# CyberArk AIM - Credential plugins and Object Query and passing ansible facts

**URL:** <https://forum.ansible.com/t/cyberark-aim-credential-plugins-and-object-query-and-passing-ansible-facts/36346>\
**Category:** AWX Project\
**Created:** [February 18, 2022, 6:35pm UTC](https://forum.ansible.com/t/cyberark-aim-credential-plugins-and-object-query-and-passing-ansible-facts/36346 "2022-02-18T18:35:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matthew\_Perry](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matthew_perry/32/3629_2.png) [@Matthew\_Perry](https://forum.ansible.com/u/Matthew_Perry)\
**Post date:** [February 18, 2022, 6:35pm UTC](https://forum.ansible.com/t/cyberark-aim-credential-plugins-and-object-query-and-passing-ansible-facts/36346/1 "2022-02-18T18:35:35Z")

</div>

Hi,

We are trying to configure our Cyberark AIM Object query to pass the inventory hostname during the credential Lookup process. Our object string needs to parse in the inventory\_hostname at execution time so that we pull the credential for the username on the host that we are connecting too. The example object query that we are using is:

Safe=Mysafe;UserName=linuxops;host=“{{ inventory\_hostname }}”

The purpose of the {{ inventory\_hostname }} is to pass the host (ansible fact )we are connecting to in the CyberArk AIM query.

We have gotten the AIM query without the passing a variable so we can use a fixed query but require to be able to pass in the inventory\_host. in order to get the unique accounts password on each individual host as its a local account on each server.

I’ve looked at the docs and if been able to get everything working with static vaules so its the part were I passing the hostname into the Object queyr that I cant figure out…

Any help or guidance would be great. I’m willing to build my own plugin that calls cyberark and gets the password but I still need to know how it would get the hostname (inventory\_hostname fact I’m assuming) during template execution on a paticular host.

Thanks Matt

Thanks

---

<div class="post-metadata">

**Author:** ![jowestco](https://avatars.discourse-cdn.com/v4/letter/j/85f322/32.png) [@jowestco](https://forum.ansible.com/u/jowestco)\
**Post date:** [February 23, 2022, 8:58pm UTC](https://forum.ansible.com/t/cyberark-aim-credential-plugins-and-object-query-and-passing-ansible-facts/36346/2 "2022-02-23T20:58:27Z")

</div>

Even if you could use an ansible\_fact inside a CyberArk lookup AWX can currently only use a single credential for all connections in a job template. There is an old feature enhancement that tracks this: [https://github.com/ansible/awx/issues/286](https://github.com/ansible/awx/issues/286). Feel free to add your thoughts in there and/or upvote that issue.  
You maybe able to get around this by writing your own lookup plugin like you mention.