Unable to get / load credentials

Hello community,

I have followed the document https://docs.ansible.com/ansible/latest/scenario_guides/guide_azure.html to authenticate with Azure.

I have created two credential files on my Ansible host as follows:

(venv27) packt@ubuntu2:~/.azure$ pwd
/home/packt/.azure
(venv27) packt@ubuntu2:~/.azure$ ls -la
total 32
drwxrwxr-x 2 packt packt 4096 Jun 12 22:24 .
drwxr-xr-x 9 packt packt 4096 Jun 12 21:59 …
-rw-rw-r-- 1 packt packt 5 Jun 12 22:19 az.json
-rw-rw-r-- 1 packt packt 5 Jun 12 22:19 az.sess
-rw-rw-r-- 1 packt packt 5 Jun 12 22:19 azureProfile.json
-rw------- 1 packt packt 27 Jun 12 22:19 config
-rw-rw-r-- 1 packt packt 296 Jun 12 22:24 credentials
-rw-rw-r-- 1 packt packt 306 Jun 12 22:24 credentials.ini

My credential files look as follows:

[default]
AZURE_CLIENT_ID=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_SECRET=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_SUBSCRIPTION_ID=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_TENANT=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_AD_USER=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_PASSWORD=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx

My playbook is a follows:

That looks like a python virtual. Is Ansible hiding in venv27?

Hi Karl,

It is a python virtual. How can I tell if Ansible is hiding in venv27? And how do I fix this? It’s never happened before

All, please ignore the last comment where I said:

‘It is a python virtual. How can I tell if Ansible is hiding in venv27? And how do I fix this? It’s never happened before’

I was referring to another question…

I still need help with this question and Unable load credentials…

Sorry Carlton, I’m running out of know-how :frowning:

Try this. Go to your home directory on the virtual and run this command:

find . -name “ansible” -print

That will locate any directories or files with “ansible” in them, and perhaps give you a clue as to how Ansible was installed, and where it was installed to.

If that command finds nothing, go to the root directory of your virtual and repeat the comand.

Beyond that, I’m as stumped as you. But I do know that either it was never installed, or it was installed somewhere other than you now expect. It has not uninstalled itself.

Regards, K.

Hi Karl,

I think we’re answering a different question.

This question refers to Ansible not loading my Azure credentials … which I desperately need help with.

I know nothing about Azure. However, some possibilities:

  • the permissions on your credentials files should probably not include o=r

  • are you are executing Ansible as the user with the credentials files?

  • the docs I can find in a cursory search suggest that the creds file should look like this:

[default]
subscription_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
secret=xxxxxxxxxxxxxxxxx

tenant=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

… which is very different to what you have.

Also you have credentials, config and credentials.ini and other files as well, not sure which is what or which is correct. Suggest you move everything OUT of that directory and move them back in one at a time while testing access, to make sure you are using the correct file.

See https://docs.ansible.com/ansible/latest/scenario_guides/guide_azure.html


​Regards, K.

Hi Karl,

Really appreciate you helping with this:

Not sure what you mean by ’ should probably not include o=r’

Also, not sure how my creds file differ from:

[default]
subscription_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
secret=xxxxxxxxxxxxxxxxx

tenant=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The permissions on your credentials files allow anyone with access to the computer to read the files. That means they can see your credentials and presumably access your Azure account. Hence probably not right.

Ok, I got yer,

So I changed it to:
[default]

AZURE_CLIENT_ID=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_SECRET=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_SUBSCRIPTION_ID=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx
AZURE_TENANT=xxxxxx.xxxxxx.xxxxxxxxx.xxxxxx

From the Ansible document it specifies using CAPITALS … instead of lowercase ie. the docs specify using AZURE_SUBSCRIPTION_ID, instead of subscription_id … or am I wrong?

Not quite what I meant. When I look at that web page, it seems to me to be saying that you should have a credentials file in ~.azure called credentials, and that that file should contain the following:

[default]
subscription_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
secret=xxxxxxxxxxxxxxxxx

tenant=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

… with the “xxxx” parts replaced by the correct values for your subscription ID and so on.

The exact names and the exact case of the names are almost certainly relevant. For example, I think it has to be exactly and literally “subscription_id” - not “SUBSCRIPTION_ID” or “SubscriptionId” or “AZURE_SUBSCRIPTION_ID” or anything else. The One True And Correct Name for it is “subscription_id”.

I may be wrong, but unless you have definite evidence to the contrary, it is safest to assume that the exact spelling, punctuation and case of everything in the INI file is meaningful.

Look at the web page again:

https://docs.ansible.com/ansible/latest/scenario_guides/guide_azure.html

… and scroll down to where it says “Providing Credentials to Azure Modules”. Then scroll down some more until you find “Storing in a File” and read that bit.

If you were using environment variables rather than a credentials file, then you would use the upper-case names with the “AZURE_” prefix, as detailed in the section called “Using Environment Variables”. Since you are storing credentials in a file, it seems to me to make sense to use the instructions in the section called “Storing in a File”.

​Regards, K.

PS: This is just me reading a document describing something I know nothing about. Anyone with actual Azure experience should feel free to chime in any time…

OK, I hear yer … gonna try that right now.

Karl,

SUCCESS!

Are you in England? If so, I would love to buy you a beer… It won’t as you suggested… I only wish I had followed your advice earlier

YOU ABSOLUTE BEAUTY

THANK YOU, THANK YOU, THANK YOU…

No, I’m not in England. Land of Oz, me.

Glad it worked. All I did was read the docs :slight_smile:

Regards, K.