Ansible Palo Alto LDAP Server Profile

brisonjf — Wed, 05 Jul 2023 14:58:29 GMT

Hello,

I have an Ansible playbook developed to automatically change the password of the account used by Palo Alto to connect to an Active Directory. On the Palo Alto side, Integrated User-ID and an LDAP Server Profile is configured to use this password.

The task to change the Integrated User-ID user works fine:

paloaltonetworks.panos.panos_config_element:
provider: "{{ device }}"

xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/user-id-collector/setting

<wmi-password>MyPassword</wmi-password>

However, the task to change the LDAP password always fails:

paloaltonetworks.panos.panos_config_element:
provider: "{{ device }}"

xpath: /config/shared/server-profile/ldap/entry[@name='ldaptest']

'<bind-password>MyPassword</bind-password>'

The error is : parser.feed(text)\nxml.etree.ElementTree.ParseError: not well-formed (invalid token): line 1, column 6\n"

I also tried with a vsys Server Profile, but the problem is the same.

Hence my questions:

How can I check what is causing the issue? Where is this line 1, column 6\n" coming from ?

Why is Palo Alto reacting differently when trying to change the value of user-id-collector compared to an LDAP Server Profile

For the sake of testing, I tried to make my modification through the API, and it works:

https://<servername>/api/?type=config&action=set&xpath=%2Fconfig%2Fshared%2Fserver-profile%2Fldap%2Fentry%5B%40name%3D%27ldaptest%27%5D&REST_API_TOKEN=xxxxxxxxxx&element=%3Cbind-password%3EMyPassword%3C/bind-password%3E

Thank you in advance.

topic Ansible Palo Alto LDAP Server Profile in Automation/API Discussions

Ansible Palo Alto LDAP Server Profile