# Using ldap\_attr to set root password works but shows failed

**URL:** <https://forum.ansible.com/t/using-ldap-attr-to-set-root-password-works-but-shows-failed/23555>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [January 25, 2017, 10:28am UTC](https://forum.ansible.com/t/using-ldap-attr-to-set-root-password-works-but-shows-failed/23555 "2017-01-25T10:28:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin\_Hughes](https://avatars.discourse-cdn.com/v4/letter/k/278dde/32.png) [@Kevin\_Hughes](https://forum.ansible.com/u/Kevin_Hughes)\
**Post date:** [January 25, 2017, 10:28am UTC](https://forum.ansible.com/t/using-ldap-attr-to-set-root-password-works-but-shows-failed/23555/1 "2017-01-25T10:28:45Z")

</div>

I’m using the following to set my LDAP root password:  
`

- name: generate ldap admin password hash  
command: “/usr/sbin/slappasswd -s PASSWORD”  
register: slapd\_admin\_password\_hash  
tags: ldap
- name: set ldap admin password  
become: yes  
ldap\_attr:  
dn: “olcDatabase={1}hdb,cn=config”  
name: olcRootPW  
values: “{{ slapd\_admin\_password\_hash.stdout }}”  
state: exact  
tags: ldap

`

It works; the password is set (in this case to PASSWORD) but the step shows an error:

`  
fatal: [10.10.9.80]: FAILED! =\> {“changed”: false, “details”: “{‘desc’: ‘No such object’}”, “failed”: true, “msg”: “Attribute action failed.”}

`

I’m completely new to LDAP from the admin side so it’s possible it’s more an LDAP misunderstanding than an Ansible one. Can anyone tell me what’s happening?

I’m using Ansible 2.3.0 on Arch linux configuring an Ubuntu Trusty server.

Thanks,  
Kev

---

<div class="post-metadata">

**Author:** ![Michael\_Stroder](https://avatars.discourse-cdn.com/v4/letter/m/7ea924/32.png) [@Michael\_Stroder](https://forum.ansible.com/u/Michael_Stroder)\
**Post date:** [January 26, 2017, 10:40am UTC](https://forum.ansible.com/t/using-ldap-attr-to-set-root-password-works-but-shows-failed/23555/2 "2017-01-26T10:40:03Z")

</div>

Kevin Hughes wrote:

> I'm using the following to set my LDAP root password:  
> -name:generate ldap admin password hash  
> &nbsp;&nbsp;command:"/usr/sbin/slappasswd -s PASSWORD"  
> &nbsp;&nbsp;register:slapd\_admin\_password\_hash  
> &nbsp;&nbsp;tags:ldap  
> -name:setldap admin password  
> &nbsp;&nbsp;become:yes  
> &nbsp;&nbsp;ldap\_attr:  
> &nbsp;&nbsp;&nbsp;&nbsp;dn:"olcDatabase={1}hdb,cn=config"  
> &nbsp;&nbsp;&nbsp;&nbsp;name:olcRootPW  
> &nbsp;&nbsp;&nbsp;&nbsp;values:"{{ slapd\_admin\_password\_hash.stdout }}"  
> &nbsp;&nbsp;&nbsp;&nbsp;state:exact  
> &nbsp;&nbsp;tags:ldap  
> \>
> 
> It works; the password is set (in this case to PASSWORD) but the step shows an error:

How did you check that the olcRootPW attribute was really changed?  
Are you 100% sure that the modify operation was successful by setting and checking a  
\_different\_ password and/or by looking at the OpenLDAP log?

> \>  
> fatal:[10.10.9.80]:FAILED!=\>{"changed":false,"details":"{'desc': 'No such  
> object'}","failed":true,"msg":"Attribute action failed."}

I've glanced over this ldap ansible module a couple of months ago but I don't know the  
inner working in detail. And diving into the various OpenLDAP details would be off-topic  
here.

But when using ansible (or another configuration management) my \*strong\* recommendation  
is to use static configuration method (aka as slapd.conf) and generate the config file(s)  
with Jinja templates. This is \*much\* less hassle regarding idempotent changes.

> I'm completely new to LDAP from the admin side so it's possible it's more an LDAP  
> misunderstanding than an Ansible one. Can anyone tell me what's happening?

I'd recommend to subscribe to the openldap-technical mailing list and ask OpenLDAP usage  
questions there. Preferrably you should try to make the LDAP operation work with  
OpenLDAP's command-line ldapmodify before trying to use ansible + 3rd party module(s).

Ciao, Michael.