conduct