# su for role and password from vault

**URL:** <https://forum.ansible.com/t/su-for-role-and-password-from-vault/18389>\
**Category:** Ansible Project\
**Created:** [June 3, 2015, 6:23am UTC](https://forum.ansible.com/t/su-for-role-and-password-from-vault/18389 "2015-06-03T06:23:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![knacktus](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@knacktus](https://forum.ansible.com/u/knacktus)\
**Post date:** [June 3, 2015, 6:23am UTC](https://forum.ansible.com/t/su-for-role-and-password-from-vault/18389/1 "2015-06-03T06:23:22Z")

</div>

Hi guys,

I need to run my roles as different user. However, the users don’t have login permissions. I need to su after logon with the user that executes the ansible playbook.

I’ve already stored the different user ids and passwords in a vault. But I don’t know where to point to the password.

- hosts: abc1  
su: yes  
su\_user: “{{ sysabc1 }}”  
??? su\_password: “{{ sysabc1\_pwd }}”

tasks:

- shell: whoami

Thanks,

Jan

---

<div class="post-metadata">

**Author:** ![knacktus](https://avatars.discourse-cdn.com/v4/letter/k/a5b964/32.png) [@knacktus](https://forum.ansible.com/u/knacktus)\
**Post date:** [June 3, 2015, 8:37am UTC](https://forum.ansible.com/t/su-for-role-and-password-from-vault/18389/2 "2015-06-03T08:37:38Z")

</div>

Ok, I’ve got a working solution after some trial and error. Here it is for reference …

Role vars, where sysipf1\_pwd is stored in a vault:

`  
Enter code here…—

# file: roles/java/vars/main.yml

ansible\_become\_pass: “{{ sysipf1\_pwd }}”

java\_directory: “{{ ipf\_soft\_dir }}/java”  
java\_archive: server-jre-8u45-linux-x64.tar.gz  
java\_path: “{{ java\_directory }}/jdk1.8.0\_45/bin”  
java\_home: “{{ java\_path }}/java”  
`

The play:

`  
Enter code here…—

# This is the playbook to install java.

- hosts: ansible  
become: yes  
become\_method: su  
become\_user: “{{ sysipf1\_user}}”  
roles:
- java  
`

What still confuses me is why it doesn’t work to put the become-directives entirely in the vars file:

`