Ansible | PS

Ansible is an open-source software provisioning, configuration management, and application-deployment tool that enables IaC (infrastructure as code). Password Safe's integration with Ansible provides an easy to use method for users to secure and manage their Ansible related secrets for automated workflows. Secrets Safe users can leverage this integration for Continuous Integration and Continuous Deployment (CI/CD) and DevOps workflows.

The Secrets Safe Lookup plugin can be configured to retrieve ASCII secrets from Secrets Safe.

Prerequisites

The Secrets Safe Lookup plugin supports the following software, features, and configurations:

• Supports retrieval of secrets from BeyondInsight and Password Safe version 23.1 or later releases.
• Supports OAuth client secret for authentication across applications and services.
• Supports managed account password retrieval.
• Is compatible with Ansible core v2.14 and later releases.
• Is compatible with Python v3.11 and later releases.
• The Secrets Safe instance must be preconfigured with the secret in question, and an account must be authorized to read it in order for this plugin to retrieve a secret.

🚧

Important information

• Do not log the secrets to stdout. Security-minded engineers must review playbooks composition before changes are run with access to secrets.
• Ansible writes lookup plugin arguments to stdout. Do not put secret text directly in the lookup plugin arguments. Use variables as an alternative.

Overview

The Secrets Safe Lookup plugin is named secrets_safe_lookup. It is designed to be run on an Ansible Control node (Linux). The lookup plugin is available from the Ansible Galaxy Registry.

ℹ️

For more information, see the Ansible Galaxy Registry.

General setup

• Create an API registration in BeyondInsight. Ensure the User password required option is disabled.
• Create or use an existing Secrets Safe group.
• Create or use an existing BeyondInsight user.
• Add API registration to the group.
• Add the user to the group.
• Add the Secrets Safe feature to the group. Assign read-only or full access based on your use case.

Managed accounts setup

1. Create or use an existing access policy that has the View Password option enabled with the Auto Approve option selected.
2. Add the All Managed Accounts Smart Group to the BeyondInsight group.
3. Add the access policy to Password Safe role assigned to the All Managed Accounts Smart Group. Ensure that both Requestor and Approver are selected in the assigned role.
4. Create or use an existing managed system.
5. Create or use an existing managed account associated with the managed system.
6. Configure the managed account with the API Enabled and Max Concurrent Requests Unlimited options selected.

Available Ansible collections

Installing collections from Ansible Galaxy

To install the collections, you can use the next command if the collection is on Ansible Galaxy repository:

ansible-galaxy collection install beyondtrust.secrets_safe
ansible-galaxy collection install beyondtrust.password_safe

Installing collection manually

If you have the collections downloaded locally, you can run the next command:

ansible-galaxy collection install beyondtrust-secrets_safe-<version>.tar.gz
ansible-galaxy collection install beyondtrust-password_safe-<version>.tar.gz

If it's not a fresh install, you would need to run the next command to update the collection to its latest version:

ansible-galaxy collection install --upgrade beyondtrust-secrets_safe-<version>.tar.gz
ansible-galaxy collection install --upgrade beyondtrust-password_safe-<version>.tar.gz

where is the version that you downloaded.

If the installation is successful, run this command:

ansible-galaxy collection list

And you should see the collection installed:

...
Collection               Version
-----------------------  -------
beyondtrust.secrets_safe  1.0.1
beyondtrust.password_safe 1.0.1 
...

Install required modules

To run the plugin in a playbook, you need to install modules using pip, with the file requirements.txt, found locally after installing the collection. Run the following command:

pip install -r ~/.ansible/collections/ansible_collections/beyondtrust/secrets_safe/requirements.txt
pip install -r ~/.ansible/collections/ansible_collections/beyondtrust/password_safe/requirements.txt

Secrets Safe Ansible Collection Documentation

Use the Secrets Safe lookup plugin

Usage

• api_url
  • description: BeyondTrust Password Safe API URL.
  • type: string
  • required: True
• api_version
  • description: The recommended version is 3.1. If no version is specified, the default API version 3.0 is used.
  • type: string
  • required: False
• retrieval_type
  • description: Type of secret to retrieve (use MANAGED_ACCOUNT or SECRET)
  • type: string
  • required: True
• api_key
  • description: API Key. If not set, then client_id/client_secret become required. RunAs user should be provided along with API key, e.g:
  • type: string
  • required: False
• client_id
  • description: API OAuth Client ID.
  • type: string
  • required: True
• client_secret
  • description: API OAuth Client Secret.
  • type: string
  • required: True
• secret_list
  • description: List of secrets (path/title,path/title) or managed accounts (ms/ma,ms/ma) to be retrieved, separated by a comma.
  • type: string
  • required: True
• certificate_path
  • description: Password Safe API pfx Certificate Path. For use when authenticating using a Client Certificate.
  • type: string
  • required: False
• certificate_password
  • description: Password Safe API pfx Certificate Password. For use when authenticating using a Client Certificate.
  • type: string
  • required: False
• verify_ca
  • description: Indicates whether to verify the certificate authority on the Secrets Safe instance.
  • type: boolean
  • default: True
  • required: False
• decrypt
  • description: When true, returns the decrypted password field; when false, the password field is omitted, this option only applies when retrieval_type is set to SECRET.
  • type: boolean
  • default: True
  • required: False
• rotate_on_checkin
        description: If True, rotates the password on check-in, only applies when retrieval type is set to MANAGED_ACCOUNT
        type: boolean
        default: True
        required: False

✅

Example

"{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup', api_url=apiURL, api_version='3.1', retrieval_type='SECRET', client_id=clientIdFromEnvVar, client_secret=secretFromEnvVar, secret_list=secretList, certificate_path=certificatePath, certificate_password=certificatePasswordFromEnVar, wantlist=False, verify_ca=True)}}"

Output

• description: list of retrieved secret(s) in the requested order.
• type: list
• elements: str

✅

Example

export PASSWORD_SAFE_CLIENT_ID=********************
export PASSWORD_SAFE_CLIENT_SECRET=********************
export CERTIFICATE_PASSWORD=********************
export PASSWORD_SAFE_API_URL=https://example.com:443/BeyondTrust/api/public/v3
---
- name: book
  hosts: localhost
  connection: local
  vars:
      apiURL: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
      clientIdFromEnvVar: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
      secretFromEnvVar: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
      certificatePasswordFromEnVar:  "{{ lookup('ansible.builtin.env', 'CERTIFICATE_PASSWORD') }}"
      certificatePath: "<path>/ClientCertificate.pfx"
      secretManagedAccounts: "fake_system/fake_ managed_account,fake_system/fake_managed_account01"
      gotManagedAccount: "{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup', api_url=apiURL, retrieval_type='MANAGED_ACCOUNT', client_id=clientIdFromEnvVar, client_secret=secretFromEnvVar, secret_list=secretManagedAccounts, certificate_path=certificatePath, certificate_password=certificatePasswordFromEnVar, wantlist=False)}}"
      secretList: "fake_grp/credential,fake_grp/file"
      gotSecrets: "{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup', api_url=apiURL, api_version='3.1', retrieval_type='SECRET', client_id=clientIdFromEnvVar, client_secret=secretFromEnvVar, secret_list=secretList, certificate_path=certificatePath, certificate_password=certificatePasswordFromEnVar, wantlist=False, verify_ca=True)}}"
  tasks:
    - name: Display Retrieved Managed accounts
      ansible.builtin.debug:
        msg: "{{ gotManagedAccount }}"
    - name: Display Retrieved Secrets
      ansible.builtin.debug:
        msg: "{{ gotSecrets }}"

Module: folders_create

Short Description

Create Folder in Beyondtrust Password Safe API.

Description

Creates a folder in the given folder name.

Parameters

Details of data object

✅

Example

- name: Create Folder
  beyondtrust.secrets_safe.folders_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      name: "my_folder_name"
      folder_name: "parent_folder"
      description: "folder description"

Return values

Module: safes_create

Short Description

Create Safe in Beyondtrust Password Safe API.

Description

Creates a Safe.

Parameters

Details of data object

✅

Example

- name: Create Safe
  beyondtrust.secrets_safe.safes_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      name: "my_safe_name"
      description: "safe description"

Return values

Module: secrets_create

Short Description

Create secrets (credential, text, file) in Beyondtrust Password Safe API.

Description

Creates a secret (credential, text, file) in the given folder name.

Parameters

Details of data object

✅

Example

- name: Create File Secret in PS
  beyondtrust.secrets_safe.secrets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      title: "Secret Title"
      username: "test_user"
      password: "Secret content"
      folder_name: "my_folder_name"
      description: "Folder Description"
      owner_id: 12
      owner_type: "User"
      owners:
        - owner_id: 12
- name: Create Credential Secret in PS
  beyondtrust.secrets_safe.secrets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      title: "Secret Title"
      text: "Secret content"
      folder_name: "my_folder_name"
      description: "Folder Description"
      owner_id: 12
      owner_type: "User"
      owners:
        - owner_id: 12
- name: Create Text Secret in PS
  beyondtrust.secrets_safe.secrets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    data:
      title: "Secret Title"
      file_path: "my_secret.txt"
      folder_name: "my_folder_name"
      description: "Folder Description"
      owner_id: 12
      owner_type: "User"
      owners:
        - owner_id: 12

Return values

Lookup Plugins

Lookup Plugin: safes_list

Short Description

Retrieve safes list from Password Safe.

Description

Custom lookup plugin to fetch safes list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    safes: "{{ lookup('beyondtrust.password_safe.safes_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Safes list
      debug:
        msg: "{{ safes }}"
    - name: Print my_new_safe_name safe
      debug:
        msg: "{{ safes | selectattr('Name', 'equalto', 'my_new_safe_name') | first }}"

Return values

Lookup Plugin: folders_list

Short Description

Retrieve folders list from Password Safe.

Description

Custom lookup plugin to fetch folders list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    folders: "{{ lookup('beyondtrust.password_safe.folders_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Folders list
      debug:
        msg: "{{ folders }}"
    - name: Print folder2 folder
      debug:
        msg: "{{ folders | selectattr('Name', 'equalto', 'folder2') | first }}"

Return values

Lookup Plugin: secrets_safe_lookup

Short Description

Retrieve ASCII secrets from Secrets Safe.

Description

Retrieve ASCII secrets and managed account passwords from BeyondTrust Password Safe 23.1 or greater.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret:
      "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    certificatePasswordFromEnVar:
      "{{ lookup('ansible.builtin.env', 'CERTIFICATE_PASSWORD') }}"
    certificatePath: "<path>/ClientCertificate.pfx"
    secretManagedAccounts:
      "fake_system/fake_managed_account,fake_system/fake_managed_account01"
    gotManagedAccount:
      "{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup',
        api_url=api_url,
        retrieval_type='MANAGED_ACCOUNT',
        client_id=client_id,
        client_secret=client_secret,
        secret_list=secretManagedAccounts,
        certificate_path=certificatePath,
        certificate_password=certificatePasswordFromEnVar,
        wantlist=False)}}"
    secretList: "fake_grp/credential,fake_grp/file"
    gotSecrets:
      "{{lookup('beyondTrust.secrets_safe.secrets_safe_lookup',
        api_url=api_url,
        retrieval_type='SECRET',
        client_id=client_id,
        client_secret=client_secret,
        secret_list=secretList,
        certificate_path=certificatePath,
        certificate_password=certificatePasswordFromEnVar,
        wantlist=False,
        verify_ca=True)}}"

Return values

Password Safe Ansible Collection Documentation

Module: assets_create

Short Description

Create Assets in Beyondtrust Password Safe API.

Description

Creates an asset.

Parameters

Details of data object

✅

Example

- name: Create Asset
  beyondtrust.password_safe.assets_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      workgroup_id: 10
      ip_address: "192.168.1.100"
      asset_name: "my_asset"
      dns_name: "my-asset.example.com"
      domain_name: "example.com"
      mac_address: "00:1A:2B:3C:4D:5E"
      asset_type: "Server"
      description: "Linux application server"
      operating_system: "Ubuntu 22.04 LTS"

Return values

Module: workgroups_create

Short Description

Create Workgroup in Beyondtrust Password Safe API.

Description

Creates a workgroup.

Parameters

Details of data object

✅

Example

- name: Create workgroup
  beyondtrust.password_safe.workgroups_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      name: "organization_name"

Return values

Module: managed_systems_create_by_workgroup_id

Short Description

Create Managed System by Workgroup Id in Beyondtrust Password Safe API.

Description

Creates a Managed System by Workgroup Id.

Parameters

Details of data object

✅

Example

- name: Create Managed System
  beyondtrust.password_safe.managed_systems_create_by_workgroup_id:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      workgroup_id: 55
      entity_type_id: 1
      host_name: "test-server-01"
      ip_address: "192.168.1.100"
      dns_name: "test-server-01.example.com"
      instance_name: "SQLInstance1"
      template: "Standard"
      forest_name: "example.local"
      platform_id: 1
      net_bios_name: "TESTSRV01"
      contact_email: "[email protected]"
      description: "Test SQL Server"
      timeout: 60
      password_rule_id: 0
      account_name_format: 1
      oracle_internet_directory_service_name: "OIDService"
      release_duration: 180
      max_release_duration: 1440
      isa_release_duration: 120
      auto_management_flag: false
      check_password_flag: true
      change_password_after_any_release_flag: false
      reset_password_on_mismatch_flag: true
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"
      remote_client_type: "EPM"
      is_application_host: false
      access_url: "https://test-server-01.example.com"
      is_default_instance: true
      use_ssl: true
      port: 1433
      ssh_key_enforcement_mode: 0
      dss_key_rule_id: 0
      login_account_id: 0
      oracle_internet_directory_id: "2a1ce180-2ae7-470a-9dda-1a8935407a1b"
      functional_account_id: 4
      elevation_command: "sudo"
      application_host_id: 5001

Return values

Module: managed_accounts_create

Short Description

Create Managed Accounts in Beyondtrust Password Safe API.

Description

Creates a managed account.

Parameters

Details of data object

✅

Example

- name: Create Managed Accounts
  beyondtrust.password_safe.managed_accounts_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      managed_system_name: "System Name"
      account_name: "example_account"
      password: "SomePasswordValue123!"
      domain_name: "example.com"
      user_principal_name: "[email protected]"
      sam_account_name: "EXAMPLE\\user"
      distinguished_name: "CN=User Example,OU=Users,DC=example,DC=com"
      private_key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9...\n-----END PRIVATE KEY-----"
      passphrase: "MySecurePassphrase"
      password_fallback_flag: true
      login_account_flag: false
      description: "This is an example managed account"
      password_rule_id: 42
      api_enabled: true
      release_notification_email: "[email protected]"
      change_services_flag: true
      restart_services_flag: false
      change_tasks_flag: true
      release_duration: 180
      max_release_duration: 1440
      isa_release_duration: 120
      max_concurrent_requests: 3
      auto_management_flag: false
      dss_auto_management_flag: false
      check_password_flag: true
      reset_password_on_mismatch_flag: true
      change_password_after_any_release_flag: false
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"
      next_change_date: "2025-10-13"
      use_own_credentials: false
      change_iis_app_pool_flag: true
      restart_iis_app_pool_flag: true
      workgroup_id: 501
      change_windows_auto_logon_flag: false
      change_com_plus_flag: true
      change_dcom_flag: false
      change_scom_flag: false
      object_id: "d27fee10-30b2-46ee-9d61-192c34fb2bfd"

Return values

Module: functional_accounts_create

Short Description

Create Functional Account in Beyondtrust Password Safe API.

Description

Creates a functional account.

Parameters

Details of data object

✅

Example

- name: Create Functional account
  beyondtrust.password_safe.functional_accounts_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      platform_id: 123
      account_name: "my_account"
      domain_name: "example.com"
      display_name: "My Account Display Name"
      password: "SomePasswordValue"
      private_key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9...\n-----END PRIVATE KEY-----"
      passphrase: "MyPassphrase"
      description: "This is an example account description"
      elevation_command: "sudo su -"
      tenant_id: "a3f2c5e8-47b0-4b3f-8e9a-12c456789abc"
      object_id: "d47a9b1e-9f32-4c2e-8a3d-9e1b5f7f1c23"
      secret: "SomeSecretValue"
      service_account_email: "[email protected]"
      azure_instance: "AzurePublic"

Return values

Module: databases_create

Short Description

Create Database in Beyondtrust Password Safe API.

Description

Creates a Database.

Parameters

Details of data object

✅

Example

- name: Create Database
  beyondtrust.password_safe.databases_create:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      asset_id=1
      platform_id=9
      port=1
      instance_name="data base name"
      is_default_instance=false
      version="1.2"
      template=""

Return values

Module: managed_systems_create_by_database_id

Short Description

Create Managed System by Database Id in Beyondtrust Password Safe API.

Description

Creates a Managed System by Database Id.

Parameters

Details of data object

✅

Example

- name: Create Managed System
  beyondtrust.password_safe.managed_systems_create_by_database_id:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      database_id: 2
      contact_email: "[email protected]"
      description: "Test SQL Server"
      timeout: 60
      password_rule_id: 0
      release_duration: 180
      max_release_duration: 1440
      isa_release_duration: 120
      auto_management_flag: false
      functional_account_id: 0
      check_password_flag: true
      change_password_after_any_release_flag: false
      reset_password_on_mismatch_flag: true
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"

Return values

Module: managed_systems_create_by_asset_id

Short Description

Create Managed System by Asset Id in Beyondtrust Password Safe API.

Description

Creates a Managed System by Asset Id.

Parameters

Details of data object

✅

Example

- name: Create Managed System
  beyondtrust.password_safe.managed_systems_create_by_asset_id:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    api_version: "3.0"
    verify_ca: true
    data:
      asset_id: 48
      platform_id: 1
      contact_email: "[email protected]"
      description: "Linux Test Server"
      release_duration: 125
      max_release_duration: 1440
      isa_release_duration: 125
      password_rule_id: 0
      check_password_flag: true
      change_password_after_any_release_flag: false
      reset_password_on_mismatch_flag: true
      change_frequency_type: "xdays"
      change_frequency_days: 30
      change_time: "02:00"
      is_application_host: false
      timeout: 60
      port: 22
      ssh_key_enforcement_mode: 1
      dss_key_rule_id: 0
      login_account_id: 0
      auto_management_flag: false
      functional_account_id: 4
      elevation_command: "sudo"
      remote_client_type: "EPM"
      application_host_id: 3001

Return values

Lookup Plugins

Lookup Plugin: functional_accounts_list

Short Description

Retrieve functional accounts list from Password Safe.

Description

Custom lookup plugin to fetch functional accounts list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    functional_accounts: >-
      {{ lookup('beyondtrust.password_safe.functional_accounts_list',
        api_url=api_url,
        client_id=client_id,
        client_secret=client_secret) }}
  tasks:
    - name: Print functional accounts list
      debug:
        msg: "{{ functional_accounts }}"
    - name: Print test Functional account
      debug:
        msg: "{{ functional_accounts | selectattr('AccountName', 'equalto', 'test') | first }}"

Return values

Lookup Plugin: workgroups_list

Short Description

Retrieve workgroups list from Password Safe.

Description

Custom lookup plugin to fetch workgroups list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    workgroups: "{{ lookup('beyondtrust.password_safe.workgroups_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Workgroups list
      debug:
        msg: "{{ workgroups }}"
    - name: Default Workgroup
      debug:
        msg: "{{ workgroups | selectattr('Name', 'equalto', 'Default Workgroup') | first }}"

Return values

Lookup Plugin: assets_list

Short Description

Retrieve assets list from Password Safe.

Description

Custom lookup plugin to fetch assets list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    assets: "{{ lookup('beyondtrust.password_safe.assets_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Assets list
      debug:
        msg: "{{ assets }}"
    - name: Print MyNewAsset2 Asset
      debug:
        msg: "{{ assets | selectattr('AssetName', 'equalto', 'MyNewAsset2') | first }}"

Return values

Lookup Plugin: managed_accounts_list

Short Description

Retrieve managed accounts list from Password Safe.

Description

Custom lookup plugin to fetch managed accounts list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    managed_accounts: "{{ lookup('beyondtrust.password_safe.managed_accounts_list', api_url=api_url,
      client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Managed Accounts list
      debug:
        msg: "{{ managed_accounts }}"
    - name: Print managed_account01 Managed Account
      debug:
        msg: "{{ managed_accounts | selectattr('AccountDescription', 'equalto', 'managed_account01') | first }}"

Return values

Lookup Plugin: platforms_list

Short Description

Retrieve platforms list from Password Safe.

Description

Custom lookup plugin to fetch platforms list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    platforms: "{{ lookup('beyondtrust.password_safe.folders_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Platforms list
      debug:
        msg: "{{ platforms }}"
    - name: Print XING Platform
      debug:
        msg: "{{ platforms | selectattr('Name', 'equalto', 'XING') | first }}"

Return values

Lookup Plugin: managed_systems_list

Short Description

Retrieve managed systems list from Password Safe.

Description

Custom lookup plugin to fetch managed systems list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    managed_systems: "{{ lookup('beyondtrust.password_safe.managed_systems_list', api_url=api_url,
      client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print Managed Systems list
      debug:
        msg: "{{ managed_systems }}"
    - name: Print system01 Managed System
      debug:
        msg: "{{ managed_systems | selectattr('SystemName', 'equalto', 'system01') | first }}"

Return values

Lookup Plugin: databases_list

Short Description

Retrieve databases list from Password Safe.

Description

Custom lookup plugin to fetch databases list from Password Safe.

Parameters

✅

Example

---
- vars:
    # PASSWORD_SAFE_API_URL, PASSWORD_SAFE_CLIENT_ID and PASSWORD_SAFE_CLIENT_SECRET are environment variables.
    api_url: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_API_URL') }}"
    client_id: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_ID') }}"
    client_secret: "{{ lookup('ansible.builtin.env', 'PASSWORD_SAFE_CLIENT_SECRET') }}"
    databases: "{{ lookup('beyondtrust.password_safe.databases_list', api_url=api_url, client_id=client_id, client_secret=client_secret) }}"
  tasks:
    - name: Print databases list
      debug:
        msg: "{{ databases }}"
    - name: Print test database
      debug:
        msg: "{{ databases | selectattr('InstanceName', 'equalto', 'test') | first }}"

Return values