fetch_secrets does not return server entries

[automate-this]

I am using the latest module version 1.2.1 in AWX.

secrets:
  - secret_id: 3896b201-dd79-47c8-bf19-7c95979f008c

- name: Get SSH Key from DVLS
  hosts: localhost
  gather_facts: false
  tasks:
    - name: Fetch secrets
      devolutions.dvls.fetch_secrets:
        server_base_url: "https://my-dps-server/dps"
        app_key: "{{ ansible_user }}"
        app_secret: "{{ ansible_password }}"
        vault_id: "00000000-0000-0000-0000-000000000000"
        secrets: "{{ secrets }}"
      register: value

    - name: Dump secrets
      debug:
        msg: "{{ value }}"

The secret id specified is an SSH Server entry from which I need to retrieve the SSH private key. But it returns nothing.

Output:

msg:
  3896b201-dd79-47c8-bf19-7c95979f008c: {}
  failed: false
  changed: false
_ansible_verbose_always: true
_ansible_no_log: false
changed: false

When I fetch all secrets from DVLS and dump them, it seems that only credential and api key entries are returned.

[DannyBedard]

Hello, thank you for your engagement and feedback on this module.

Just so you know, we only support these credential types for the moment:

SubType = "AccessCode"
SubType = "ApiKey"
SubType = "AzureServicePrincipal"
SubType = "ConnectionString"
SubType = "Passkey"
SubType = "PrivateKey"
SubType = "Default"

So if you are trying to fetch an IT Asset or an SSH terminal, it will return an empty object. It might be a good idea to handle it properly; we'll look into it.

But if you are trying with a Credential entry - SSH key, we can look into it. I've reproduced your bug locally and was able to retrieve my SSH key. Let's walk through the solution:

1 - I am not seeing a declared file variable for your secrets.yml. Maybe you declared it earlier in your script:

1 - I am not seeing a declared file variable for your secrets.yml, maybe you declared it earlier in your script

  vars_files:
    - secrets.yml

And then use it like this: "{{ secrets }}"

2 - The same applies to your credentials, but I'm assuming they're correct since you can get other types of secrets.

3 - Check if you have permission to read or view the password for the requested SSH key.

[automate-this]

You are correct. The entry is an SSH Terminal Entry. As a workaround for testing I created an "SSH Private Key" entry. That worked. I was able to get the privatekey data and the passphrase.

So this is not a bug but more of a feature request.
Getting the SSH Terminal or RDP entry would be great, because this way I could use the awx inventory hostname to search dynamically in DVLS.

May I also suggest adding a awx credential lookup type, that grabs credentials from DVLS on demand?
Like these https://docs.ansible.com/ansible-tower/3.5.0/html/administration/credential_plugins.html

AWX/ Ansible Tower provides a developer interface for that.

[DannyBedard]

Thank you for your suggestion. We will evaluate whether it aligns with the objectives of this module and explore what capabilities DVLS can offer. We appreciate your suggestion and will be in touch once we have further information.