# is it possible to dynamically set user or sudo of a play / playbook? **URL:** \ **Category:** Ansible Project\ **Created:** [July 15, 2013, 10:38pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126 "2013-07-15T22:38:14Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Michael\_Ni](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Michael\_Ni](https://forum.ansible.com/u/Michael_Ni)\ **Post date:** [July 15, 2013, 10:38pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/1 "2013-07-15T22:38:14Z")
Suppose I have a thousand users, with different sudo settings, When including a play or playbook within a playbook, can i set the user and sudo key dynamically? I want to have 1 template I can use for all 1 thousand users instead of having 1000 plays, 1 for each user. Mike ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [July 15, 2013, 10:57pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/2 "2013-07-15T22:57:37Z")
Yes, you can pass in variables with --extra-args and do things like: user: “{{ user }}” Also you can set ansible\_ssh\_user as an inventory variable too. ---
**Author:** ![Michael\_Ni](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Michael\_Ni](https://forum.ansible.com/u/Michael_Ni)\ **Post date:** [July 15, 2013, 11:36pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/3 "2013-07-15T23:36:06Z")
If the outer playbook includes a playbook for each 1000 users, I am able to pass the user in as a variable, however I just realized I need to enter the password for each “inner play”. I could set my local computer’s pubkey in known hosts for each user, but can I pass the password in the include statement, either as a variable or an arg? Mike ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [July 15, 2013, 11:41pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/4 "2013-07-15T23:41:27Z")
You can definitely define a data structure and loop through it with\_items. I am not sure why you would need to login with each of 1000 users when you could log in as something else and just set ownership? ---
**Author:** ![Michael\_Ni](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Michael\_Ni](https://forum.ansible.com/u/Michael_Ni)\ **Post date:** [July 15, 2013, 11:49pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/5 "2013-07-15T23:49:48Z")
I’m trying to install ruby rvm with the single user install instead of system wide install. Each user needs to be isolated from other users. The rvm installation script will install in ~/.rvm folder. So is it possible to set each play’s user password with “with\_items”? otherwise I may have to do passwordless ssh login. ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [July 16, 2013, 12:15am UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/6 "2013-07-16T00:15:40Z")
Trying to understand, you want to install 1000 copies of RVM on a system or is this more like 1000 different systems? Have ideas, but answer might depend on which 🙂 ---
**Author:** ![Michael\_Ni](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Michael\_Ni](https://forum.ansible.com/u/Michael_Ni)\ **Post date:** [July 16, 2013, 2:07am UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/7 "2013-07-16T02:07:01Z")
Basically i’m trying set up web servers for ruby projects for 1000 users on each machine. Each user has his/her own password. Each user cannot go into other user’s directories. I probably wouldn’t be able to run 1000 ruby code due to memory constraints. 1000 was just to make a point. If you mean 1000 different systems as in 1000 machines each running separate things, I am setting it up where 1000 machines are identical. Basically horizontally webscaling. In reality I would probably only have 10 machines max. Let’s just say I put 30 users per machine. My hope was to use the outer playbook to include plays where I can login as each user and run commands as that user. I could use a sudo user to do it but I would have to modify RVM. RVM single user installs just installs in the current user’s home directory. The second problem is, I don’t want to have to physically type in the password for each user. Using a prompt would be a pain. I guess I would have to do passwordless ssh login. Mike ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 16, 2013, 11:47am UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/8 "2013-07-16T11:47:16Z")
Ok so you say 1000 machines and you say 10 and then you say 3000 and you say 30, I would like to discuss your actual use case if possible. I think you really don’t want to run the rbenv setup script 1000 times, that’s for sure 🙂 ---
**Author:** ![Michael\_Ni](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Michael\_Ni](https://forum.ansible.com/u/Michael_Ni)\ **Post date:** [July 17, 2013, 9:45am UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/9 "2013-07-17T09:45:34Z")
So I discovered I can only dynamically set playbook users with command line and extra vars, so I would have to run the command for each user such as the following ```auto ansible-playbook -i production inner-playbook.yml --verbose --extra-vars "user=mike" ``` I tried doing the following within an “outer-playbook.yml” - include: inner-playbook.yml user: ‘{{ item }}’ with\_items: $user\_list but the user became {{ user }} the debug showed \<66.228.54.69\> ESTABLISH CONNECTION FOR USER: {{user}} on PORT 2345 TO 66.228.54.22 is there a way to execute playbooks from playbooks while setting the user with “with\_items”? Mike ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 17, 2013, 11:23am UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/10 "2013-07-17T11:23:14Z")
Yes and no. The “sudo\_user” is a valid attribute of a task. This should be functional to set the user. I haven’t verified whether that works using “sudo\_user: '{{item}}” or not. The user itself needs to be set at play level. It seems it would be easier to run things from sudo root and chown them, and use the file/copy/template modules with the owner= parameter, etc? –Michael ---
**Author:** ![Michael\_Ni](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Michael\_Ni](https://forum.ansible.com/u/Michael_Ni)\ **Post date:** [July 17, 2013, 9:43pm UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/11 "2013-07-17T21:43:43Z")
I just tried to use the sudo\_user, it didn’t work for me outer playbook - include: tasks/ruby-project.yml inner\_user: ‘{{ item }}’ with\_items: $domains inner playbook ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 18, 2013, 1:18am UTC](https://forum.ansible.com/t/is-it-possible-to-dynamically-set-user-or-sudo-of-a-play-playbook/13126/12 "2013-07-18T01:18:45Z")
Yeah, so as brought up a few times before, include + with\_items is basically an unsupported thing. You can’t use inventory variables among other minor issues. It’s much better to loop inside the tasks instead, and you _can_ set sudo\_user on a task attribute.