laps_password – Retrieves the LAPS password for a server

• Synopsis
• Requirements
• Parameters
• Notes
• Examples
• Return Values
• Status

Synopsis

• This lookup returns the LAPS password set for a server from the Active Directory database.
• See https://github.com/jborean93/ansible-lookup-laps_password for more information around installing pre-requisites and testing.

Requirements

The below requirements are needed on the local master node that executes this lookup.

• python-ldap

Parameters

Notes

Examples

# This isn't mandatory but it is a way to call kinit from within Ansible before calling the lookup
- name: call kinit to retrieve Kerberos token
  expect:
    command: kinit [email protected]
    responses:
      (?i)password: SecretPass1
  no_log: True

- name: Get the LAPS password using Kerberos auth, relies on kinit already being called
  set_fact:
    ansible_password: "{{ lookup('laps_password', 'SERVER', domain='dc01.ansible.com') }}"

- name: Specific the domain host using an explicit LDAP URI
  set_fact:
    ansible_password: "{{ lookup('laps_password', 'SERVER', domain='ldap://ansible.com:389') }}"

- name: Use Simple auth over LDAPS
  set_fact:
    ansible_password: "{{ lookup('laps_password', 'server',
                                 domain='dc01.ansible.com',
                                 auth='simple',
                                 scheme='ldaps',
                                 username='[email protected]',
                                 password='SuperSecret123') }}"

- name: Use Simple auth with LDAP and StartTLS
  set_fact:
    ansible_password: "{{ lookup('laps_password', 'app01',
                                 domain='dc01.ansible.com',
                                 auth='simple',
                                 start_tls=True,
                                 username='[email protected]',
                                 password='SuperSecret123') }}"

- name: Narrow down the search base to a an OU
  set_fact:
    ansible_password: "{{ lookup('laps_password', 'sql10',
                                 domain='dc01.ansible.com',
                                 search_base='OU=Databases,DC=ansible,DC=com') }}"

- name: Set certificate file to use when validating the TLS certificate
  set_fact:
    ansible_password: "{{ lookup('laps_password', 'windows-pc',
                                 domain='dc01.ansible.com',
                                 start_tls=True,
                                 ca_cert='/usr/local/share/certs/ad.pem') }}"

Return Values

Common return values are documented here, the following are the fields unique to this lookup:

Status

• This lookup is not guaranteed to have a backwards compatible interface. [preview]
• This lookup is maintained by the Ansible Community. [community]

Authors

• Jordan Borean (@jborean93)