# win\_dns\_record credentials

**URL:** <https://forum.ansible.com/t/win-dns-record-credentials/35973>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [November 6, 2021, 11:14am UTC](https://forum.ansible.com/t/win-dns-record-credentials/35973 "2021-11-06T11:14:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elio\_Lopez](https://avatars.discourse-cdn.com/v4/letter/e/2acd7d/32.png) [@Elio\_Lopez](https://forum.ansible.com/u/Elio_Lopez)\
**Post date:** [November 6, 2021, 11:14am UTC](https://forum.ansible.com/t/win-dns-record-credentials/35973/1 "2021-11-06T11:14:54Z")

</div>

Hello there,

I’m using the win\_dns\_record module in tower 3.8.3 in Openshift, but it doesn’t seem to have an option to put the credentials to be used, or at least not documented.  
The only way to fill in the required “ansible\_user” and “ansible\_password” credentials is explicitly in the “extra variables” section, with its no convenient against security concerns.

I’ve opened an “issue” against the project ([https://github.com/ansible-collections/community.windows/issues/315](https://github.com/ansible-collections/community.windows/issues/315) ), but Jordan Borean has kindly suggested me to write in this group.

if I try to use the facts:

- set\_fact:  
ansible\_user: “{{ user }}”  
ansible\_password: “{{ password }}”

- debug: msg: “Ansible user set by fact is {{ ansible\_user }}”

- name: Create A record  
community.windows.win\_dns\_record:  
name: “{{ vm\_name|upper }}”  
type: “A”  
value: “{{ vm\_ip }}”  
zone: “{{ selected\_zone }}”

the values are actually not considered by the playbook:

TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /tmp/bwrap\_1535\_6eo1vcx\_/awx\_1535\_5bwcwf0t/project/windows\_management\_playbooks/automate.yaml:1 Using module file /usr/lib/python2.7/site-packages/ansible/modules/windows/setup.ps1 Pipelining is enabled. \<[dc.masked.com](http://dc.masked.com)\> ESTABLISH WINRM CONNECTION FOR USER: root on PORT 5985 TO [dc.masked.com](http://dc.masked.com) fatal: [[dc.masked.com](http://dc.masked.com)]: UNREACHABLE! =\> { “changed”: false, “msg”: “plaintext: auth method plaintext requires a password”, “unreachable”: true }

Is there a better was to pass the credentials (perhaps from within the playbook, and not as an extra variable) so we can encrypt them?

Thanks in advance,

Elio

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [November 9, 2021, 1:22am UTC](https://forum.ansible.com/t/win-dns-record-credentials/35973/2 "2021-11-09T01:22:32Z")

</div>

My comment in that issue still applies you have a play that looks somewhat like the following

- name: my play  
hosts: my-win-hosts  
gather\_facts: yes # If omitted the default is yes, will always run unless you set this as no  
tasks:
- name: Create A record  
community.windows.win\_dns\_record:  
name: “{{ vm\_name|upper }}”  
type: “A”  
value: “{{ vm\_ip }}”  
zone: “{{ selected\_zone }}”

The ‘gather\_facts: yes’ part means it is going to run the setup.ps1 module at the start of the play and it’s trying to connect as your current user and no password is set as per the error message. This happens all before the ‘win\_dns\_record’ module is even run. If no credential are specified for the winrm connection Ansible will default to the current username, in your case root, and there is no password specified leading to your problem.

What you need to do to fix this is to ensure you have defined ansible\_user and ansible\_password so that it applies to my-win-hosts. This can be done in 3 main ways

- Set as a host var for the host itself
- Set as a group var for the group the host is a member of, say a group called windows
- Set explicitly when you call ansible-playbook, either through -e, or with the -u and -k arguments  
The latter option is only really useful if you need the caller of the play to provide the credentials, typically you want these set on the host or group level like so

[windows]  
my-win-hosts ansible\_user=username ansible\_password=password

[windows:vars]  
ansible\_connection=winrm  
ansible\_winrm\_transport=ntlm  
…

If you wish for the person to provide it through the command line when invoking Ansible you can do ‘ansible-playbook main.yml -u username -k’. The -k will have Ansible prompt you what the password is, otherwise you can use the somewhat insecure method ‘-e ansible\_password=password’.

Thanks

Jordan