fix #380

functional-test/src/test/groovy/functional/BasicIntegrationSpec.groovy

@@ -306,4 +306,32 @@ class BasicIntegrationSpec extends BaseTestConfiguration {
         logs.findAll {it.log.contains("\"token\": 13231232312321321321321")}.size() == 1
     }
 
+    def "test use encrypted user file with multiline password file"(){
+        when:
+
+        def jobId = "198b7deb-2ba2-4ac6-a80e-94f06ab7fb62"
+
+        JobRun request = new JobRun()
+        request.loglevel = 'INFO'
+
+        def result = client.apiCall {api-> api.runJob(jobId, request)}
+        def executionId = result.id
+
+        def executionState = waitForJob(executionId)
+
+        def logs = getLogs(executionId)
+        Map<String, Integer> ansibleNodeExecutionStatus = TestUtil.getAnsibleNodeResult(logs)
+
+        then:
+        executionState!=null
+        executionState.getExecutionState()=="SUCCEEDED"
+        ansibleNodeExecutionStatus.get("ok")!=0
+        ansibleNodeExecutionStatus.get("unreachable")==0
+        ansibleNodeExecutionStatus.get("failed")==0
+        ansibleNodeExecutionStatus.get("skipped")==0
+        ansibleNodeExecutionStatus.get("ignored")==0
+        logs.findAll {it.log.contains("\"environmentTest\": \"someOtherTest\"")}.size() == 1
+        logs.findAll {it.log.contains("\"token\": \"someOtherToken\"")}.size() == 1
+    }
+
 }

functional-test/src/test/groovy/functional/base/BaseTestConfiguration.groovy

@@ -23,6 +23,7 @@ class BaseTestConfiguration extends Specification{
     public static final String NODE_KEY_PASSPHRASE = "testpassphrase123"
     public static final String USER_VAULT_PASSWORD = "vault123"
     public static final String ENCRYPTED_INVENTORY_VAULT_PASSWORD = "123456"
+    public static final String USER_VAULT_PASSWORD_FILE_MULTILINE = "multiline\npassword\n"
 
     def startCompose() {
         if(rundeckEnvironment==null){
@@ -107,6 +108,10 @@ class BaseTestConfiguration extends Specification{
         requestBody = RequestBody.create(USER_VAULT_PASSWORD.getBytes(), Client.MEDIA_TYPE_X_RUNDECK_PASSWORD)
         keyResult = client.apiCall {api-> api.createKeyStorage("project/$projectName/vault-user.pass", requestBody)}
 
+        //user vault password
+        requestBody = RequestBody.create(USER_VAULT_PASSWORD_FILE_MULTILINE.getBytes(), Client.MEDIA_TYPE_X_RUNDECK_PASSWORD)
+        keyResult = client.apiCall {api-> api.createKeyStorage("project/$projectName/vault-multiline.pass", requestBody)}
+
         //add encrypted inventory password
         requestBody = RequestBody.create(ENCRYPTED_INVENTORY_VAULT_PASSWORD.getBytes(), Client.MEDIA_TYPE_X_RUNDECK_PASSWORD)
         keyResult = client.apiCall {api-> api.createKeyStorage("project/$projectName/vault-inventory.password", requestBody)}

functional-test/src/test/resources/docker/ansible/user-encrypted-env-vars-multiline-password.yaml

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+39616539663235646532393064306563383930626134643465386664646566616534346366386537
+6361326636333761396565613233356635313465646530390a616332663532653731316263366566
+64383064383736383261646434666330343934313534393062353366613730353865303338613662
+3066623366643033390a356165393935636231346239646562313062663532326461333139656439
+37343636373162643164386663623563346230363830663864313435383561343036333662613131
+30306534336463623266333933393730643838386137376265323565346261346565353031616531
+64663665616430626631363666363834313765623833323830643537633162376632363931356161
+34333966623833396434366531666431626634373530396366356434303764383839353934663833
+6333

functional-test/src/test/resources/project-import/ansible-test/rundeck-ansible-test/jobs/job-198b7deb-2ba2-4ac6-a80e-94f06ab7fb62.xml

@@ -0,0 +1,45 @@
+<joblist>
+  <job>
+    <defaultTab>nodes</defaultTab>
+    <description></description>
+    <dispatch>
+      <excludePrecedence>true</excludePrecedence>
+      <keepgoing>false</keepgoing>
+      <rankOrder>ascending</rankOrder>
+      <successOnEmptyNodeFilter>false</successOnEmptyNodeFilter>
+      <threadcount>1</threadcount>
+    </dispatch>
+    <executionEnabled>true</executionEnabled>
+    <group>Ansible</group>
+    <id>198b7deb-2ba2-4ac6-a80e-94f06ab7fb62</id>
+    <loglevel>INFO</loglevel>
+    <name>simple-inline-playbook-user-encryption-multiline-password</name>
+    <nodeFilterEditable>false</nodeFilterEditable>
+    <nodefilters>
+      <filter>name: ssh-node </filter>
+    </nodefilters>
+    <nodesSelectedByDefault>true</nodesSelectedByDefault>
+    <plugins />
+    <scheduleEnabled>true</scheduleEnabled>
+    <sequence keepgoing='false' strategy='node-first'>
+      <command>
+        <node-step-plugin type='com.batix.rundeck.plugins.AnsiblePlaybookInlineWorkflowNodeStep'>
+          <configuration>
+            <entry key='ansible-base-dir-path' value='/home/rundeck/ansible' />
+            <entry key='ansible-become' value='false' />
+            <entry key='ansible-encrypt-extra-vars' value='false' />
+            <entry key='ansible-extra-param' value='--extra-vars=@/home/rundeck/ansible/user-encrypted-env-vars-multiline-password.yaml' />
+            <entry key='ansible-playbook-inline' value='- hosts: all&#10;  gather_facts: false&#10;  tasks:&#10;&#10;    - name: Hello World!&#10;      debug:&#10;        msg: "Hello World!"&#10;    - name: Get Disk Space&#10;      shell: "df -h"&#10;      register: sh_output&#10;      &#10;    - debug: msg={{hostvars[inventory_hostname]}}&#10;    - debug: var=sh_output.stdout_lines&#10;' />
+            <entry key='ansible-ssh-auth-type' value='privateKey' />
+            <entry key='ansible-ssh-key-storage-path' value='keys/project/ansible-test/ssh-node.key' />
+            <entry key='ansible-ssh-passphrase-option' value='option.password' />
+            <entry key='ansible-ssh-use-agent' value='false' />
+            <entry key='ansible-ssh-user' value='rundeck' />
+            <entry key='ansible-vault-storage-path' value='keys/project/ansible-test/vault-multiline.pass' />
+          </configuration>
+        </node-step-plugin>
+      </command>
+    </sequence>
+    <uuid>198b7deb-2ba2-4ac6-a80e-94f06ab7fb62</uuid>
+  </job>
+</joblist>

src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleRunner.java

@@ -537,7 +537,7 @@ public int run() throws Exception {
             if (useAnsibleVault) {
                 VaultPrompt vaultPrompt = VaultPrompt.builder()
                         .vaultId("internal-encrypt")
-                        .vaultPassword(ansibleVault.getMasterPassword() + "\n")
+                        .vaultPassword(ansibleVault.getMasterPassword())
                         .build();
 
                 stdinVariables.add(vaultPrompt);
@@ -552,7 +552,7 @@ public int run() throws Exception {
             if (vaultPass != null && !vaultPass.isEmpty()) {
                 VaultPrompt vaultPrompt = VaultPrompt.builder()
                         .vaultId("None")
-                        .vaultPassword(vaultPass + "\n")
+                        .vaultPassword(vaultPass)
                         .build();
 
                 stdinVariables.add(vaultPrompt);

src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleResourceModelSource.java

@@ -731,7 +731,7 @@ public String getNodesFromInventory(AnsibleRunner.AnsibleRunnerBuilder runnerBui
     if(runner.getVaultPass() != null){
       VaultPrompt vaultPrompt = VaultPrompt.builder()
               .vaultId("None")
-              .vaultPassword(runner.getVaultPass() + "\n")
+              .vaultPassword(runner.getVaultPass())
               .build();
       ansibleInventoryListBuilder.vaultPrompt(vaultPrompt);
     }

src/main/groovy/com/rundeck/plugins/ansible/util/ProcessExecutor.java

@@ -69,6 +69,7 @@ private void processPrompt(OutputStreamWriter stdinw, final VaultPrompt vaultPro
             Thread stdinThread = new Thread(() -> {
                 try {
                     stdinw.write(vaultPrompt.getVaultPassword());
+                    stdinw.write(3); // end of text
                     stdinw.flush();
                 } catch (IOException e) {
                     throw new RuntimeException(e);

src/main/resources/vault-client.py

@@ -32,7 +32,12 @@
 if sys.stdin.isatty():
     secret = getpass.getpass()
 else:
-    secret = sys.stdin.readline().rstrip()
+    secret = ''
+    while 1:
+        c = sys.stdin.read(1)
+        if c == chr(3) or len(c) == 0: # end of text or nothing read
+            break
+        secret = secret + c
 
 if secret is None:
     sys.stderr.write('ERROR: secret is not set\n')