# ipa-client-install using ansible-vault

**URL:** <https://forum.ansible.com/t/ipa-client-install-using-ansible-vault/25691>\
**Category:** Ansible Project\
**Created:** [October 5, 2017, 5:33pm UTC](https://forum.ansible.com/t/ipa-client-install-using-ansible-vault/25691 "2017-10-05T17:33:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ed\_Rice](https://avatars.discourse-cdn.com/v4/letter/e/b487fb/32.png) [@Ed\_Rice](https://forum.ansible.com/u/Ed_Rice)\
**Post date:** [October 5, 2017, 5:33pm UTC](https://forum.ansible.com/t/ipa-client-install-using-ansible-vault/25691/1 "2017-10-05T17:33:57Z")

</div>

Ansible version is 2.3.1.0 / Python version is 2.7.5

I have created the following in one of my playbooks -

- name: Join IPA domain  
command: ipa-client-install --server=servername.domain --domain=private.domain --principal=admin --password=“{{ipa\_password}}” --mkhomedir --force-ntpd -U

when this play is ran, it fails with the following error “kinit: Preauthentication failed while getting initial credentials” I can see where my password is getting unwrapped from the vault. It shows up in the trace as “–password={u’ipa\_password’ : u’mypassword’}”

If I use plaintext in the --password= field, the play runs successfully and I join my domain. I really would like to use ansible-vault so I can automate this task without exposing my ipa password.