Using environment variables/config file for authentication does not work about controller_configuration

[sean-m-sullivan]

@DWSR Thought you'd like to know that this thread inspired This PR, to fix default values in awx.awx as well. https://github.com/ansible/awx/pull/9313/files

[ericzolf]

I'm not sure to follow you:

• all tower_username definitions are commented out in the defaults
• the pattern for all tasks is tower_username: "{{ tower_username | default(omit) }}" (with only two exceptions, 'hosts' and 'users', defaulting to admin, but I'll fix this so that it's consistent).
• and the same thing for tower_oauthtoken (without exception).

So, if you don't define the tower_... variables in your inventory, the module should take them from the environment variables.

[ericzolf]

Additionally, the tower_password wasn't omitted on hosts and users, that might have caused more issues. I'll fix it also.

[sean-m-sullivan]

Going to leave this open in case that did not solve it, plan to do some testing to verify for tower config file as well. Unless we hear back from @DWSR that the new revision worked, It has not been pushed to galaxy yet, but should be today once the other PR is merged.

[DWSR]

tower_username | default(omit) will not omit the parameter if tower_username is an empty string. In order to do that, you need to pass a second parameter of true. Without that, the default values in several of the roles will cause credentials supplied in the environment (or via the config file, I suspect) to not work as expected.

An example:

- hosts: all
  gather_facts: false
  vars:
    tower_username: ""
  tasks:
    - debug:
        msg: "Without true: {{ tower_username | default(omit) }}"
    - debug:
        msg: "With true: {{ tower_username | default(omit, true) }}"

❯ ansible-playbook -i 'localhost,' ~/scratch/scratch.yml

PLAY [all] ****************************************************************************************************************************************************

TASK [debug] **************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "Without true: "
}

TASK [debug] **************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "With true: __omit_place_holder__0722bcf5e39a489bde9d47ecebed1d271e166a77"
}

PLAY RECAP ****************************************************************************************************************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

[sean-m-sullivan]

I think the question rises, why is tower_username being set at all when your using ansible_cfg settings. I took your example and was wondering myself. We normally expect tower_username to be never declared, same with the other auth variables when ansible.cfg is being used.
Playbook:

- name: Launch VRF workflows
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    tower_username: ""
    tower_false: false
    tower_true: true
  tasks:
    - debug:
        msg: "tower_username Without true: {{ tower_username | default(omit) }}"
    - debug:
        msg: "tower_username With true: {{ tower_username | default(omit, true) }}"
    - debug:
        msg: "tower_not_username Without true: {{ tower_not_username | default(omit) }}"
    - debug:
        msg: "tower_not_username With true: {{ tower_not_username | default(omit, true) }}"
    - debug:
        msg: "tower_false Without true: {{ tower_false | default(omit) }}"
    - debug:
        msg: "tower_false With true: {{ tower_false | default(omit, true) }}"
    - debug:
        msg: "tower_true Without true: {{ tower_true | default(omit) }}"
    - debug:
        msg: "tower_true With true: {{ tower_true | default(omit, true) }}"

output:

ansible-playbook test_copy.yml 
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [Launch VRF workflows] ****************************************************************************************************************************************************************************

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_username Without true: "
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_username With true: __omit_place_holder__a5707b829bf711bc86fe36c4dfdc39ab701ebe3e"
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_not_username Without true: __omit_place_holder__a5707b829bf711bc86fe36c4dfdc39ab701ebe3e"
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_not_username With true: __omit_place_holder__a5707b829bf711bc86fe36c4dfdc39ab701ebe3e"
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_false Without true: False"
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_false With true: __omit_place_holder__a5707b829bf711bc86fe36c4dfdc39ab701ebe3e"
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_true Without true: True"
}

TASK [debug] *******************************************************************************************************************************************************************************************
ok: [localhost] => {
    "msg": "tower_true With true: True"
}

PLAY RECAP *********************************************************************************************************************************************************************************************
localhost                  : ok=8    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

It is possible for someone to do a PR, and add false to every omit option in the Repo, and we would gladly accept that PR, but the quick fix for now is to not define the variable.

[DWSR]

@sean-m-sullivan It looks like 1.0.2 fixed this. I'll open up a separate issue to treat empty strings as unset (i.e. default(omit) -> default(omit, true)) so that discussion can be focused on that.