# AnsibleUnsafeText as ansible\_become\_pass variable

**URL:** <https://forum.ansible.com/t/ansibleunsafetext-as-ansible-become-pass-variable/8687>\
**Category:** Get Help\
**Created:** [September 22, 2024, 1:37pm UTC](https://forum.ansible.com/t/ansibleunsafetext-as-ansible-become-pass-variable/8687 "2024-09-22T13:37:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![HexaOrko](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@HexaOrko](https://forum.ansible.com/u/HexaOrko)\
**Post date:** [September 22, 2024, 1:37pm UTC](https://forum.ansible.com/t/ansibleunsafetext-as-ansible-become-pass-variable/8687/1 "2024-09-22T13:37:51Z")

</div>

Hi,  
i’m unable the solve this and maybe there is no solution.  
But i will try to teardown my problem.

Inside my hosts.yaml inventory file i supply the ansible\_become\_pass value for currently with this:

```auto
all:
  vars:
    ansible_become_pass: '{{ system[inventory_hostname|lower].password }}'

```

This information came from my vault file `-e @vault/become_vault.yml`  
which has this construction:

```auto
system:
  my_host:
    password: mysecret

```

this works pretty fine for a while now.

But now i want to change this and use a [lookup solution](https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html) for pass, i already use this inside my playbooks.

But it does not work, my query inside my hosts.yaml looks like

```auto
ansible_become_pass: "{{ lookup('community.general.passwordstore', 'clients/'+ inventory_hostname|lower + '/ansible_user')}}"

```

But it does not work as aspected, `sudo` and `doas` deny the password.

The only difference i found was that the password from the vault file is type `AnsibleUnicode`and this from the lookup is type `AnsibleUnsafeText`

i guess the problem is how AnsibleUnsafeText is handle as ansible\_become\_pass

this unsafe tag is according to [this](https://github.com/mitogen-hq/mitogen/wiki/AnsibleUnsafe-notes) a direct consequence from use of a lookup.

i try’d get get rid of this tag, so i can use it as input for ansible\_become\_pass, but without success.

so hopefully some here as a idea for a solution.

best hexa

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [September 22, 2024, 2:14pm UTC](https://forum.ansible.com/t/ansibleunsafetext-as-ansible-become-pass-variable/8687/2 "2024-09-22T14:14:06Z")

</div>

Whether the password is marked unsafe or not should not make a difference. So the problem isn’t unsafe, but which part of ansible-core or a become plugin / something else inbetween screws this up. Could you provide information on how you use it so it results in a failure?

---

<div class="post-metadata">

**Author:** ![HexaOrko](https://avatars.discourse-cdn.com/v4/letter/h/e5b9ba/32.png) [@HexaOrko](https://forum.ansible.com/u/HexaOrko)\
**Post date:** [September 23, 2024, 8:51pm UTC](https://forum.ansible.com/t/ansibleunsafetext-as-ansible-become-pass-variable/8687/3 "2024-09-23T20:51:57Z")

</div>

Thank you for pushing me to try create a isolated example of this issue.  
I’m unable to recreate this problem, with other words … now it works without any problem.

I’m not sure whats happend, maybe just late night related issues.  
Thanks and sorry for the noize.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 23, 2024, 8:52pm UTC](https://forum.ansible.com/t/ansibleunsafetext-as-ansible-become-pass-variable/8687/4 "2024-10-23T20:52:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.