community.windows.laps_password lookup – Retrieves the LAPS password for a server.
Note
This lookup plugin is part of the community.windows collection (version 2.3.0).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install community.windows
.
You need further requirements to be able to use this lookup plugin,
see Requirements for details.
To use it in a playbook, specify: community.windows.laps_password
.
Synopsis
This lookup returns the LAPS password set for a server from the Active Directory database.
See https://github.com/jborean93/ansible-lookup-laps_password for more information around installing pre-requisites and testing.
Requirements
The below requirements are needed on the local controller node that executes this lookup.
python-ldap
Terms
Parameter |
Comments |
---|---|
The host name to retrieve the LAPS password for. This is the |
Keyword parameters
This describes keyword parameters of the lookup. These are the values key1=value1
, key2=value2
and so on in the following
examples: lookup('community.windows.laps_password', key1=value1, key2=value2, ...)
and query('community.windows.laps_password', key1=value1, key2=value2, ...)
Parameter |
Comments |
---|---|
When set to It is highly recommended to not touch this to avoid any credentials being exposed over the network. Use Choices:
|
|
The type of authentication to use when connecting to the Active Directory server When using It is recommended ot use When using You cannot use Choices:
|
|
The path to a CA certificate PEM file to use for certificate validation. Certificate validation is used when This may fail on hosts with an older OpenLDAP install like MacOS, this will have to be updated before reinstalling python-ldap to get working again. |
|
The domain to search in to retrieve the LAPS password. This could either be a Windows domain name visible to the Ansible controller from DNS or a specific domain controller FQDN. Supports either just the domain/host name or an explicit LDAP URI with the domain/host already filled in. If the URI is set, port and scheme are ignored. |
|
The password for Required when |
|
The LDAP port to communicate over. If kdc is already an LDAP URI then this is ignored. |
|
The LDAP scheme to use. When using The Active Directory host must be configured for If kdc is already an LDAP URI then this is ignored. Choices:
|
|
Changes the search base used when searching for the host in Active Directory. Will default to search in the If multiple matches are found then a more explicit search_base is required so only 1 host is found. If searching a larger Active Directory database, it is recommended to narrow the search_base for performance reasons. |
|
When This requires the Active Directory to be set up with a certificate that supports StartTLS. This is ignored when Choices:
|
|
Required when using The username to authenticate with. Recommended to use the username in the UPN format, e.g. This is required when Call |
|
When using
Choices:
|
Notes
Note
When keyword and positional parameters are used together, positional parameters must be listed before keyword parameters:
lookup('community.windows.laps_password', term1, term2, key1=value1, key2=value2)
andquery('community.windows.laps_password', term1, term2, key1=value1, key2=value2)
If a host was found but had no LAPS password attribute
ms-Mcs-AdmPwd
, the lookup will fail.Due to the sensitive nature of the data travelling across the network, it is highly recommended to run with either
auth=gssapi
,scheme=ldaps
, orstart_tls=yes
.Failing to run with one of the above settings will result in the account credentials as well as the LAPS password to be sent in plaintext.
Some scenarios may not work when running on a host with an older OpenLDAP install like MacOS. It is recommended to install the latest OpenLDAP version and build python-ldap against this, see https://keathmilligan.net/python-ldap-and-macos for more information.
Examples
# This isn't mandatory but it is a way to call kinit from within Ansible before calling the lookup
- name: call kinit to retrieve Kerberos token
expect:
command: kinit [email protected]
responses:
(?i)password: SecretPass1
no_log: true
- name: Get the LAPS password using Kerberos auth, relies on kinit already being called
set_fact:
ansible_password: "{{ lookup('community.windows.laps_password', 'SERVER', domain='dc01.ansible.com') }}"
- name: Specific the domain host using an explicit LDAP URI
set_fact:
ansible_password: "{{ lookup('community.windows.laps_password', 'SERVER', domain='ldap://ansible.com:389') }}"
- name: Use Simple auth over LDAPS
set_fact:
ansible_password: "{{ lookup('community.windows.laps_password', 'server',
domain='dc01.ansible.com',
auth='simple',
scheme='ldaps',
username='[email protected]',
password='SuperSecret123') }}"
- name: Use Simple auth with LDAP and StartTLS
set_fact:
ansible_password: "{{ lookup('community.windows.laps_password', 'app01',
domain='dc01.ansible.com',
auth='simple',
start_tls=True,
username='[email protected]',
password='SuperSecret123') }}"
- name: Narrow down the search base to a an OU
set_fact:
ansible_password: "{{ lookup('community.windows.laps_password', 'sql10',
domain='dc01.ansible.com',
search_base='OU=Databases,DC=ansible,DC=com') }}"
- name: Set certificate file to use when validating the TLS certificate
set_fact:
ansible_password: "{{ lookup('community.windows.laps_password', 'windows-pc',
domain='dc01.ansible.com',
start_tls=True,
ca_cert='/usr/local/share/certs/ad.pem') }}"
Return Value
Key |
Description |
---|---|
The LAPS password(s) for the host(s) requested. Returned: success |