# postgres\_user: crypted password not working

**URL:** <https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [October 27, 2015, 9:58am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625 "2015-10-27T09:58:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![r.grosmann](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@r.grosmann](https://forum.ansible.com/u/r.grosmann)\
**Post date:** [October 27, 2015, 9:58am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625/1 "2015-10-27T09:58:53Z")

</div>

hello group,

I have a set of tasks to create a postgres database and user.  
The strange thing is, that although it works, the supplied password is never taken as encrypted.

So if I do

- name: creeer gebruiker {{dbuser}} voor de database  
sudo: yes  
sudo\_user: postgres  
postgresql\_user:  
name: “{{dbuser}}”  
db: “{{dbuser}}”  
password: mango  
role\_attr\_flags: CREATEDB  
state: present

I get a user that can login with password mango. However, if I crypt mango with either

mkpassword --method=MD5

or

echo “md5`echo -n "mango" | md5sum`”

(from the ansible postgresql\_user documentation, with md5 replaced by md5sum- ubuntu does not have a md5 command)

and change the task to pass the crypted password

- name: creeer gebruiker {{dbuser}} voor de database  
sudo: yes  
sudo\_user: postgres  
when: not rollback  
postgresql\_user:  
name: “{{dbuser}}”  
db: “{{dbuser}}”  
password: $1$m8gRylOU$2x0qxe/RzmYFlSY93WBHT1  
encrypted: true  
role\_attr\_flags: CREATEDB  
state: present

I get a user that can only login with password $1$m8gRylOU$2x0qxe/RzmYFlSY93WBHT1 and NOT with password mango. It seems postgresql\_user is not communicating this well with postgres.  
Does anyone know how I can workaround this?

thanks for your help! Ruud

---

<div class="post-metadata">

**Author:** ![r.grosmann](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@r.grosmann](https://forum.ansible.com/u/r.grosmann)\
**Post date:** [October 27, 2015, 10:01am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625/2 "2015-10-27T10:01:10Z")

</div>

By the way:  
I use ansible 1.7.2 on a debian host, ubuntu target.

---

<div class="post-metadata">

**Author:** ![r.grosmann](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@r.grosmann](https://forum.ansible.com/u/r.grosmann)\
**Post date:** [October 27, 2015, 10:14am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625/3 "2015-10-27T10:14:54Z")

</div>

hello,

I was not completely correct in my first post. When I supply a password that is encrypted with

echo “md5`echo -n "mango" | md5sum`”

I get as output the string “md5aa00faf97d042c13a59da4d27eb32358 -”  
If I put this string in the task, I only can login with that string as password. However, when I supply that password, but _without_ the trailing " -", then I can neither login with md5aa00faf97d042c13a59da4d27eb32358 or mango, although the user is created.

I am stuck now. Any ideas?

Ruud

---

<div class="post-metadata">

**Author:** ![r.grosmann](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@r.grosmann](https://forum.ansible.com/u/r.grosmann)\
**Post date:** [October 27, 2015, 10:20am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625/4 "2015-10-27T10:20:23Z")

</div>

hello,

I was not completely correct in my first post. When I supply a password that is encrypted with

echo “md5`echo -n "mango" | md5sum`”

I get as output the string “md5aa00faf97d042c13a59da4d27eb32358 -”  
If I put this string in the task, I only can login with that string as password. However, when I supply that password, but _without_ the trailing " -", then I can neither login with md5aa00faf97d042c13a59da4d27eb32358 or mango, although the user is created.

I am stuck now. Any ideas?

Ru

---

<div class="post-metadata">

**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\
**Post date:** [October 27, 2015, 11:24am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625/5 "2015-10-27T11:24:18Z")

</div>

The md5 command is not the same as the md5sum command - as you have found by experiment - since the md5sum command also outputs the name of the file it has just checked.

Additionally if you look at the info in the ansible postgres\_user you will see that the encrypted password hash needs the user name in there as well as a salt.

However you would save yourself a lot of pain if you put the credentials into an ansible vault and then passed them to the commands in a normal (ie not hashed) form, but use the encrypted flag so that they are stored hashed within the database.

Nigel.

---

<div class="post-metadata">

**Author:** ![r.grosmann](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@r.grosmann](https://forum.ansible.com/u/r.grosmann)\
**Post date:** [October 27, 2015, 11:48am UTC](https://forum.ansible.com/t/postgres-user-crypted-password-not-working/19625/6 "2015-10-27T11:48:58Z")

</div>

Hi NIgel,  
thanks for your help. I was really having a blind spot when reading the docs. You are right: the username was missing when generating the password. When I added that one, I got a user with the expected password.  
The md5sum command can be used, when the file name is trimmed from the output.  
And I don’t see how the salt fits in. I have not specified a salt and it is working all the same.

Again: thank you for helping me out. I already spent too much time of living on this issue… 😉

Ruud