# Using Vault in microsoft.ad.ldap.yml

**URL:** <https://forum.ansible.com/t/using-vault-in-microsoft-ad-ldap-yml/38809>\
**Category:** Ansible Project\
**Created:** [June 14, 2024, 2:45pm UTC](https://forum.ansible.com/t/using-vault-in-microsoft-ad-ldap-yml/38809 "2024-06-14T14:45:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Caroline\_Kiel](https://avatars.discourse-cdn.com/v4/letter/c/b487fb/32.png) [@Caroline\_Kiel](https://forum.ansible.com/u/Caroline_Kiel)\
**Post date:** [June 14, 2024, 2:45pm UTC](https://forum.ansible.com/t/using-vault-in-microsoft-ad-ldap-yml/38809/1 "2024-06-14T14:45:44Z")

</div>

Hi everyone,  
I searched this list but couldn’t find a valid answer.

I want to use the MS plugin microsoft.ad.ldap.yml inside a playbook.  
As long, as I enter the LDAP username and password as clear text in the yml, everything runs smooth.  
But, of course, this is not an option for production, so I’m looking for a way to store the password in a vault file.  
Unfortunately, I can’t get it to work using variables at all.  
There is a hint that one can use environment variables, but I’m really struggling.

Does anyone have a hint for me?  
Thank you very much in advance,  
Caroline

---

<div class="post-metadata">

**Author:** ![Will\_McDonald](https://avatars.discourse-cdn.com/v4/letter/w/f475e1/32.png) [@Will\_McDonald](https://forum.ansible.com/u/Will_McDonald)\
**Post date:** [June 17, 2024, 2:22pm UTC](https://forum.ansible.com/t/using-vault-in-microsoft-ad-ldap-yml/38809/2 "2024-06-17T14:22:42Z")

</div>

And: [https://docs.ansible.com/ansible/latest/collections/microsoft/ad/ldap\_inventory.html#parameter-password](https://docs.ansible.com/ansible/latest/collections/microsoft/ad/ldap_inventory.html#parameter-password)

If you set both:

MICROSOFT\_AD\_LDAP\_USERNAME  
MICROSOFT\_AD\_LDAP\_PASSWORD

e.g.:

$ export MICROSOFT\_AD\_LDAP\_USERNAME=read\_only\_user  
$ export MICROSOFT\_AD\_LDAP\_PASSWORD=Hugely\_Complicated\_Password

Then those should be consumed by the plugin. If your password has metacharacters, you’ll need to figure out the right combination of quoting/escaping too to ensure they’re ingested correctly?

If you read the examples in the plugin docs, they also show some lookups being used to populate the config, you could potentially tweak that to pull from an Ansible vault.