pan.xapi.PanXapiError: edit failed, may need to override template object admin first

PranayBomma — Sat, 18 May 2019 17:23:31 GMT

TASK [Set admin password] *******************************************************************************************************************************
task path: /export/home/mmap/Myfirstyml.yml:25
<10.60.128.4> ESTABLISH LOCAL CONNECTION FOR USER: admin
<10.60.128.4> EXEC /bin/sh -c 'echo ~bommap && sleep 0'
<10.60.128.4> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /export/home/mmap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262 `" && echo ansible-tmp-1558199922.89-98462149531262="` echo /export/home/mmap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262 `" ) && sleep 0'
Using module file /export/home/bommap/.ansible/roles/PaloAltoNetworks.paloaltonetworks/library/panos_admin.py
<10.60.128.4> PUT /export/home/bommap/.ansible/tmp/ansible-local-202982VBlgd/tmpMU29RX TO /export/home/bommap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262/panos_admin.py
<10.60.128.4> EXEC /bin/sh -c 'chmod u+x /export/home/bommap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262/ /export/home/bommap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262/panos_admin.py && sleep 0'
<10.60.128.4> EXEC /bin/sh -c '/usr/bin/python /export/home/bommap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262/panos_admin.py && sleep 0'
<10.60.128.4> EXEC /bin/sh -c 'rm -f -r /export/home/bommap/.ansible/tmp/ansible-tmp-1558199922.89-98462149531262/ > /dev/null 2>&1 && sleep 0'
The full traceback is:
Traceback (most recent call last):
File "/tmp/ansible_p5pHzT/ansible_module_panos_admin.py", line 214, in <module>
main()
File "/tmp/ansible_p5pHzT/ansible_module_panos_admin.py", line 205, in main
changed = admin_set(xapi, module, admin_username, admin_password, role)
File "/tmp/ansible_p5pHzT/ansible_module_panos_admin.py", line 147, in admin_set
element='<phash>%s</phash>' % phash)
File "/export/home/bommap/.local/lib/python2.7/site-packages/pan/xapi.py", line 749, in edit
self.__type_config('edit', query, extra_qs)
File "/export/home/bommap/.local/lib/python2.7/site-packages/pan/xapi.py", line 805, in __type_config
raise PanXapiError(self.status_detail)
pan.xapi.PanXapiError: edit failed, may need to override template object admin first

fatal: [10.60.128.4]: FAILED! => {
"changed": false,
"module_stderr": "Traceback (most recent call last):\n File \"/tmp/ansible_p5pHzT/ansible_module_panos_admin.py\", line 214, in <module>\n main()\n File \"/tmp/ansible_p5pHzT/ansible_module_panos_admin.py\", line 205, in main\n changed = admin_set(xapi, module, admin_username, admin_password, role)\n File \"/tmp/ansible_p5pHzT/ansible_module_panos_admin.py\", line 147, in admin_set\n element='<phash>%s</phash>' % phash)\n File \"/export/home/bommap/.local/lib/python2.7/site-packages/pan/xapi.py\", line 749, in edit\n self.__type_config('edit', query, extra_qs)\n File \"/export/home/bommap/.local/lib/python2.7/site-packages/pan/xapi.py\", line 805, in __type_config\n raise PanXapiError(self.status_detail)\npan.xapi.PanXapiError: edit failed, may need to override template object admin first\n",
"module_stdout": "",
"msg": "MODULE FAILURE",
"rc": 1

Re: pan.xapi.PanXapiError: edit failed, may need to override template object admin first

gfreeman — Mon, 20 May 2019 16:08:14 GMT

Based on the file path in that output, I see that you're using the PaloAltoNetworks.paloaltonetworks Ansible Galaxy role, which is good. I also see that you're trying to use panos_admin. However, I don't see the deprecation warning for that module, which means that you're not using the latest version of the role.

The panos_admin module is capable of performing SET commands only, and if the user is alrerady defined, this can lead to problems if the admin's permissions are different from what panos_admin would otherwise try to configure. It is recommended to use panos_administrator instead, which has expanded support for the full range of administrator permissions available to both firewall and Panorama.

topic pan.xapi.PanXapiError: edit failed, may need to override template object admin first in Automation/API Discussions

pan.xapi.PanXapiError: edit failed, may need to override template object admin first

Re: pan.xapi.PanXapiError: edit failed, may need to override template object admin first