Allow passing username/password from env variables

[fabricesemti80]

SUMMARY

In the microsoft.ad.ldap module, if I specify the credentials as:

...
username: "{{ lookup('env', 'ansible_user_windows_sig') }}"
password: "{{ lookup('env', 'ansible_password_windows_sig') }}"
...

I get an error:

❯ ansible-inventory  --inventory /home/fabrice/projects/SS.INFRA.Ansible/inventories/microsoft.ad.ldap.yml --list
[WARNING]:  * Failed to parse /home/fabrice/projects/SS.INFRA.Ansible/inventories/microsoft.ad.ldap.yml with
ansible_collections.microsoft.ad.plugins.inventory.ldap plugin: Received LDAPResult error bind failed -
INVALID_CREDENTIALS - 8009030C: LdapErr: DSID-0C0905E2, comment: AcceptSecurityContext error, data 52e, v3839
[WARNING]:  * Failed to parse /home/fabrice/projects/SS.INFRA.Ansible/inventories/microsoft.ad.ldap.yml with
ansible_collections.ansible.builtin.plugins.inventory.yaml plugin: Plugin configuration YAML file, not YAML inventory
[WARNING]:  * Failed to parse /home/fabrice/projects/SS.INFRA.Ansible/inventories/microsoft.ad.ldap.yml with
ansible_collections.ansible.builtin.plugins.inventory.ini plugin: Invalid host pattern 'plugin:' supplied, ending in ':'
is not allowed, this character is reserved to provide a port.
[WARNING]: Unable to parse /home/fabrice/projects/SS.INFRA.Ansible/inventories/microsoft.ad.ldap.yml as an inventory
source
[WARNING]: No inventory was parsed, only implicit localhost is available
{
    "_meta": {
        "hostvars": {}
    },
    "all": {
        "children": [
            "ungrouped"
        ]
    }
}

(this works ok in https://docs.ansible.com/ansible/devel/collections/microsoft/ad/object_info_module.html#ansible-collections-microsoft-ad-object-info-module-requirements, ie. )

...
        domain_username: "{{ lookup('env', 'ansible_user_windows_sig') }}"
        domain_password: "{{ lookup('env', 'ansible_password_windows_sig') }}"
...

ISSUE TYPE

• Feature Idea

While putting in the username: user@DOMAIN.COM and password: <password for the user> works, and I can obtain a kerberos ticket with kinit, ideally I would like to retrieve my credential from env vars....

COMPONENT NAME

microsoft.ad.ldap

ADDITIONAL INFORMATION

[jborean93]

The PR #37 exposes all the connection options for LDAP into their own environment variables. Unfortunately lookups are disabled as part of any inventory plugin by default which is why your example won't work.

[fabricesemti80]

thanks.
so adding

export MICROSOFT_AD_LDAP_username="user@DOMAIN.COM"
export MICROSOFT_AD_LDAP_password="password"

Should be the way? (if so, a bit limiting since I manage 3x domains, but I can work with it), or can only do kinit? (As in your demo )

[jborean93]

You'll have to use the upper case USERNAME and PASSWORD but yes.

(if so, a bit limiting since I manage 3x domains, but I can work with it

That is a good point, I'll have a closer look and see what can be done to enable lookups for the options. If it is I might just add a note saying this is possible but be careful of where the values are sourced from.

or can only do kinit

This should also be another option. At least with MIT krb5 you can use a directory ccache that contains multiple tickets for different principals. It should be possible to checkout all your krb5 tickets into the one ccache for your various principals and krb5 will select the correct ticket for the realm you are talking to. I have not tested this option but it should theoretically work.

[jborean93]

I've talked about this internally with some other Ansible devs and right now the only real option is to set the option in your inventory plugin config. You can vault the whole yml file and Ansible will be able to decrypt it if provided with the vault secret at runtime.

A more practical solution is to follow ansible/ansible#79244 which is designed to allow templating on config options. This should enable things like the env lookup plugin to be used in your plugin config allowing you to do custom logic for deriving these values. Unfortunately I don't want to add even more custom handling to the inventory plugin itself so I'm hoping that PR will be ready shortly (bcoca said he was going to look into it again soon).