title: In Ansible, is it possible to define the authentication method per playbook?
body: <p>TL;DR: Is it possible to chain two playbooks with one ansible-playbook command where one playbook is password auth and the other playbook is key auth? (see last section for real-world purpose).</p>
  
  <h1>Setup:</h1>
  
  <p>I have two playbooks, the second of which <code>include</code>s the first.</p>
  
  <h3>PlaybookA.yml</h3>
  
  <pre><code>---
  - name: PlaybookA # requires password authentication
    hosts: sub.domain.ext
    remote_user: root
    roles:
      - { role: role1, sudo: yes }
  ...
  </code></pre>
  
  <h3>PlaybookB.yml</h3>
  
  <pre><code>---
  - name: Run PlaybookA
    include: PlaybookA.yml
  
  - name: PlaybookB # requires ssh-key authentication
    hosts: sub.domain.ext
    remote_user: ansible
    roles:
      - { role: role2, sudo: yes }
  ...
  </code></pre>
  
  <h1>Requirements:</h1>
  
  <ol>
  <li>Execute only one command.</li>
  <li>Use password auth for PlaybookA.</li>
  <li>Use ssh-key auth for PlaybookB.</li>
  </ol>
  
  <h1>Question 1:</h1>
  
  <p>Is it possible within Ansible (versions 1.9.4 or lower) to execute one ansible-playbook command that will successfully run PlaybookB using ssh-key authentication but when PlaybookB includes PlaybookA, run PlaybookA using password authentication?</p>
  
  <h1>Question 2:</h1>
  
  <p>If this is not possible with Ansible 1.9.4 or lower, is this possible with 2.0.0+?</p>
  
  <h1>Notes of worth:</h1>
  
  <ol>
  <li>Ansible provides <code>--ask-pass</code> (or <code>-k</code>) as a command line switch enabling password authentication.</li>
  <li>Ansible provides <code>ask_pass</code> as a variable but it seems as though it can only be set within <code>ansible.cfg</code> (I haven't been able to set this as a playbook variable to the desired effect).</li>
  <li>Attempting to set <code>ask_pass</code> as an instruction within a playbook results in the following: <code>ERROR: ask_pass is not a legal parameter of an Ansible Play</code>. If this parameter was legal, it would provide a way to instruct ansible on a per-playbook level, what authentication method to use.</li>
  </ol>
  
  <h1>Purpose / Real World:</h1>
  
  <p>I'm attempting to create a configuration management workflow with Ansible that will be simple enough that others at work will be able to learn / adapt to it (and hopefully the use of Ansible in general for CM and orchestration).</p>
  
  <p>For any new machine (VM or physical) that gets built, I intend for us to run two playbooks immediately. PlaybookA (as shown above) has the responsibility of logging in with the correct default user (typically depends upon the infrastructure [aws, vsphere, none, etc]). Once in, its very limited job is to:</p>
  
  <ol>
  <li>Create the standardized user for ansible to run as (and install its ssh-key).</li>
  <li>Remove any non-root users that may exist (artifacts of the vm infrastructure, etc).</li>
  <li>Disable root access.</li>
  <li>Disable password authentication (ssh-key only from this point on).</li>
  </ol>
  
  <p>Depending upon the vm infrastructure (or lack thereof), the default user or the default authentication method can be different. Toward the goal of adoption of Ansible, I'm attempting to keep things extremely simple for fellow co-workers, so I'd like to automate as much of this flow-control as possible.</p>
  
  <p>Once PlaybookA has locked down the vm and setup the standardized user, PlaybookB uses that standardized user to perform all other operations necessary to bring our vm's up to the necessary baseline of tools and utilities, etc.</p>
  
  <p>Any tips, hints, suggestions would be greatly appreciated.</p>