# git checkout to new branch and change back to local user

**URL:** <https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982>\
**Category:** Ansible Project\
**Created:** [March 13, 2018, 11:02am UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982 "2018-03-13T11:02:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Balaji1](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@Balaji1](https://forum.ansible.com/u/Balaji1)\
**Post date:** [March 13, 2018, 11:02am UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/1 "2018-03-13T11:02:03Z")

</div>

Hello All,

Please help to find answers for two questions.

1. 

I am trying to clone a remote git repo which I am able to do with git module but does anyone know how I can achieve to do

git checkout -b new branch \<username\_\>

git-crypt unlock

using git module or any other means. ( I can use “command” ) but any other better way?

1. I know how to make ansible to ssh to remote

become\_method = sudo  
become\_user = name  
create a file  
set owner = name

but how to achieve, once the owner is set on a remote host

return back to local (control) host,

become a local user,  
create a file.  
set owner.

Thanks,

---

<div class="post-metadata">

**Author:** ![Patrick\_Hunt](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@Patrick\_Hunt](https://forum.ansible.com/u/Patrick_Hunt)\
**Post date:** [March 13, 2018, 2:35pm UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/2 "2018-03-13T14:35:27Z")

</div>

> I can help to address #2 at least for now.

Ansible does not allow you to chain “Become” statements. In other words you cannot log in as user1, become root, and then become user2 (or even user1) in the same play. You could address this in a few different ways that I know of:

- split the play into multiple plays within a playbook where you can set the become for each different play:

`

---

<div class="post-metadata">

**Author:** ![flowerysong1](https://avatars.discourse-cdn.com/v4/letter/f/ecae2f/32.png) [@flowerysong1](https://forum.ansible.com/u/flowerysong1)\
**Post date:** [March 13, 2018, 4:45pm UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/3 "2018-03-13T16:45:49Z")

</div>

> > I can help to address #2 at least for now.
> 
> Ansible does not allow you to chain “Become” statements.

This is true; you cannot use two types or levels of privilege escalation at once.

> In other words you cannot log in as user1, become root, and then become user2 (or even user1) in the same play.

This is untrue. The privilege escalation settings for each task in a play are independent.

`

- hosts: localhost  
become: true  
tasks:
- command: whoami
- command: whoami  
become\_user: email
- command: whoami  
become: false

`

`

TASK [command] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [localhost] =\> {“attempts”: 1, “changed”: true, “cmd”: [“whoami”], “delta”: “0:00:00.002095”, “end”: “2018-03-13 12:38:30.764121”, “rc”: 0, “start”: “2018-03-13 12:38:30.762026”, “stderr”: “”, “stderr\_lines”: , “stdout”: “root”, “stdout\_lines”: [“root”]}

TASK [command] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [localhost] =\> {“attempts”: 1, “changed”: true, “cmd”: [“whoami”], “delta”: “0:00:00.001929”, “end”: “2018-03-13 12:38:30.889973”, “rc”: 0, “start”: “2018-03-13 12:38:30.888044”, “stderr”: “”, “stderr\_lines”: , “stdout”: “email”, “stdout\_lines”: [“email”]}

TASK [command] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [localhost] =\> {“attempts”: 1, “changed”: true, “cmd”: [“whoami”], “delta”: “0:00:00.002009”, “end”: “2018-03-13 12:38:31.004561”, “rc”: 0, “start”: “2018-03-13 12:38:31.002552”, “stderr”: “”, “stderr\_lines”: , “stdout”: “ec2-user”, “stdout\_lines”: [“ec2-user”]}

`

---

<div class="post-metadata">

**Author:** ![Balaji1](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@Balaji1](https://forum.ansible.com/u/Balaji1)\
**Post date:** [March 13, 2018, 5:17pm UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/4 "2018-03-13T17:17:51Z")

</div>

On Tuesday, March 13, 2018 at 7:35:27 AM UTC-7, Patrick Hunt wrote:Hi Patrick,

> > I can help to address #2 at least for now.
> 
> Ansible does not allow you to chain “Become” statements. In other words you cannot log in as user1, become root, and then become user2 (or even user1) in the same play. You could address this in a few different ways that I know of:
> 
> - split the play into multiple plays within a playbook where you can set the become for each different play:
> 
> ## `
> 
> - host: localhost  
> become: true  
> become\_user: root  
> become\_method: su
> 
> tasks:
> 
> - name: some play performed as root
> 
> - host: localhost  
> become: true  
> become\_user: user2  
> become\_method: su
> 
> tasks:
> 
> - name: some other play performed as user2
> 
> - host: localhost  
> become: false
> 
> tasks:
> 
> - name: some other play performed as user1  
> …  
> `
> 
> - you could also use a command module workaround (at least with a Nix system) such as:
> 
> ## `
> 
> - hosts: localhost  
> become: true  
> become\_user: root  
> become\_method: su
> 
> tasks:
> 
> - name: some task as root
> 
> - name: some task as user2  
> command: su - user2 -c “/home/user2/somecommand.sh”  
> …  
> `

Hi Patrick,

> My follow-up question is… why? In your example you could just create the file as root, set the owner, group, and mode to reflect the user you want it to be.

Thank you very much for suggesting above method and sharing your knowledge.  
This playbook will be used by other users in my team on their laptop. Hence creating a file and performing few tasks as the local user.

Thanks,  
Balaji Chavdi

---

<div class="post-metadata">

**Author:** ![Patrick\_Hunt](https://avatars.discourse-cdn.com/v4/letter/p/c68b51/32.png) [@Patrick\_Hunt](https://forum.ansible.com/u/Patrick_Hunt)\
**Post date:** [March 13, 2018, 5:42pm UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/5 "2018-03-13T17:42:18Z")

</div>

Good catch. You’re correct, it is possible, I was mistaken. Practically is it possible to be able to provide multiple sets of credentials for your example? I’ve always done a work around, such as I listed in the other comment, since I can pass my current logon (-k) username/password, and can pass 1 set of become credentials (-K), but not a 2nd or 3rd set of become credentials.

---

<div class="post-metadata">

**Author:** ![flowerysong1](https://avatars.discourse-cdn.com/v4/letter/f/ecae2f/32.png) [@flowerysong1](https://forum.ansible.com/u/flowerysong1)\
**Post date:** [March 13, 2018, 7:22pm UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/6 "2018-03-13T19:22:25Z")

</div>

Well, one of the advantages of sudo as a privilege escalation method is that there aren’t separate sets of credentials for each escalation target, you just have to be permitted to run things as the users in question.

But, yes, it is possible to provide different credentials. It’s easiest to do this non-interactively using a Vault-encrypted variable or another secret lookup method, but there are various ways to make it interactive.

`

- hosts: localhost  
become: true  
tasks:
- command: whoami  
become\_method: su  
become\_user: flowerysong  
vars:  
ansible\_become\_pass: “{{ user\_passwords.flowerysong }}”
- command: whoami

`

`

TASK [command] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [localhost] =\> {“changed”: true, “cmd”: [“whoami”], “delta”: “0:00:00.002181”, “end”: “2018-03-13 15:15:47.586117”, “rc”: 0, “start”: “2018-03-13 15:15:47.583936”, “stderr”: “”, “stderr\_lines”: , “stdout”: “flowerysong”, “stdout\_lines”: [“flowerysong”]}

TASK [command] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [localhost] =\> {“changed”: true, “cmd”: [“whoami”], “delta”: “0:00:00.002159”, “end”: “2018-03-13 15:15:47.717122”, “rc”: 0, “start”: “2018-03-13 15:15:47.714963”, “stderr”: “”, “stderr\_lines”: , “stdout”: “root”, “stdout\_lines”: [“root”]}

`

---

<div class="post-metadata">

**Author:** ![Balaji1](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@Balaji1](https://forum.ansible.com/u/Balaji1)\
**Post date:** [March 17, 2018, 2:50pm UTC](https://forum.ansible.com/t/git-checkout-to-new-branch-and-change-back-to-local-user/26982/7 "2018-03-17T14:50:50Z")

</div>

Thanks Flowerysong…!  
These answers helped me a lot…

Thanks all…!