Cyberark Per Host Password Lookup In The Ansible Automation Platform

Cyberark Central Credential provider has some killer features with one of particular interest(for this article that is) which is the ability to have a different password per host. It seems pretty bonkers to think you can maintain separate passwords for 100 different devices, but CA does it, and not only that, it has facilities that can change the password each time it’s used *galaxy brain*.

This post demonstrates how to do a per-host lookup inside the Tower/Control environment.

Demo Video

Cyberark Setup

In my CA environment I have a safe named “test” that I’m using.
In the root folder of test I’ve created three password objects, each for the switches I plan to connect to. Each object is named the same as the inventory hostname from ansible: sw1, sw2, sw3.

All of the connection info along with the walkthrough is in my CA AIM blog post.

Playbook

I’m first going to say that given my drothers I would have used the Cyberark lookup plugin, but you have to have the Central Credential software installed on your server, and I’ve yet to get a copy of it. The playbook to make that work is here:

I instead used the cyberark collection that contains the cyberark_credential module, which can be found here.

Looking at the playbook above I have a variable that I’ve setup(and I’m replacing at runtime from my tower environment) named ca_base_url.
The other cyberark info is just presented plain text, but notice that I had to supply my cert and key. This is why I wanted to use the lookup plugin, so I wouldn’t have to put a link to the cert/key anytime I wanted to use it…but I digress.

The real magic happens in the query section of the first task:

1

query: "Safe=test;Object={{ inventory_hostname }}"

I’m connecting to the safe named “test” and for each host in the current run I’m pulling the password object that is named the same as their “inventory_name”. Having these two match is how I key the two items together(the host to their respective password).

I next set the ansible_password variable for each host based on the password I just looked up. Now, when ansible subsequently attempts to connect to any inventory host it will do so via the password that was just pulled.

Make note that any task that either did the lookup or set the variables also had the no_log option set to true so that the passwords are never exposed in the logging.

Conclusion

The Cyberark per-host lookup process isn’t too difficult, it’s just a slight mind-shift from what we are used to. If you have any questions or comments, please let me know. Thanks and happy automating!