# Credential CyberArk AIM with certs Timeout, Non-Cert works

**URL:** <https://forum.ansible.com/t/credential-cyberark-aim-with-certs-timeout-non-cert-works/32946>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [May 15, 2020, 8:41pm UTC](https://forum.ansible.com/t/credential-cyberark-aim-with-certs-timeout-non-cert-works/32946 "2020-05-15T20:41:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matthew\_Perry](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matthew_perry/32/3629_2.png) [@Matthew\_Perry](https://forum.ansible.com/u/Matthew_Perry)\
**Post date:** [May 15, 2020, 8:41pm UTC](https://forum.ansible.com/t/credential-cyberark-aim-with-certs-timeout-non-cert-works/32946/1 "2020-05-15T20:41:29Z")

</div>

Hi,  
I have an issue with Cybetark AIM credentials in AWX, We are able to use  
CuberArk AIM credentials to pull passwords and it works fine, however when  
we try to add an SSL Key and Cert to the call the process hangs and times  
out.  
ENVIRONMENT

&nbsp;&nbsp;&nbsp;- AWX version: 9.2  
&nbsp;&nbsp;&nbsp;- AWX install method: docker on linux  
&nbsp;&nbsp;&nbsp;- Ansible version: 2.9.3  
&nbsp;&nbsp;&nbsp;- Operating System: Red-Hat 7.7  
&nbsp;&nbsp;&nbsp;- Web Browser: Chrome

STEPS TO REPRODUCE

We have setup safe and App Id in CyberArk to test pulling passwords from a  
CyberArk safe., The process is working fine with the Test  
URL(https://[awxhost]/api/v2/credentials/XX/test/) weare able to pull a  
test password. However, when l we configure to use a client key and  
certificate to validate the client connection the process "hangs" and nginx  
reports a timeout. Does anyone know where/which docker container we can  
look at to find any debuging info for why the call with certs is timing out?  
I'm not sure where I can pull any logs related to the API URL Test  
URL(https://[awxhost]/api/v2/credentials/XX/test/). I've tried docker logs  
on each container and I cant see anything related to the call.  
I've located the module that handles AIM Creds in AWX :  
&nbsp;&nbsp;  
/var/lib/awx/venv/awx/lib/python3.6/site-packages/awx/main/credential\_plugins/aim.py

from .plugin import CredentialPlugin

from urllib.parse import quote, urlencode, urljoin

from django.utils.translation import ugettext\_lazy as \_

import requests

# AWX

from awx.main.utils import (

&nbsp;&nbsp;&nbsp;&nbsp;create\_temporary\_fifo,

)

aim\_inputs = {

&nbsp;&nbsp;&nbsp;&nbsp;'fields': [{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'url',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('CyberArk AIM URL'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'format': 'url',

&nbsp;&nbsp;&nbsp;&nbsp;}, {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'app\_id',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Application ID'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'secret': True,

&nbsp;&nbsp;&nbsp;&nbsp;}, {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'client\_key',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Client Key'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'secret': True,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'multiline': True,

&nbsp;&nbsp;&nbsp;&nbsp;}, {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'client\_cert',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Client Certificate'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'secret': True,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'multiline': True,

&nbsp;&nbsp;&nbsp;&nbsp;}, {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'verify',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Verify SSL Certificates'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'boolean',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'default': True,

&nbsp;&nbsp;&nbsp;&nbsp;}],

&nbsp;&nbsp;&nbsp;&nbsp;'metadata': [{

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'object\_query',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Object Query'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'help\_text': \_('Lookup query for the object. Ex:  
"Safe=TestSafe;Object=testAccountName123"'),

&nbsp;&nbsp;&nbsp;&nbsp;}, {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'object\_query\_format',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Object Query Format'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'default': 'Exact',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'choices': ['Exact', 'Regexp']

&nbsp;&nbsp;&nbsp;&nbsp;}, {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': 'reason',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'label': \_('Reason'),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'type': 'string',

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'help\_text': \_('Object request reason. This is only needed if it is  
required by the object\'s policy.')

&nbsp;&nbsp;&nbsp;&nbsp;}],

&nbsp;&nbsp;&nbsp;&nbsp;'required': ['url', 'app\_id', 'object\_query'],

}

def aim\_backend(\*\*kwargs):

&nbsp;&nbsp;&nbsp;&nbsp;url = kwargs['url']

&nbsp;&nbsp;&nbsp;&nbsp;client\_cert = kwargs.get('client\_cert', None)

&nbsp;&nbsp;&nbsp;&nbsp;client\_key = kwargs.get('client\_key', None)

&nbsp;&nbsp;&nbsp;&nbsp;verify = kwargs['verify']

&nbsp;&nbsp;&nbsp;&nbsp;app\_id = kwargs['app\_id']

&nbsp;&nbsp;&nbsp;&nbsp;object\_query = kwargs['object\_query']

&nbsp;&nbsp;&nbsp;&nbsp;object\_query\_format = kwargs['object\_query\_format']

&nbsp;&nbsp;&nbsp;&nbsp;reason = kwargs.get('reason', None)

&nbsp;&nbsp;&nbsp;&nbsp;query\_params = {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'AppId': app\_id,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Query': object\_query,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'QueryFormat': object\_query\_format,

&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;if reason:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;query\_params['reason'] = reason

&nbsp;&nbsp;&nbsp;&nbsp;request\_qs = '?' + urlencode(query\_params, quote\_via=quote)

&nbsp;&nbsp;&nbsp;&nbsp;request\_url = urljoin(url, '/'.join(['AIMWebService', 'api',  
'Accounts']))

&nbsp;&nbsp;&nbsp;&nbsp;cert = None

&nbsp;&nbsp;&nbsp;&nbsp;if client\_cert and client\_key:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cert = (

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;create\_temporary\_fifo(client\_cert.encode()),

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;create\_temporary\_fifo(client\_key.encode())

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;)

&nbsp;&nbsp;&nbsp;&nbsp;elif client\_cert:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cert = create\_temporary\_fifo(client\_cert.encode())

&nbsp;&nbsp;&nbsp;&nbsp;res = requests.get(

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;request\_url + request\_qs,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;timeout=30,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cert=cert,

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;verify=verify,

&nbsp;&nbsp;&nbsp;&nbsp;)

&nbsp;&nbsp;&nbsp;&nbsp;res.raise\_for\_status()

&nbsp;&nbsp;&nbsp;&nbsp;return res.json()['Content']

aim\_plugin = CredentialPlugin(

&nbsp;&nbsp;&nbsp;&nbsp;'CyberArk AIM Central Credential Provider Lookup',

&nbsp;&nbsp;&nbsp;&nbsp;inputs=aim\_inputs,

&nbsp;&nbsp;&nbsp;&nbsp;backend=aim\_backend

)

I have tested the CyberArk call with Certs outside of AWX with a basic  
Python Program and it works fine so I'm fairly certain that CyberArk is  
properly configured to respond. Include the Python Code I'm using that  
works :

#import http.client  
import http.client  
import json  
import ssl  
Defining certificate related stuff and host of endpoint

certificate\_file = '/loc/cert.pem'  
certificate\_secret= ''  
host = 'cyberarkhost'  
Defining parts of the HTTP request

request\_url='/AIMWebService/api/Accounts?AppID=APP\_GSF\_D\_Ansible\_Test&Safe=GSF\_D\_Ansible\_Test&UserName=Ansible-User'  
request\_headers = {  
'Content-Type': 'application/json'  
}  
request\_body\_dict={  
"AppID": "APP\_GSF\_D\_Ansible\_Test",  
"object\_query": "Safe=GSF\_D\_Ansible\_Test;UserName=Ansible-User",  
"object\_query\_format": "Exact",  
"reason":"sss"  
}  
Define the client certificate settings for https connection

context = ssl.SSLContext(ssl.PROTOCOL\_SSLv23)  
context.load\_cert\_chain(certfile=certificate\_file,  
password=certificate\_secret)

connection = http.client.HTTPSConnection(host, port=443, context=context)  
Use connection to submit a HTTP POST request

connection.request(method="GET", url=request\_url, headers=request\_headers,  
body=json.dumps(request\_body\_dict))  
Print the HTTP response

response = connection.getresponse()  
print(response.status, response.reason)  
data = response.read()  
print(data)

Thanks Matt