What causes "Password is required for {method} privilege switching" in jumpserver/jumpserver?

Provide the privilege password via the module's password/become parameter (e.g. from ansible_become_password or a vaulted var).

jumpserver/jumpserver · error · RuntimeError

Password is required for {method} privilege switching

Error message

Password is required for {method} privilege switching

What it means

Raised inside _switch_network_privilege (via switch_user) when the device displayed a privilege-switch password prompt (su/enable) but no password was configured. The client detects the prompt and requires credentials to proceed.

Source

Thrown at apps/libs/ansible/modules_utils/remote_client.py:539

        self._debug(
            'privilege.network.start',
            method=method,
            command=switch_cmd,
        )
        self._check_send(channel)
        self._send_command(channel, switch_cmd)
        switch_output = self._get_match_recv(
            su_prompt_re,
            allow_quiet=True,
            quiet_period=max(1.0, float(self.delay_time)),
        )
        prompt_seen = self.__match(su_prompt_re, switch_output)
        result_output = switch_output

        if prompt_seen:
            if password is None or str(password) == '':
                raise RuntimeError(
                    f'Password is required for {method} privilege switching'
                )
            password = str(password)
            if '\r' in password or '\n' in password:
                raise ValueError(
                    'The privilege password cannot contain a line break'
                )
            self._check_send(channel)
            self._send_command(channel, password)
            # The privileged prompt often differs from the login prompt
            # (`>` becomes `#`), so allow quiet completion here.
            password_output = self._get_match_recv(allow_quiet=True)
            result_output += '\n' + password_output
            if (
                self.__match(su_prompt_re, password_output)
                or network_auth_failure_re.search(password_output)
            ):
                raise BecomeAuthenticationError(

View on GitHub (pinned to 6ec464fabd)

Solutions

Provide the privilege password via the module's password/become parameter (e.g. from ansible_become_password or a vaulted var).
If the device should not prompt, verify the enable/su configuration (e.g. 'enable secret' vs no password) and the become method chosen.
Confirm the correct become method is selected so an unexpected prompt isn't misinterpreted.

Example fix

# before
- name: run module
  my_module:
    become_method: enable
# after
- name: run module
  my_module:
    become_method: enable
    become_password: "{{ vault_enable_password }}"

Defensive patterns

Strategy: validation

Validate before calling

if become and not (module.params.get('login_password') or module.params.get('become_password')):
    module.fail_json(msg='Privilege switching requires a password on this device')

Prevention

Test enable/su interactively to learn whether a password is prompted.
Vault the privilege password and pass it explicitly.
Don't assume key-based login removes the need for an enable password.

When it happens

Trigger: Calling the module with become/enable switching on a network device where the device prompts for a password and login_password (or the become password param) is None or empty string.

Common situations: Assuming NOPASSWD/enable-without-password on a device that actually requires one; keys used for login so login_password was never set; become password stored in a vault variable that rendered empty.

Related errors

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/d8d859fb1c205ec4. Report an issue: GitHub.