# ansible\_ssh\_user and delegate\_to unexpected behavior

**URL:** <https://forum.ansible.com/t/ansible-ssh-user-and-delegate-to-unexpected-behavior/14445>\
**Category:** Ansible Project\
**Created:** [January 28, 2014, 5:27pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-delegate-to-unexpected-behavior/14445 "2014-01-28T17:27:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Niku\_Toivola](https://avatars.discourse-cdn.com/v4/letter/n/7ab992/32.png) [@Niku\_Toivola](https://forum.ansible.com/u/Niku_Toivola)\
**Post date:** [January 28, 2014, 5:27pm UTC](https://forum.ansible.com/t/ansible-ssh-user-and-delegate-to-unexpected-behavior/14445/1 "2014-01-28T17:27:08Z")

</div>

Hello,

I noticed that an ansible\_ssh\_user defined in the inventory for a host or group is used **also when delegating to a host that does not have it set**. This seems counterintuitive to me and makes it difficult to delegate tasks to a host that requires a different user. I wonder if this is by design?

I would expect Ansible to not use the ansible\_ssh\_user of host A when connecting to host B via delegate\_to at all, or at least that it would be possible to override it by setting a different remote\_user in the play.

Please see the example below:

hosts:

> testhost ansible\_ssh\_user=ec2-user  
> otherhost

sshtest.yml:

> * * *
> 
> - hosts: testhost  
> gather\_facts: no  
> tasks:
> - command: whoami

> - hosts: testhost  
> remote\_user: otheruser  
> gather\_facts: no  
> tasks:
> - command: whoami  
> delegate\_to: otherhost

‘ansible-playbook -i hosts -vvvv sshtest.yml’ output:

> PLAY [testhost] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> TASK: [command whoami] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ESTABLISH CONNECTION FOR USER: ec2-user on PORT 22 TO testhost  
> REMOTE\_MODULE command whoami  
> EXEC /bin/sh -c ‘mkdir -p $HOME/.ansible/tmp/ansible-tmp-1390928371.32-215246186572191 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1390928371.32-215246186572191 && echo $HOME/.ansible/tmp/ansible-tmp-1390928371.32-215246186572191’  
> PUT /tmp/tmpx2j5XZ TO /home/ec2-user/.ansible/tmp/ansible-tmp-1390928371.32-215246186572191/command  
> EXEC /bin/sh -c ‘/usr/bin/python /home/ec2-user/.ansible/tmp/ansible-tmp-1390928371.32-215246186572191/command; rm -rf /home/ec2-user/.ansible/tmp/ansible-tmp-1390928371.32-215246186572191/ \>/dev/null 2\>&1’  
> changed: [testhost] =\> {“changed”: true, “cmd”: [“whoami”], “delta”: “0:00:00.006628”, “end”: “2014-01-28 16:59:33.480779”, “rc”: 0, “start”: “2014-01-28 16:59:33.474151”, “stderr”: “”, “stdout”: “ec2-user”}
> 
> PLAY [testhost] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> TASK: [command whoami] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> ESTABLISH CONNECTION FOR USER: ec2-user on PORT 22 TO otherhost  
> fatal: [testhost] =\> {‘msg’: ‘FAILED: Authentication failed.’, ‘failed’: True}
> 
> FATAL: all hosts have already failed – aborting
> 
> PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
> to retry, use: --limit @/home/ansible/sshtest.retry
> 
> testhost : ok=1 changed=1 unreachable=1 failed=0

The delegation to otherhost fails because Ansible tries to use the ansible\_ssh\_user of testhost also on otherhost where that user does not exist. This happens whether or not I have “remote\_user: otheruser” in the second play. Explicitly setting “ansible\_ssh\_user=otheruser” for otherhost in the inventory does work so it’s more of an annoyance than a major issue but it seems a bit counterintuitive to me. Any thoughts?

This is on latest devel, by the way.

//Niku