I’m currently playing with the ansible collection to get and create ressources on my self-hosted (docker) passbolt. I’m trying to run the tasks given in the “passbolt/lab-passbolt-ansible-poc”.
Viewing a resource is working well as you can see here:
As you can see, the previous request to authenticate the user and check if the resource already exists seems to success. What’s more, this user is admin so I can’t figure out why it is forbidden.
Is it safe to use the ansible collection ? It depends on the py-passbolt python module and seems to be experimental, I can’t find many documentation on it or other examples, am I the only one to use it ? I don’t know if this is better to not use it at all.
TASK [Get] ********************************************************************************************************************************************************************************************************
/usr/local/lib/python3.11/dist-packages/pgpy/constants.py:192: CryptographyDeprecationWarning: IDEA has been deprecated
bs = {SymmetricKeyAlgorithm.IDEA: algorithms.IDEA,
/usr/local/lib/python3.11/dist-packages/pgpy/constants.py:194: CryptographyDeprecationWarning: CAST5 has been deprecated
SymmetricKeyAlgorithm.CAST5: algorithms.CAST5,
/usr/local/lib/python3.11/dist-packages/pgpy/constants.py:195: CryptographyDeprecationWarning: Blowfish has been deprecated
SymmetricKeyAlgorithm.Blowfish: algorithms.Blowfish,
ok: [local1] => {
“msg”: {
“created”: “2023-10-22T16:12:02+00:00”,
“deleted”: false,
“description”: “”,
“folder_parent_id”: null,
“modified”: “2023-10-22T16:12:02+00:00”,
“modified_by”: “ecb21632-2921-4a4d-96c6-7fa9eb4fe9c3”,
“name”: “OVH”,
“password”: “the_password”,
“personal”: true,
“resource_type_id”: “a28a04cd-6f53-518a-967c-9963bf9cec51”,
“uri”: “”,
“username”: “choco”
}
}
TASK [Create] *****************************************************************************************************************************************************************************************************
/usr/local/lib/python3.11/dist-packages/pgpy/constants.py:192: CryptographyDeprecationWarning: IDEA has been deprecated
bs = {SymmetricKeyAlgorithm.IDEA: algorithms.IDEA,
/usr/local/lib/python3.11/dist-packages/pgpy/constants.py:194: CryptographyDeprecationWarning: CAST5 has been deprecated
SymmetricKeyAlgorithm.CAST5: algorithms.CAST5,
/usr/local/lib/python3.11/dist-packages/pgpy/constants.py:195: CryptographyDeprecationWarning: Blowfish has been deprecated
SymmetricKeyAlgorithm.Blowfish: algorithms.Blowfish,
ok: [local1] => {
“lookup(‘passbolt’, ‘test’, password=‘PASSWORD1234’)”: {
“created”: “”,
“deleted”: “”,
“description”: “”,
“folder_parent_id”: “”,
“modified”: “”,
“modified_by”: “”,
“name”: “”,
“password”: “”,
“personal”: “”,
“resource_type_id”: “”,
“uri”: “”,
“username”: “”
}
}
The output shows an empty resource with OK status but in the docker logs I can clearly see the 403 error code from the server on the POST request (cf first post output)
But when I set PASSBOLT_CREATE_NEW_RESOURCE to ‘false’, it tells me that the resource doesn’t exist:
fatal: [local1]: FAILED! => {“msg”: “An unhandled exception occurred while running the lookup plugin ‘passbolt’. Error was a <class ‘Exception’>, original message: resource test not found. resource test not found”}
In the playbook, the password is randomly generated, but you can force the password as you set in your ecample. I got no issue on my side.
Can you tell me more about your environment where you are running ansible, how did you setup your ansible environment and give me the output of these commands?
cat /etc/os-release
pip list
ansible --version
ansible-galaxy collection list
Can you also use this icon to format your code?
Because it is very hard to read your code snippets.
Having same problem as described, playbook able to fetch passwords, but not able to create passwords if it doesn’t exists, PASSBOLT_CREATE_NEW_RESOURCE=“true”.
I checked your previous comment where you are using image: passbolt/passbolt:latest , But i got into this problem with image: passbolt/passbolt:latest-ce
Hi @basan12 and welcome to passbolt community forum
passbolt/passbolt:latest and passbolt/passbolt:latest-ce are the same image.
Can you tell me more about your environment where you are running ansible, how did you setup your ansible environment and give me the output of these commands?
cat /etc/os-release
pip list
ansible --version
ansible-galaxy collection list
The access log shows a 403, however via the addon am able to create passwords.
x.x.x.x - - [02/Feb/2024:18:13:21 +0100] “POST /resources.json HTTP/1.1” 403 303 “-” “python-httpx/0.23.3”
The passbolt error log shows:
2024-02-02 17:26:40 error: [Cake\Http\Exception\InvalidCsrfTokenException] CSRF token from either the request body or request headers did not match or is missing. in /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Http/Middleware/CsrfProtectionMiddleware.php on line 417
Request URL: /resources.json
Client IP:XXXX
Outside a browser, like for a CLI or SDK, read the value from the csrf cookie and send it back with the request in HTTP headers.
Inside a browser (if you can’t access the cookie), get it from the csrf token API endpoint and send it back with the request in HTTP headers. (not recommended, we will deprecate this at some point)
