# Ansible - User Create Module - Not working with Vault

**URL:** <https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594>\
**Category:** Ansible Project\
**Created:** [February 9, 2021, 2:00pm UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594 "2021-02-09T14:00:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![penguinpages](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/penguinpages/32/8179_2.png) [@penguinpages](https://forum.ansible.com/u/penguinpages)\
**Post date:** [February 9, 2021, 2:00pm UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594/1 "2021-02-09T14:00:34Z")

</div>

Still learning Ansible… but I think this is a feature request / maybe a bug?

Hoping their is a work around.

Goal: Create a user on CentOS host with membership of wheel group, ssh key and use a provided password but NOT store password in plain text within ansible.

I am using vault where I encrypt a password and save it in my global variables file

Ex: /group\_vars/all.yml ansible-vault encrypt\_string ‘Password’ --name ‘vault\_cluster\_ssh\_password’

# Add above output to all.yml and also above it I add a line to create usable variable for username

vault\_cluster\_ssh: cluster # Account used for inter node cluster tasks  
vault\_cluster\_ssh\_password: !vault |  
$ANSIBLE\_VAULT;1.1;AES256  
6439393631386137383264343636323666363931316664323231343363326234633930616437303234613865366366363234

Now.. I want to use that in a playbook

- name: Add the user ‘cluster’ with a bash shell, appending the group 'wheel’and generate ssh key for hosts “{{ target\_hosts }}”  
user:  
name: ‘{{ vault\_cluster\_ssh }}’  
shell: /bin/bash  
groups: wheel  
state: present  
generate\_ssh\_key: yes  
ssh\_key\_bits: 2048  
ssh\_key\_file: .ssh/id\_rsa  
createhome: no  
password: “{{ vault\_cluster\_ssh\_password | string | password\_hash(‘sha512’) }}”

# password: ‘{{ Password | string | password\_hash(‘sha512’) }}’

The commented line works .. but the use of variable does not. All examples I have found still use clear txt passwords to create users which is not allowed and bad form.  
What I don’t get is why they are shoving the output directly into 'etc/shadow" if you call to create user… so you have to use password\_hash component. Why would the user add module not just call as input parameter your “password variable” and use OS “passwd” binary… why is it shoving things direct into files with manual hash? Their may be reason but this then creates above issue where I cannot call input as variable that leverages standard vault call.

Hoping their is a better way to do this / work around someone has.

---

<div class="post-metadata">

**Author:** ![penguinpages](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/penguinpages/32/8179_2.png) [@penguinpages](https://forum.ansible.com/u/penguinpages)\
**Post date:** [February 9, 2021, 10:43pm UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594/2 "2021-02-09T22:43:41Z")

</div>

Correction:

This was an error where I was trying too many things and did not re-test with all correct variables set.

This does work:  
Co-worker pointed out to dump password out as variable and I saw it was read that in wrong as I changed several times to test things

---

<div class="post-metadata">

**Author:** ![Antony\_Stone](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@Antony\_Stone](https://forum.ansible.com/u/Antony_Stone)\
**Post date:** [February 9, 2021, 10:48pm UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594/3 "2021-02-09T22:48:30Z")

</div>

For the benefit of future visitors to this forum / archive, please could you  
make clear what you did need to do differently so that things worked as  
expected / required.

That way, at least some people will not have to ask the same question again 🙂

Thanks,

Antony.

---

<div class="post-metadata">

**Author:** ![penguinpages](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/penguinpages/32/8179_2.png) [@penguinpages](https://forum.ansible.com/u/penguinpages)\
**Post date:** [February 10, 2021, 4:17am UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594/4 "2021-02-10T04:17:54Z")

</div>

Sorry for not being clear..

What I did .. was .. nothing. No code change from the code posted.

I use Visual Studio Code … and did not between changes save file before running test… which then got back false “failure”… and do kept trying other things.

The below code works  
from global variables file /group\_var/all.yml

vault\_nut\_ssh: nut # Account used for UPS services client and server side  
vault\_nut\_ssh\_password: !vault |  
$ANSIBLE\_VAULT;1.1;AES256  
643963626666\<snip3330613639316532350a373634653566326338636565346539663366646338303861623030326263  
3532

User create.. in this case “nut” for ups monitoring.

# Setup “nut” user as both client and server need it

- name: Add the user ‘nut’ with a bash shell, appending the group 'wheel’and generate ssh key for hosts “{{ target\_hosts }}”  
user:  
name: ‘{{ vault\_nut\_ssh }}’  
shell: /bin/bash  
groups: wheel  
state: present  
generate\_ssh\_key: yes  
ssh\_key\_bits: 2048  
ssh\_key\_file: .ssh/id\_rsa  
createhome: yes  
password: “{{ vault\_nut\_ssh\_password | string | password\_hash(‘sha512’) }}”

---

<div class="post-metadata">

**Author:** ![penguinpages](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/penguinpages/32/8179_2.png) [@penguinpages](https://forum.ansible.com/u/penguinpages)\
**Post date:** [February 10, 2021, 1:07pm UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594/5 "2021-02-10T13:07:52Z")

</div>

PS: The web page for Ansible password is still broken

[https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module](https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module)

 ![image.png](https://us1.discourse-cdn.com/ansible/original/2X/0/0ae1b786fe995f0e6e746c2f6da92db07081d94b.png)

---

<div class="post-metadata">

**Author:** ![Bruce\_M](https://avatars.discourse-cdn.com/v4/letter/b/8e8cbc/32.png) [@Bruce\_M](https://forum.ansible.com/u/Bruce_M)\
**Post date:** [March 2, 2021, 11:16pm UTC](https://forum.ansible.com/t/ansible-user-create-module-not-working-with-vault/34594/6 "2021-03-02T23:16:24Z")

</div>

That page may have been deprecated cause I believe the same instruction is found in the faqs now.:

**[https://docs.ansible.com/ansible/latest/reference\_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module)**