If you need a one liner that works with any yaml file (not only in inventory) containing inlined vault vars, and if you are ready to install a pip package for that, there is a solution using yq, a yaml processor built on top of jq

prerequesite: Install yq

pip install yq

Usage

You can get your result with the following command:

yq .ldapconfig inventory/group_vars/env1 | ansible_vault decrypt

If you need to type your vault pass interactively, don't forget to add the relevant option

yq .ldapconfig inventory/group_vars/env1 | ansible_vault --ask-vault-pass decrypt

We can use an Ansible adhoc command to retrieve the variable of interest, ldap_config. To start we're going to use this adhoc to retrieve the Ansible encrypted vault string:

$ ansible -i "localhost," all               \
    -m debug                                \
    -a 'msg="{{ ldap_config }}"'            \
    --vault-password-file=~/.vault_pass.txt \
    -e@inventory/group_vars/env1
localhost | SUCCESS => {
    "msg": "ABCD......."

Make note that we're:

• using the debug module and having it print the variable, msg={{ ldap_config }}
• giving ansible the path to the secret to decrypt encrypted strings
• using the notation -e@< ...path to file...> to pass the file with the encrypted vault variables

Now we can use Jinja2 filters to do the rest of the parsing:

$ ansible -i "localhost," all                             \
     -m debug                                             \
     -a 'msg="{{ ldap_config | b64decode | from_yaml }}"' \
     --vault-password-file=~/.vault_pass.txt              \
     -e@inventory/group_vars/env1
localhost | SUCCESS => {
    "msg": {
        "apiVersion": "v1",
        "bindDN": "uid=readonly,cn=users,cn=accounts,dc=mydom,dc=com",
        "bindPassword": "my secret password to ldap",
        "ca": "",
        "insecure": true,
        "kind": "LDAPSyncConfig",
        "rfc2307": {
            "groupMembershipAttributes": [
                "member"
            ],
            "groupNameAttributes": [
                "cn"
            ],
            "groupUIDAttribute": "dn",
            "groupsQuery": {
                "baseDN": "cn=groups,cn=accounts,dc=mydom,dc=com",
                "derefAliases": "never",
                "filter": "(objectclass=groupOfNames)",
                "scope": "sub"
            },
            "tolerateMemberNotFoundErrors": false,
            "tolerateMemberOutOfScopeErrors": false,
            "userNameAttributes": [
                "uid"
            ],
            "userUIDAttribute": "dn",
            "usersQuery": {
                "baseDN": "cn=users,cn=accounts,dc=mydom,dc=com",
                "derefAliases": "never",
                "scope": "sub"
            }
        },
        "url": "ldap://192.168.1.10:389"
    }
}

NOTE: The above section -a 'msg="{{ ldap_config | b64decode | from_yaml }}" is what's doing the heavy lifting in terms of converting from Base64 to YAML.

References

• How to run Ansible without hosts file
• https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#filters-for-formatting-data
• Base64 Decode String in jinja
• How to decrypt string with ansible-vault 2.3.0