Getting started with 1Password for your growing team, or refining your setup? Our Secured Success quickstart guide is for you.
Forum Discussion
brchar
2 years agoNew Contributor
Beg Report: ED25519 SSH Private Keys human-readable value differs from json value
in troubleshooting with the ansible community, we have discovered that ED25519 SSH Keys generated by 1Password have an incorrect value in the private key value field when using "--format json" flag. ...
rmartinsjr
2 years agoNew Contributor
Hi andi_t_1P
I've just spent a lot of hours trying to figure out why my Ansible playbook was not using the right SSH key (and failing) when I came across this bug report.
Now I understand that the lookup plugin "community.general.onepassword" was retrieving the PKCS8 while OP cli was showing the right SSH format. Sadly there's no consistency between the two and adding an insult to injury, there's no way to point out which format the Ansible lookup plugin should use.
I agree with brchar, not only it makes ed25519 adoption difficult by tools such as Ansible, but it is a completely different behavior triggered by the key type! And guess what I had to do to have it working without committing more hours? I "downgraded" the ED25519 key to RSA!
Here are some key points that 1Password team should address:
* Consistency: the Ansible plugin states that it's a wrapper around OP cli, but it shows PKCS8 while OP cli shows OPENSSH format. Either both return PKCS8 or OPENSSH format.
* Compatibility: Ansible lookup plugin should return the OPENSSH format for ED25519, as it is the case for RSA keys.
* Keep the Ansible plugin up to date! It looks like the plugin is "unaware" of this change AND there is no way to retrieve different formats.