Workflow template credentials prompt not saving

[naren-ambati]

ISSUE TYPE

• Bug Report

SUMMARY

Trying to Change Machine Credentials for my workflow job templates, and I can see changes are applied only for the last template and rest of them are not being saved.

ENVIRONMENT

• AWX version: 6.0.0
• AWX install method: docker on linux
• Operating System: Oracle Linux
• Web Browser:

EXPECTED RESULTS

• Workflow Job templates should take prompted credentials individually for each template not default credentials.
• All the Job templates should be saved with prompted credentials.

ACTUAL RESULTS

• One with creds is a successful job run, remaining templates test fails right away.

ADDITIONAL INFORMATION

Another Turnaround will be adding Credentials option right next to Inventory, this will be quickest. But AWX should replace the creds which regular template already has and use the credentials which we used in workflow.

[ryanpetrello]

@mabashian you have any ideas here, or have some time to take a look at this?

[mabashian]

@naren-ambati unfortunately I haven't been able to pin down the exact steps needed to reproduce this behavior. Could you provide me with a basic outline of steps to reproduce? What does the job template look like? Does it have a default credential? If so, what type of credential? How many workflow nodes are you updating with overriding credentials? Does this only happen when creating new workflow nodes or are you also seeing this when editing existing nodes?

[naren-ambati]

My workflow contains more than 5 job templates with both parallel and concurrent job runs. Most of the credentials we use are machine and we got more than 10.

Default Credentials are assigned to some templates, but for some minor applications we don't use any default and make it prompt so that we can select the credentials while deploying.

Easy way : Adding Credentials checkbox next to Inventory in workflow templates. And that credentials should overwrite the credentials which are assigned to regular Job templates.

Alternate: Right now in workflow visualizer we can edit each job templates. Suppose, when we click on one of the job template, we can see the prompt option in the right bottom, we can use that for credentials but we can only prompt for one job template, and other templates will use credentials which are assigned in regular job templates.
If the regular job templates doesn't have any default credentials, workflow will run that job template without any credentials and it fails.

Summary: Workflow should have have to control job templates with all the prompts, and overwrite the prompts that are assigned to regular job templates. Also, prompts should be save for all workflow job templates not just for one.

Hope this helps.

[mabashian]

@naren-ambati I want to make sure I'm understanding what you're asking for.

Easy way : Adding Credentials checkbox next to Inventory in workflow templates. And that credentials should overwrite the credentials which are assigned to regular Job templates.

This sounds like an enhancement to the workflow template form. You're asking for the option to provide a global credential at the workflow template level that would overwrite the credentials for each job template in the workflow? Something like this:

Alternate: Right now in workflow visualizer we can edit each job templates. Suppose, when we click on one of the job template, we can see the prompt option in the right bottom, we can use that for credentials but we can only prompt for one job template, and other templates will use credentials which are assigned in regular job templates.
If the regular job templates doesn't have any default credentials, workflow will run that job template without any credentials and it fails.

This is the part that I haven't been able to reproduce but sounds like a bug(?). If you select a job template as a workflow node and that job template prompts for credential on launch then you should be able to replace that credential for that particular node. This shouldn't just be limited to one node. I've tried this by creating a brand new workflow and creating two nodes. Each node points to a different Job Template that prompts for credential. I'm able to overwrite the credential for Job Template in the workflow visualizer. Launching the workflow and checking the jobs for each node shows that the overwritten credentials are used.

[naren-ambati]

@mabashian First part is exactly right. Second part, yes it is a bug.
small example: My workflow has 5 job templates, I started changing credentials in prompt for each job template. I started from top to bottom. After changing all the prompts and when I refresh into the visualizer, I can see the prompt changes only in the bottom last one and no changes applied for first 4. This confirms as a bug.

I would consider First part is better compared to Second, Overwrite credentials and deploy all the job templates. Also for credentials toggle please add prompt of execution check box. It will be so . helpful.

[naren-ambati]

@mabashian Any Update?

[Danee13]

I ran into a similar if not the same problem. Almost every job template we created prompts for credentials, and when I tried to organize a workflow, the process failed at the third or forth job. The error was: { "msg": "No authentication methods available" }

[mabashian]

@naren-ambati

small example: My workflow has 5 job templates, I started changing credentials in prompt for each job template. I started from top to bottom. After changing all the prompts and when I refresh into the visualizer, I can see the prompt changes only in the bottom last one and no changes applied for first 4. This confirms as a bug.

Are you sure that you're hitting the SELECT button after you select a credential for each node? If you don't hit SELECT after editing each node then your changes will not be applied.

I'm going to create a separate issue for your feature request as tracking feature requests and bugs in the same issue won't be productive.

[mabashian]

@naren-ambati actually I see that you commented on #1731. Let's track credential prompting in that issue.

[naren-ambati]

@mabashian Yes I'm hitting select for each node. But workflow is saving only for one node. As for me, I resolved this issue in my own way. But, people who are using different credentials for each node will be still facing this issue.

[elyezer]

I tried to reproduce the issue on awx: 7.0.0 but I was not able. Here is what I did:

1. Created 4 credentials
2. Created a job template with a default credential and marked prompt on launch
3. Created a workflow job template like the image below:

4. Left the default credential for the first node, then used a different credential on each of the other nodes.
5. Ran the workflow job and it succeeded and used the expected credential on each job.
6. Edited the workflow job template and shuffled the credentials on each node
7. Ran the workflow job and it succeeded and used the expected credential on each job.

PS: During the edit I forgot to click on select and it didn't pick up the new value, it did after a clicked on select.

@naren-ambati can you please confirm if the above steps cover the issue you were facing?

[naren-ambati]

@elyezer if we are using different credential for each workflow job and it succeeded, ----> yes this is what I used to look for.

Thanks you this will be unblocked for many.

[elyezer]

@naren-ambati yes, I've clicked on the details link of each node from left to right and from top to bottom (when it apply) and the following are screenshots of the details of each one:

If I shuffle the credentials as done in the verification steps then they are updated accordingly. With all that said I think we can close this issue and consider it verified.

In case anyone observes a different behavior, please open another issue with the detailed steps.