CyberArk AIM - Credential plugins and Object Query and passing ansible facts

Archives AWX Project
1

Hi,

We are trying to configure our Cyberark AIM Object query to pass the inventory hostname during the credential Lookup process. Our object string needs to parse in the inventory_hostname at execution time so that we pull the credential for the username on the host that we are connecting too. The example object query that we are using is:

Safe=Mysafe;UserName=linuxops;host=“{{ inventory_hostname }}”

The purpose of the {{ inventory_hostname }} is to pass the host (ansible fact )we are connecting to in the CyberArk AIM query.

We have gotten the AIM query without the passing a variable so we can use a fixed query but require to be able to pass in the inventory_host. in order to get the unique accounts password on each individual host as its a local account on each server.

I’ve looked at the docs and if been able to get everything working with static vaules so its the part were I passing the hostname into the Object queyr that I cant figure out…

Any help or guidance would be great. I’m willing to build my own plugin that calls cyberark and gets the password but I still need to know how it would get the hostname (inventory_hostname fact I’m assuming) during template execution on a paticular host.

Thanks Matt

Thanks

2

Even if you could use an ansible_fact inside a CyberArk lookup AWX can currently only use a single credential for all connections in a job template. There is an old feature enhancement that tracks this: https://github.com/ansible/awx/issues/286. Feel free to add your thoughts in there and/or upvote that issue.
You maybe able to get around this by writing your own lookup plugin like you mention.