In my previous post from 2021, I shared a custom Ansible module (run_vro_wf) designed to trigger VMware vRealize Orchestrator (vRO) workflows directly from Ansible Tower / AAP.
Since infrastructure environments evolve, I’ve updated the module to support both vRA 8 authentication flows as well as VCF 9 Automation authentication with tenant / organization support.
What’s New in this Update?
- Dual Authentication Support (vRA 8 & VCF 9):
- The script automatically attempts authentication against vRA 8 endpoints first.
- If that fails (or when running against VCF 9 architecture), it falls back to old vCD CloudAPI sessions using Basic Auth encoded as username@tenant:password to retrieve the x-vmware-vcloud-access-token. (Note: LDAP authentication was tested; OIDC flow was not evaluated in this build).
- New tenant Parameter:
- A required
tenantparameter has been added to specify the tenant or VCD Organization name.
- A required
- Array Input Support:
- Improved parameter building to support both strings and lists (Array/string).
How Authentication Works Under the Hood
The key enhancement in this release is the fallback login mechanism. The module tries vRA 8 authentication first, and if an exception occurs, it seamlessly switches to VCF 9 / vCD CloudAPI session authentication.
def login(server, user, password, tenant, validate_cert):
try:
# Try vRA 8 CSP/IaaS authentication flow first
return get_auth_token_vra8(server, user, password, validate_cert)
except Exception:
# Fallback to VCF 9 / vCD CloudAPI session authentication
return get_auth_token_v9(server, user, password, tenant, validate_cert)
VCF 9 / vCD Session Token Retrieval Snippet
For VCF 9 environment, credentials are formatted as username@tenant:password and base64-encoded to request a session token from /cloudapi/1.0.0/sessions:
def get_auth_token_v9(server, user, password, tenant, validate_cert):
credentials = "{}@{}:{}".format(user, tenant, password)
credentials_base64 = base64.b64encode(credentials.encode("utf-8")).decode("utf-8")
headers = {
"Accept": "application/*;version=40.0",
"Authorization": "Basic " + credentials_base64
}
url = server + "/cloudapi/1.0.0/sessions"
r = open_url(url, method="POST", headers=headers, validate_certs=validate_cert)
token = r.headers.get("x-vmware-vcloud-access-token")
if not token:
raise Exception("x-vmware-vcloud-access-token header not found")
return token
Example Ansible Playbook
Below is an updated Ansible playbook showing how to invoke the module with the new tenant parameter:
---
- hosts: localhost
gather_facts: false
tasks:
- name: Run Test vRO Workflow with input
run_vro_wf:
vro_server: "https://your_automation_server.domain.local"
username: "your_username"
password: "your_password"
tenant: "your_tenant_name"
workflow_id: "c8f47d23-7e34-4056-8a78-2896e68e2334"
input_values:
input1: "value1"
input2: "value2"
input3: "value3"
register: result
- name: Output result
debug:
msg: "{{ result }}"
Download Module File
The full python module code is attached to this post / available in the repository download section.
Download it, place it into your Ansible project’s library folder, and you are ready to go!