{"record":{"id":"c5772b7217207fc2","repo":"semaphoreui/semaphore","slug":"access-key-type-not-supported-for-ansible-become-u","errorCode":null,"errorMessage":"access key type not supported for ansible become user","messagePattern":"access key type not supported for ansible become user","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ssh/agent.go","lineNumber":214,"sourceCode":"\tswitch usage {\n\tcase db.AccessKeyRoleGit:\n\t\tswitch key.Type {\n\t\tcase db.AccessKeySSH:\n\t\t\tvar agent Agent\n\t\t\tagent, err = StartSSHAgent(key, logger)\n\t\t\tinstallation.SSHAgent = &agent\n\t\t\tinstallation.Login = key.SshKey.Login\n\t\t}\n\tcase db.AccessKeyRoleAnsiblePasswordVault:\n\t\tswitch key.Type {\n\t\tcase db.AccessKeyLoginPassword:\n\t\t\tinstallation.Password = key.LoginPassword.Password\n\t\tdefault:\n\t\t\terr = fmt.Errorf(\"access key type not supported for ansible password vault\")\n\t\t}\n\tcase db.AccessKeyRoleAnsibleBecomeUser:\n\t\tif key.Type != db.AccessKeyLoginPassword {\n\t\t\terr = fmt.Errorf(\"access key type not supported for ansible become user\")\n\t\t}\n\t\tinstallation.Login = key.LoginPassword.Login\n\t\tinstallation.Password = key.LoginPassword.Password\n\tcase db.AccessKeyRoleAnsibleUser:\n\t\tswitch key.Type {\n\t\tcase db.AccessKeySSH:\n\t\t\tvar agent Agent\n\t\t\tagent, err = StartSSHAgent(key, logger)\n\t\t\tinstallation.SSHAgent = &agent\n\t\t\tinstallation.Login = key.SshKey.Login\n\t\tcase db.AccessKeyLoginPassword:\n\t\t\tinstallation.Login = key.LoginPassword.Login\n\t\t\tinstallation.Password = key.LoginPassword.Password\n\t\tcase db.AccessKeyNone:\n\t\t\t// No SSH agent or password needed for ansible user with no access key.\n\t\tdefault:\n\t\t\terr = fmt.Errorf(\"access key type not supported for ansible user\")\n\t\t}","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/pkg/ssh/agent.go#L196-L232","documentation":"Returned by KeyInstaller.Install in pkg/jwt/... more precisely pkg/ssh/agent.go when an access key used for the Ansible become-user role has a type other than db.AccessKeyLoginPassword. A simple inequality guard rejects the combination: the become (sudo/su) flow needs a plaintext login and password, so an SSH key or other credential type cannot fulfil this role.","triggerScenarios":"Thrown at pkg/ssh/agent.go:214 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a login/password access key for the become-user slot in the environment configuration","Store the privilege-escalation account as a LoginPassword access key and select it for the become role","Surface this error to the user in the environment editor so the wrong key type is fixed before a run is scheduled"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}