Access management and authentication

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.

3. Enter a unique Name for the authenticator. The name is required, must be unique across all authenticators, and must not be longer than 512 characters. This becomes the unique identifier generated for the authenticator.

   Note

   Changing the name does not update the unique identifier of the authenticator. For example, if you create an authenticator with the name My Authenticator and later change it to My LDAP Authenticator you will not be able to create another authenticator with the name My Authenticator because the unique identifier is still in use.

4. Select the authenticator type from the Authentication type list. See Configuring an authentication type for the complete list of authentication plugins available.

5. The Authentication details section automatically updates to show the fields relevant to the selected authentication type. See the relevant sections in Configuring an authentication type for the required details.

   For all authentication types you can enter a Name, Additional Authenticator Fields and Create Objects.

6. Enable or disable Enabled to specify if the authenticator should be enabled or disabled. If enabled, users are able to login from the authenticator. If disabled, users will not be allowed to login from the authenticator.

7. Enable or disable Create Object to specify whether the authenticator should create teams and organizations in the system when a user logs in.

   Enabled

   Teams and organizations defined in the authenticator maps are created and the users added to them.

   Disabled

   Organizations and teams defined in the authenticator maps will not be created automatically in the system. However, if they already exist, for example, created by a superuser, users who trigger the maps are granted access to them.

8. Enable or disable Remove Users. If enabled, any access previously granted to a user is removed when they authenticate from this source. If disabled, permissions are only added or removed from the user based on the results of this authenticator’s authenticator mappings.

   For example, assume a user has been granted the is_superuser permission in the system. And that user will log in to an authenticator whose maps will not formulate an opinion as to whether or not the user should be a superuser. If Remove Users is enabled, the is_superuser permission will be removed from the user, the authenticator maps will not have an opinion as to whether it should be there or not so, after login the user will not have the is_superuser permission.

   If Remove Users is disabled, the is_superuser permission will not be removed from the user. The authenticator maps will not have an opinion as to whether it should be there or not so after login the user will have the is_superuser permission.

9. Click Create Authentication Method and proceed to Define authentication mapping rules and triggers.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. In the list view, select the authenticator name displayed in the Name column.
3. Select the Mapping tab from the Details page of your authenticator.
4. Click Create mapping.

5. Select a map type from the Authentication mapping list. See Authenticator map types for detailed descriptions of the different map types. Choices include:

   • Allow
   • Organization
   • Team
   • Role
   • Is Superuser
6. Enter a unique rule Name to identify the rule.

7. Select a Trigger from the list. See Authenticator map triggers for more details. Choices include:

   • Always
   • Never
   • Group
   • Attribute
8. Click Create mapping.
9. Repeat this procedure to create additional mapping rules and triggers for the authenticator.

10. Proceed to Adjust the Mapping order to optionally reorder the mappings for your authenticator.

    Note

    The mapping order setting is only available if there is more than one authenticator map defined.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. In the list view, select the authenticator name displayed in the Name column.
3. Select the Mapping tab from the Details page of your authenticator.
4. Click Manage mappings.

5. Adjust the mapping order by dragging and dropping the mappings up or down in the list using the icon.

   Note

   The mapping precedence is determined by the order in which the mappings are listed.

6. After your authenticator maps are in the correct order, click Apply.

Procedure

1. Go to your authenticator’s configuration details within the Ansible Automation Platform UI to locate the callback_url.

   For more information, see Displaying authenticator details.

2. Identify and copy the auto-generated Callback URL, Redirect URL, or Reply URL that Ansible Automation Platform provides for your specific authentication method.
3. Update your IdP’s configuration by pasting the copied redirect URL from Ansible Automation Platform into your IdP’s configuration where necessary.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this Local configuration. The configuration name is required, must be unique across all authenticators, and must not be longer than 512 characters.
4. Select Local from the Authentication type list.

5. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

6. To automatically create organizations, users, and teams upon successful login, select Create objects.
7. To enable this authentication method upon creation, select Enabled.
8. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
9. Click Next.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select LDAP from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.
5. In the LDAP Server URI field, enter or modify the list of LDAP servers to which you want to connect. This field supports multiple addresses.

6. In the LDAP Bind DN text field, enter the Distinguished Name (DN) to specify the user that the Ansible Automation Platform uses to connect to the LDAP server as shown in the following example:

   cn=josie,cn=users,dc=website,dc=com

7. In the LDAP Bind Password text field, enter the password to use for the binding user.

8. Select a group type from the LDAP Group Type list.

   The group type defines the class name of the group, which manages the groups associated with users in your LDAP directory and is returned by the search specified in Step 14 of this procedure. The group type, along with group parameters and the group search, is used to find and assign groups to users during log in, and can also be evaluated during the mapping process. The following table lists the available group types, along with their descriptions and the necessary parameters for each. By default, LDAP groups will be mapped to Django groups by taking the first value of the cn attribute. You can specify a different attribute with name_attr. For example, name_attr='cn'.

   Expand

   Table 2.1. Available LDAP group types

   LDAP Group Type	Description	Initializer method (init)
   PosixGroupType	Handles the posixGroup object class. This checks for both primary group and group membership.	name_attr='cn'
   MemberDNGroupType	Handles the grouping mechanisms wherein the group object contains a list of its member DNs.	member_attr, name_attr='cn'
   GroupOfNamesType	Handles the groupOfNames object class. Equivalent to MemberDNGroupType('member').	name_attr='cn'
   GroupOfUniqueNamesType	Handles the groupOfUniqueNames object class. Equivalent to MemberDNGroupType('uniqueMember').	name_attr='cn'
   ActiveDirectoryGroupType	Handles the Active Directory groups. Equivalent to MemberDNGroupType('member').	name_attr='cn'
   OrganizationalRoleGroupType	Handles the organizationalRole object class. Equivalent to MemberDNGroupType('roleOccupant').	name_attr='cn'
   NestedGroupOfNamesType	Handles the groupOfNames object class. Equivalent to NestedMemberDNGroupType('member').	member_attr, name_attr='cn'
   NestedGroupOfUniqueNamesType	Handles the groupOfUniqueNames object class. Equivalent to NestedMemberDNGroupType('uniqueMember').	name_attr='cn'
   NestedActiveDirectoryGroupType	Handles the Active Directory groups. Equivalent to NestedMemberDNGroupType('member').	name_attr='cn'
   NestedOrganizationalRoleGroupType	Handles the organizationalRole object class. Equivalent to NestedMemberDNGroupType('roleOccupant').	name_attr='cn'

   Show more
   Note

   The group types that are supported by Ansible Automation Platform use the underlying django-auth-ldap library. To specify the parameters for the selected group type, see Step 14 of this procedure.

9. You can use LDAP User DN Template as an alternative to user search. This approach is more efficient for user lookups than searching if it is usable in your organizational environment. Enter the name of the template as shown in the following example:

   uid=%(user)s,cn=users,cn=accounts,dc=example,dc=com

   where: uid is the user identifier, cn is the common name and dc is the domain component.

   Note

   If this setting has a value it will be used instead of the LDAP User Search setting.

10. LDAP Start TLS is disabled by default. StartTLS allows your LDAP connection to be upgraded from an unencrypted connection to a secure connection using Transport Layer Security (TLS). To enable StartTLS when the LDAP connection is not using SSL, set the switch to On.

11. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

12. Enter any LDAP Connection Options to set for the LDAP connection. By default, LDAP referrals are disabled to prevent certain LDAP queries from hanging with Active Directory. Option names should be strings as shown in the following example:

    OPT_REFERRALS: 0
    OPT_NETWORK_TIMEOUT: 30

    See the python-LDAP Reference for possible options and values that can be set.

13. Depending on the selected LDAP Group Type, different parameters are available in the LDAP Group Type Parameters field to account for this. LDAP_GROUP_TYPE_PARAMS is a dictionary, which is converted to kwargs and passed to the LDAP Group Type class selected. There are two common parameters used by group types: name_attr and member_attr. Where name_attr defaults to cn and member_attr defaults to member:

    {"name_attr": "cn", "member_attr": "member"}

    To determine the parameters that a specific LDAP Group Type requires, refer to the django_auth_ldap documentation on the classes init parameters.

14. In the LDAP Group Search field, specify which groups should be searched and how to search them as shown in the following example:

    [
    "dc=example,dc=com",
    "SCOPE_SUBTREE",
    "(objectClass=group)"
     ]

15. In the LDAP User Attribute Map field, enter user attributes to map LDAP fields to your Ansible Automation Platform users, for example, email or first_name as shown in the following example:

    {
    "first_name": "givenname",
    "last_name": "sn",
    "email": "mail"
    }

16. In the LDAP User Search field, enter where to search for users during authentication as shown in the following example:

    [
    "ou=users,dc=website,dc=com",
    "SCOPE_SUBTREE",
    "(cn=%(user)s)"
    ]

    If the LDAP User DN Template is not set, the Ansible Automation Platform authenticates to LDAP using the Bind DN Template and LDAP Bind Password. After authentication, an LDAP search is performed to locate the user specified by this field. If the user is found, Ansible Automation Platform validates the provided password against the user found by the LDAP search. Multiple search queries are supported for users with LDAPUnion by entering multiple search terms as shown in the following example:

    [
        [
            "ou=users,dc=example,dc=com",
            "SCOPE_SUBTREE",
            "uid=%(user)s"
        ],
         [
            "ou=employees,dc=subdivision,dc=com",
            "SCOPE_SUBTREE",
            "uid=%(user)s"
         ]
    ]

    If non-unique users are found during multiple searches, those users will not be able to log in to Ansible Automation Platform. Based on the example provided, if a user with uid=jdoe was found in both the ou=users,dc=example,dc=com and ou=employees,dc=subdivision,dc=com, neither jdoe user would be able to log in. All other unique users that are found in either branch would still be able to log in.

    Note

    If the field LDAP User DN Template is populated, it takes precedence over the LDAP User Search field and only the template will be used to authenticate users.

17. To automatically create organizations, users, and teams upon successful login, select Create objects.
18. To enable this authentication method upon creation, select Enabled.
19. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
20. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this SAML configuration.
4. Select SAML from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.
5. Enter the application-defined unique identifier used as the audience of the SAML service provider configuration in the SAML Service Provider Entity ID field. This is usually the base URL of your service provider, but the actual value depends on the Entity ID expected by your IdP.
6. Include the certificate content in the SAML Service Provider Public Certificate field. This information is contained in the cert.pem you created as a prerequisite and must include the --BEGIN CERTIFICATE-- and --END CERTIFICATE--.
7. Include the private key content in the SAML Service Provider Private Key field. This information is contained in the key.pem you created as a prerequisite and must include the --BEGIN PRIVATE KEY-- and --END PRIVATE KEY--.
8. Enter the URL to redirect the user to for login initiation in the IdP Login URL field. This is the login URL from your SAML IdP application.

9. Enter the public cert used for secrets coming from the IdP in the IdP Public Cert field. This is the SAML certificate available for download from IdP.

   Note

   The IdP in the IdP Public Cert field should contain the entire certificate, including the --BEGIN-- and --END CERTIFICATE--. You must manually enter the prefix and suffix if the IdP does not include it.

10. Enter the entity ID returned in the assertion in the Entity ID. This is the identifier from your IdP SAML application. You can find this value in the SAML metadata provided by your IdP.
11. Enter user details in the Groups, User Email, Username, User Last Name and User First Name.

12. Enter a permanent ID for the user in the User Permanent ID field. This field is required.

    Note

    Additional attributes might be available through your SAML IdP. Those values must be included in either the Additional Authenticators Fields or the SAML IDP to extra_data attribute mapping field. Refer to those steps for details.

13. The SAML Assertion Consumer Service (ACS) URL field registers the service as a service provider (SP) with each identity provider (IdP) you have configured. Leave this field blank. After you save this authentication method, it is auto generated. This field must match the Reply URL setting in your IdP.

14. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator. For example, to ensure all SAML IdP attributes other than Email, Username, Last Name, First Name are included for mapping, enter the following:

    GET_ALL_EXTRA_DATA: true

    Alternatively, you can include a list of SAML IdP attributes in the SAML IDP to extra_data attribute mapping field.

    Note

    Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

15. In the SAML Service Provider Organization Info field, provide the URL, display name, and the name of your app.

    {
      "en-US": {
        "url": "http://www.example.com",
        "displayname": "Example",
        "name": "example"
      }
    }

16. In the SAML Service Provider Technical Contact field, give the name and email address of the technical contact for your service provider.

    {
    "givenName": "Some User",
    "emailAddress": "suser@example.com"
    }

17. In the SAML Service Provider Support Contact field, give the name and email address of the support contact for your service provider.

    {
    "givenName": "Some User",
    "emailAddress": "suser@example.com"
    }

18. Optional: Provide extra configuration data in the SAML Service Provider extra configuration data field. For example, you can choose to enable signing requests for added security:

    {
    "sign_request": True,
    }

    This field is the equivalent to the SOCIAL_AUTH_SAML_SP_EXTRA in the API. For more information, see OneLogin’s SAML Python Toolkit to learn about the valid service provider extra (SP_EXTRA) parameters.

    Note

    References to the OneLogin SAML Python Toolkit are for formatting examples only. Some configuration entries in the OneLogin documentation might not apply to Ansible Automation Platform.

19. Optional: Provide security settings in the SAML Security Config field. This field is the equivalent to the SOCIAL_AUTH_SAML_SECURITY_CONFIG field in the API.

    // Indicates whether the <samlp:AuthnRequest> messages sent by this SP // will be signed. [Metadata of the SP will offer this info]
    "authnRequestsSigned": false,
    
    // Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> // and <samlp:LogoutResponse> elements received by this SP to be signed.
    "wantMessagesSigned": false,
    
    // Indicates a requirement for the <saml:Assertion> elements received by // this SP to be signed. [Metadata of the SP will offer this info]
    "wantAssertionsSigned": false,
    
    // Authentication context.
    // Set to false and no AuthContext will be sent in the AuthNRequest,
    // Set true or don't present this parameter and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
    // Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
    "requestedAuthnContext": true,

    For more information and additional options, see OneLogin’s SAML Python Toolkit.

20. Optional: In the SAML IDP to extra_data attribute mapping field, enter values to map IDP attributes to extra_data attributes. These values will include additional user information beyond standard attributes such as Email or Username to be mapped. For example:

    - Department
    - UserType
    - Organization

    For more information about the values you can include, see advanced SAML settings.

    Important

    Ensure to include all relevant values so that everything gets mapped correctly for your configuration. Alternatively, you can include the GET_ALL_EXTRA_DATA: true in the Additional Authenticator Fields to allow mapping of all available SAML IdP attributes.

21. To automatically create organizations, users, and teams upon successful login, select Create objects.
22. To enable this authentication method upon creation, select Enabled.
23. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.

24. Click Create Authentication Method.

    Important

    You can configure an HTTPS redirect for SAML in operator-based deployments to simplify login for your users. For the steps to configure this setting, see Enabling single sign-on (SSO) for platform gateway on OpenShift Container Platform.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select TACACS+ from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. Enter the following information:

   • Hostname of TACACS+ Server: Provide the hostname or IP address of the TACACS+ server with which to authenticate. If you leave this field blank, TACACS+ authentication is disabled.
   • TACACS+ Authentication Protocol: The protocol used by the TACACS+ client. The options are ascii or pap.
   • Shared secret for authenticating to TACACS+ server: The secret key for TACACS+ authentication server.
6. The TACACS+ client address sending enabled is disabled by default. To enable client address sending, select the checkbox.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

8. To automatically create organizations, users, and teams upon successful login, select Create objects.
9. To enable this authentication method upon creation, select Enabled.
10. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
11. Click Create Authentication Method.

1. Configure your Ansible Automation Platform to use Microsoft Entra ID authentication using the steps in this procedure.
2. Register Ansible Automation Platform in Microsoft Entra ID by following the Quickstart: Register an application with the Microsoft identity platform. This process provides you with an Application (client) ID and Application secret.
3. Add the redirect URL in Microsoft Entra ID. After completing the configuration wizard for Microsoft Entra ID authentication in your platform, copy the URL displayed in the Azure AD OAuth2 Callback URL field. Then, go to your registered enterprise application in Azure and add this URL as a Redirect URL (also referred to as a Callback URL in Ansible Automation Platform) as described in How to add a redirect URI to your application. This step is required for the login flow to work correctly.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select Azuread from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.
5. Click Edit, copy and paste Microsoft’s Application (Client) ID to the OIDC Key field.

6. If your Microsoft Entra ID is configured to provide user group information within a groups claim, ensure that the platform is configured with a Groups Claim name that matches your Microsoft Entra ID configuration. This allows the platform to correctly identify and associate groups for users logging in through Microsoft Entra ID.

   Note

   Groups coming from Microsoft Entra ID can be identified using either unique IDs or group names. When creating group mappings for a Microsoft Entra ID authenticator, you can use either the unique ID or the group name.

   By default, Microsoft Entra ID uses groups as the default group claim name. So, be sure to either set the value to the default or to any custom override you have set in your IdP. The current default is set to preserve the existing behavior unless explicitly changed.

7. Following instructions for registering your application with the Microsoft identity platform, supply the key (shown at one time only) to the client for authentication.
8. Copy and paste the secret key created for your Microsoft Entra ID/Microsoft Azure AD application to the OIDC Secret field.
9. Optional: By default, the name attribute from Microsoft Entra ID is used as the username field within Ansible Automation Platform. If you want to override that default value and use another attribute from Microsoft Entra ID, enter that attribute in the username field.

10. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

11. To automatically create organizations, users, and teams upon successful login, select Create objects.
12. To enable this authentication method upon creation, select Enabled.
13. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
14. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select Google OAuth from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. The Google OAuth2 Key and Google OAuth2 Secret fields are pre-populated.

   If not, use the credentials Google supplied during the web application setup process. Save these settings for use in the following steps.

6. Copy and paste Google’s Client ID into the Google OAuth2 Key field.
7. Copy and paste Google’s Client secret into the Google OAuth2 Secret field.

8. Optional: Enter information for the following fields using the tooltip provided for instructions and required format:

   • Access Token URL
   • Access Token Method
   • Authorization URL
   • Revoke Token Method
   • Revoke Token URL
   • OIDC JWT Algorithm(s)
   • OIDC JWT

9. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

10. To automatically create organizations, users, and teams upon successful login, select Create objects.
11. To enable this authentication method upon creation, select Enabled.
12. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
13. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select Generic OIDC from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. Enter the following information:

   • OIDC Provider URL: The URL for your OIDC provider.
   • OIDC Key: The client ID from your third-party IdP.
   • OIDC Secret: The client secret from your IdP.
6. Optional: Select the HTTP method to be used when requesting an access token from the Access Token Method list. The default method is POST.

7. Optionally enter information for the following fields using the tooltip provided for instructions and required format:

   • Access Token Method - The default method is POST.
   • Access Token URL
   • Access Token Method
   • Authorization URL
   • Callback URL - The OIDC Callback URL field registers the service as a service provider (SP) with each OIDC provider you have configured. Leave this field blank. After you save this authentication method, it is auto generated. Configure your IdP to allow redirects to this URL as part of the authentication flow.
   • ID Key
   • ID Token Issuer
   • JWKS URI
   • OIDC Public Key
   • Revoke Token Method - The default method is GET.
   • Revoke Token URL
   • Response Type
   • Token Endpoint Auth Method
   • Userinfo URL
   • Username Key
8. Use the Verify OIDC Provider Certificate to enable or disable the OIDC provider SSL/TLS certificate verification.
9. Use the Redirect State to enable or disable the state parameter in the redirect URI. Enable this to prevent Cross Site Request Forgery (CSRF) attacks.

10. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

11. To automatically create organizations, users, and teams upon successful login, select Create objects.
12. To enable this authentication method upon creation, select Enabled.
13. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
14. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select Keycloak from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.
5. Enter the location where the user’s token can be retrieved in the Keycloak Access Token URL field.
6. Optional: Enter the redirect location the user is taken to during the login flow in the Keycloak Provider URL field.
7. Enter the Client ID from your Keycloak installation in the Keycloak OIDC Key field.
8. Enter the RS256 public key provided by your Keycloak realm in the Keycloak Public Key field.
9. Enter the OIDC secret (Client Secret) from your Keycloak installation in the Keycloak OIDC Secret field.

10. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

11. To automatically create organizations, users, and teams upon successful login, select Create objects.
12. To enable this authentication method upon creation, select Enabled.
13. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
14. Click Create Authentication Method.

1. From the navigation for your Keycloak configuration, select Client scopes → YOUR-CLIENT-ID-dedicated → Add mapper → Audience.
2. Pick a name for the mapper.
3. Select the Client ID corresponding to your client in Included Client Audience.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select GitHub organization from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. Enter the name of your GitHub organization, as used in your organization’s URL, for example, https://github.com/<yourorg>/ in the GitHub OAuth Organization Name field.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

8. Enter the authorization scope for users in the GitHub OAuth2 Scope field. The default is read:org.
9. To automatically create organizations, users, and teams upon successful login, select Create objects.
10. To enable this authentication method upon creation, select Enabled.
11. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
12. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select GitHub team from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. Copy and paste GitHub’s team ID in the GitHub OAuth2 Team ID field.
7. Enter the authorization scope for users in the GitHub OAuth2 Scope field. The default is read:org.

8. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

9. To automatically create organizations, users, and teams upon successful login, select Create objects.
10. To enable this authentication method upon creation, select Enabled.
11. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.

12. Click Create Authentication Method.

    To verify that the authentication is configured correctly, log out of Ansible Automation Platform and check that the login screen displays the logo of your authentication chosen method to enable logging in with those credentials.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select GitHub enterprise from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. In the Base URL field, enter the hostname of the GitHub Enterprise instance, for example, https://github.example.com.
7. In the Github OAuth2 Enterprise API URL field, enter the API URL of the GitHub Enterprise instance, for example, https://github.example.com/api/v3.

8. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

9. To automatically create organizations, users, and teams upon successful login, select Create objects.
10. To enable this authentication method upon creation, select Enabled.
11. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
12. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select GitHub enterprise organization from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. When you register the application, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. In the Base URL field, enter the hostname of the GitHub Enterprise instance, for example, https://github.example.com.
7. In the Github OAuth2 Enterprise API URL field, enter the API URL of the GitHub Enterprise instance, for example, https://github.example.com/api/v3.
8. Enter the name of your GitHub enterprise organization, as used in your organization’s URL, for example, https://github.com/<yourorg>/ in the GitHub OAuth2 Enterprise Org Name field.

9. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

10. To automatically create organizations, users, and teams upon successful login, select Create objects.
11. To enable this authentication method upon creation, select Enabled.
12. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.

13. Click Create Authentication Method.

    To verify that the authentication is configured correctly, log out of Ansible Automation Platform and check that the login screen displays the logo of your authentication chosen method to enable logging in with those credentials.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select GitHub enterprise team from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. In the Base URL field, enter the hostname of the GitHub Enterprise instance, for example, https://github.orgexample.com.
7. In the Github OAuth2 Enterprise API URL field, enter the API URL of the GitHub Enterprise instance, for example, https://github.example.com/api/v3.
8. Enter the OAuth2 key (Client ID) from your GitHub developer application in the GitHub OAuth2 team ID field.

9. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

10. To automatically create organizations, users, and teams upon successful login, select Create objects.
11. To enable this authentication method upon creation, select Enabled.
12. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
13. Click Create Authentication Method.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Click Create authentication.
3. Enter a Name for this authentication configuration.
4. Select Radius from the Authentication type list. The Authentication details section automatically updates to show the fields relevant to the selected authentication type.
5. Enter the host or IP of the RADIUS server in the RADIUS Server field. If you leave this field blank, RADIUS authentication is disabled.
6. Enter the Shared secret for authenticating to RADIUS server.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI. Any values not defined here are not provided to the authenticator.

8. To automatically create organizations, users, and teams upon successful login, select Create objects.
9. To enable this authentication method upon creation, select Enabled.
10. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
11. Click Create Authentication Method.

1. Allow rule set to never
2. Allow rule based on group
3. Superuser rule based on user attributes
4. Team admin rule based on user group

1. The Organization title of the page indicates that you are configuring settings permissions on an organization.
2. Network Organization is entered in this field and is the unique, descriptive name for this map configuration.
3. Attributes is selected from the Trigger list to configure authentication based on an attribute from the source system, which in this example is Organization.
4. The operation is defined as or meaning that at least one condition must be true for authentication to succeed.
5. The Attribute coming from the source system is Organization.
6. The Comparison value is set to matches which means that when a user has the attribute Value of Networking, they are added to the Networking organization.
7. The attribute Value coming from the source system is Networking.
8. The name of the Organization to which you are adding members is Networking.
9. Users are added to the Networking organization with the Organization Member role.

Procedure

1. After configuring the authentication details for your authentication method, select the Mapping tab.
2. Select Allow from the Add authentication mapping list.
3. Enter a unique rule Name to identify the rule.
4. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
5. Select Revoke to deny user access to the system when the trigger conditions are not matched.
6. Click Next.

Procedure

1. After configuring the authentication details for your authentication method, select the Mapping tab.
2. Select Organization from the Add authentication mapping list.
3. Enter a unique rule Name to identify the rule.
4. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
5. Select Revoke to remove the user’s access to the selected organization role when the trigger conditions are not matched.
6. Select the Organization to which matching users are added or blocked.
7. Select a Role to be applied or removed for matching users (for example, Organization Admin or Organization Member).
8. Click Next.

Procedure

1. After configuring the authentication details for your authentication method, select the Mapping tab.
2. Select Team from the Add authentication mapping list.
3. Enter a unique rule Name to identify the rule.
4. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
5. Select Revoke to remove the user’s access to the selected organization role and deny user access to the system when the trigger conditions are not matched.
6. Select the Team and Organization to which matching users are added or blocked.
7. Select a Role to be applied or removed for matching users (for example, Team Admin or Team Member).
8. Click Next.

Procedure

1. After configuring the authentication details for your authentication method, select the Mapping tab.
2. Select Role from the Add authentication mapping list.
3. Enter a unique rule Name to identify the rule.
4. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
5. Select Revoke to remove the role for the user when none of the trigger conditions are matched.
6. Select a Role to be applied or removed for matching users.
7. Click Next.

Procedure

1. After configuring the authentication details for your authentication method, select the Mapping tab.
2. Select Superuser from the Add authentication mapping list.
3. Enter a unique rule Name to identify the rule.
4. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
5. Select Revoke to remove the superuser role from the user when none of the trigger conditions are matched.
6. Click Next.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. Select your authenticator from the list.
3. Select the Mapping tab and click Create mapping.
4. In Authentication mapping, choose the appropriate mapping type: Organization, Team, or Role.
5. In the Trigger field, select Attributes.

6. In the corresponding field, such as the Organization field for an Organization map, enter the Jinja-like syntax to dynamically generate the name.

   • For example, to create an organization name based on an attribute called users_orgs, enter Org {% for_attr_value(users_orgs) %}.
7. In the Attribute field, specify the name of the attribute from your external provider that has values you want to loop through, such as users_orgs.
8. Complete any other required fields for the mapping, see Authenticator map triggers for more information.

9. Click Create mapping. Platform gateway uses this template to create and manage user assignments based on the values of the specified attribute.

   Note

   The system raises a validation error if the templating syntax is mistyped and the new authenticator map is not created. During an authentication, if the external provider does not provide the specified attribute or the user does not have values associated with the attribute specified by the Jinja syntax the map is triggered and a message indicating why is put into the platform gateway logs.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.

   The Authentication Methods page is displayed.

2. Click Create authentication and follow the steps for creating an authentication method in Configuring an authentication type. Otherwise, proceed to step 3.
3. From the menu bar, you can sort the list of authentication methods by using the arrows in the menu bar for Order, Name and Authentication type.
4. Click the toggles to Enable or Disable authenticators.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.
2. In the search bar, enter an appropriate keyword for the authentication method you want to search for and click the arrow icon.
3. If you do not find what you are looking for, you can narrow your search. From the filter list, select Name or Authentication type depending on the search term you want to use.
4. Scroll through the list of search results and select the authenticator you want to review.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.

2. In the list view, select the authenticator name displayed in the Name column.

   The authenticator Details page is displayed.

3. From the Details page, you can review the configuration settings applied to the authenticator.

Procedure

1. From the navigation panel, select Access Management → Authentication Methods.

2. In the list view, you can either:

   1. Select the Edit icon next to authenticator you want to modify, or
   2. Select the authenticator name displayed in the Name column and click Edit authenticator from the Details page.
3. Change the authentication details or mapping configurations as required.
4. Click Save.

Procedure

1. From the navigation panel, select Access Management → OAuth Applications.
2. Click Create OAuth application. The Create Application page opens.

3. Enter the following details:

   Name

   (required) Enter a name for the application you want to create.

   URL

   (optional) Enter the URL of the external application. This link is added to the navigation panel for easy access. This setting is currently offered as a Technology Preview only.

   Description

   (optional) Include a short description for your application.

   Organization

   (required) Select an organization with which this application is associated.

   Authorization grant type

   (required) Select one of the grant types to use for the user to get tokens for this application. For more information, see Application functions for more information about grant types.

   Client Type

   (required) Select the level of security of the client device.

   Redirect URIS

   Provide a list of allowed URIs, separated by spaces. You need this if you specified the grant type to be Authorization code.

4. Click Create OAuth application, or click Cancel to abandon your changes.

   The Client ID and Client Secret display in a window. This will be the only time the client secret will be shown.

   Note

   The Client Secret is only created when the Client type is set to Confidential.

5. Click the copy icon and save the client ID and client secret to integrate an external application with Ansible Automation Platform.

Procedure

1. From the navigation panel, go to Settings → Platform gateway.
2. Click Edit platform gateway settings.
3. Change the Allow external users to create OAuth2 tokens setting to Enabled.
4. Click Save platform gateway settings.

Procedure

1. From the navigation panel, select Access Management → Organizations.
2. In the Search bar, enter an appropriate keyword for the organization you want to search for and click the arrow icon.
3. From the menu bar, you can sort the list of organizations by using the arrows for Name to toggle your sorting preference.
4. You can also sort the list by selecting Name, Created or Last modified from the Sort list.
5. You can view organization details by clicking an organization Name on the Organizations page.

Procedure

1. From the navigation panel, select Access Management → Organizations.
2. Click Create organization.

3. Enter the Name and give a Description for your organization.

   Note

   If automation controller is enabled on the platform, continue with Step 4. Otherwise, proceed to Step 6.

4. Select the name of the Execution environment or search for one that members of this organization can use to run automation.
5. Enter the name of the Instance Groups on which to run this organization.
6. Optional: Enter the Galaxy credentials or search from a list of existing ones.

7. Select the Max hosts for this organization. The default is 0. When this value is 0, it signifies no limit. If you try to add a host to an organization that has reached or exceeded its cap on hosts, an error message displays:

   You have already reached the maximum number of 1 hosts allowed for your organization. Contact your System Administrator for assistance.

8. Click Next.

9. If you selected more than 1 instance group, you can manage the order by dragging and dropping the instance group up or down in the list and clicking Confirm.

   Note

   The execution precedence is determined by the order in which the instance groups are listed.

10. Click Next and verify the organization settings.
11. Click Finish.

Procedure

1. From the navigation panel, select Access Management → Organizations.
2. From the Organizations list view, select the organization whose notifications you want to manage.
3. Select the Notification tab.
4. Use the toggles to enable or disable the notifications to use with your particular organization. For more information, see Enable and disable notifications.
5. If no notifiers have been set up, select Automation Execution → Administration → Notifiers from the navigation panel.

Procedure

1. From the navigation panel, select Access Management → Organizations.
2. From the Organizations list view, select the organization whose execution environments you want to manage.
3. Select the Execution Environments tab.
4. If no execution environments are available, click Create execution environment to create one. Alternatively, you can create an execution environment from the navigation panel by selecting Automation Execution → Infrastructure → Execution Environments.

5. Click Create execution environment.

   Note

   After creating a new execution environments, return to Access Management → Organizations and select the organization in which you created the execution environment to update the list on that tab.

6. Select the execution environments to use with your particular organization.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. In the Search bar, enter an appropriate keyword for the team you want to search for and click the arrow icon.
3. From the menu bar, you can sort the list of teams by using the arrows for Name and Organization to toggle your sorting preference.
4. You can view team details by clicking a team Name on the Teams page.
5. You can view organization details by clicking the link in the Organization column.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. Click Create team.
3. Enter a Name and optionally give a Description for the team.

4. Select an Organization to be associated with this team.

   Note

   Each team can only be assigned to one organization.

5. Click Create team. The Details page opens, where you can review and edit your team information and access.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. Select the team to which you want to add users.
3. Select the Users tab.
4. Select one or more users from the list by clicking the checkbox next to the name to add them as members of this team.
5. Click Add users.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. Select the team from which you want to remove users.
3. Select the Users tab.
4. Click the Remove user icon next to the user you want to remove as a member of the team.

5. You can delete multiple users by selecting the checkbox next to each user you want to remove, and selecting Remove selected users from the More actions ⋮ list.

   Note

   If the user is a Team administrator, you can remove their membership to the team from the Administrators tab.

6. A confirmation dialog asking you to confirm the removal will appear. Confirm the removal. Note that removing a user from a team removes all of that team’s role assignments from the user.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. Select the team to which you want to add an administrator.
3. Select the Administrators tab and click Add administrator(s).
4. Select one or more users from the list by clicking the checkbox next to the name to add them as administrators of this team.
5. Click Add administrators.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. Select the team Name to which you want to add roles.

3. Select the Roles tab and click Add roles.

   Note

   Ensure that you are selecting the desired role within the correct component context, because resources like projects and credentials can be associated with both Automation Execution (automation controller) and Automation Decisions (Event-Driven Ansible).

4. Select a Resource type and click Next.
5. Select the resources that you want to give the team role-based access to and click Next.

6. Select the roles to apply to the resources and click Next.

   Tip

   If you are selecting more than one role in this step, consider creating a custom role that includes all the permissions for this resource type to give the team the correct access.

7. Review the settings and click Finish.
8. The Add roles dialog displays indicating whether the role assignments were successfully applied. Click Close to close the dialog.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. Select the team Name from which you want to remove roles.
3. Select the Roles tab.

4. To remove a single role, click the minus icon next to the resource and confirm removal on the dialog that is displayed.

   Note

   Ensure that you are selecting the desired role within the correct component context, because resources like projects and credentials can be associated with both Automation Execution (automation controller) and Automation Decisions (Event-Driven Ansible).

5. To remove roles in bulk, select the checkbox next to each resource you want to remove and click Delete selected roles from the More Actions ⋮ list on the menu bar, then confirm removal and click Delete role.

Procedure

1. From the navigation panel, select Access Management → Teams.
2. To remove a single team, click the minus icon - next to the team and confirm removal on the dialog that is displayed.
3. To remove teams in bulk, select the checkbox next to each team that you want to remove, then click the More Actions ⋮ icon and select Delete team.

Procedure

1. From the navigation panel, select Access Management → Users.
2. In the Search bar, enter an appropriate keyword for the user you want to search for and click the arrow icon.
3. From the menu bar, you can sort the list of users by using the arrows for Username, Email, First name, Last name or Last login to toggle your sorting preference.
4. You can view user details by selecting a Username from the Users list view.

Procedure

1. From the navigation panel, select Access Management → Users.
2. Click Create user.
3. Enter the details about your new user in the fields on the Create user page. Fields marked with an asterisk (*) are required.

4. Normal users are the default when no User type is specified. To define a user as an administrator or auditor, select a User type from the drop-down menu.

   Note

   If you are modifying your own password, log out and log back in for the change to take effect.

5. Select the Organization to be assigned for this user. For information about creating a new organization, see Creating an organization.

6. Click Create user.

   When the user is successfully created, the User details screen opens. From here, you can review and change the user’s teams, roles, tokens and other membership details.

   Note

   If the user is not newly-created, the details screen displays the user’s last login activity.

Procedure

1. From the navigation panel, select Access Management → Users.
2. Click the Pencil icon next to the user you want to edit and select Edit user.
3. The Edit user page is displayed where you can change user details such as Password, Email, User type, and Organization.
4. After your changes are complete, click Save user.

Procedure

1. From the navigation panel, select Access Management → Users.
2. To delete a single user, select the More Actions ⋮ icon next to the user you want to remove and select Delete user.
3. To bulk delete users, select the checkbox next to each user you want to remove, and then from the More Actions⋮ list, click Delete users.

Procedure

1. From the navigation panel, select Access Management → Users.
2. From the Users list view, click the user to which you want to add roles.
3. Select the Roles tab to display the set of roles assigned to this user. These provide the ability to read, change, and administer resources.

4. To add new roles, click Add roles.

   Note

   Ensure that you are selecting the desired role within the correct component context, because resources like projects and credentials can be associated with both Automation Execution (automation controller) and Automation Decisions (Event-Driven Ansible).

5. Select a Resource type and click Next.
6. Select the resources that you want to give role-based access to and click Next.

7. Select the roles that will be applied to the resources and click Next.

   Tip

   If you are selecting more than one role, consider creating a custom role that includes all the permissions for this resource type so you can give your users the appropriate level of access.

8. Review the settings and click Finish. The Add roles dialog displays indicating whether the role assignments were successfully applied. Click Close to close the dialog.

Procedure

1. From the navigation panel, select Access Management → Users.
2. Select the user name whose role access you want to remove.

3. Select the Roles tab.

   Note

   Ensure that you are selecting the desired role within the correct component context, because resources like projects and credentials can be associated with both Automation Execution (automation controller) and Automation Decisions (Event-Driven Ansible).

4. To remove a single role, click the - icon next to the role and confirm removal on the dialog that is displayed.
5. To remove multiple roles, select the checkbox next to each role you want to remove and click Remove selected roles from the More actions ⋮ list on the menu bar. On the dialog that is displayed, confirm removal of the selected roles and click Remove role.

Procedure

1. From the navigation panel, click the name of the resource that you want to give a team access to. For example, Automation Execution → Templates.
2. On the details page, select the Team Access tab.
3. Click Assign Teams.
4. Click the checkbox beside the team to assign that team access to your chosen resource and click Next.
5. Select the roles you want applied to the team for the chosen resource and click Next.
6. Review the settings and click Finish. The Assign Teams dialog displays indicating whether the role assignments were successfully applied.
7. You can remove resource access for a team by selecting the Remove team icon next to the team. This launches a confirmation dialog, asking you to confirm the removal.

Procedure

1. From the navigation panel, select a resource that you want to give a team access to. For example, Automation Execution → Templates.
2. Select the User access tab.
3. Click Assign users.
4. Click the checkbox beside the user to assign that user to your chosen resource and click Next.
5. Select the roles you want applied to the user for the chosen resource and click Next.
6. Review the settings and click Finish. The Assign Roles dialog displays indicating whether the role assignments were successfully applied.
7. You can edit a user’s access to a resource from the User Access tab by clicking the pencil icon next to the user’s name and adding or removing directly-assigned roles.
8. You can remove resource access for a user by selecting the Remove role icon next to the user. This launches a confirmation dialog asking you to confirm the removal.

Procedure

1. From the navigation panel, select Settings → Platform gateway.
2. The Platform gateway settings page is displayed.
3. To configure the options, click Edit.

4. You can configure the following Security settings:

   • Allow system administrators to set insecure user passwords: Whether a superuser account can save an insecure password when editing any local user account.

   • Gateway basic auth enabled: Enable basic authentication to the platform gateway API.

     Turning this off prevents all basic authentication (local users), so customers need to make sure they have their alternative authentication mechanisms correctly configured before doing so.

     Turning it off with only local authentication configured also prevents all access to the UI.

     Gateway token name: The header name to push from the proxy to the backend service.

   • Gateway access token expiration: How long the access tokens are valid for.

   • Jwt private key: The private key used to encrypt the JWT tokens sent to backend services.

     This should be a private RSA key and one should be generated automatically on installation.

     Note

     Use caution when rotating the key as it will cause current sessions to fail until their JWT keys are reset.

   • (Read only) Jwt public key: The private key used to encrypt the JWT tokens sent to backend services.

     This should be a private RSA key and one should be generated automatically on installation.

     Note

     See other services' documentation on how they consume this key.

     Warning

     If this name is changed, backends must be updated to compensate.

     Social auth username is full email: Enabling this setting alerts social authentication to use the full email as username instead of the full name.

   • Csrf trusted origins: If the service is behind a reverse proxy or load balancer, use this setting to configure the schema://addresses from which the service should trust Origin header values.
5. Click Save changes to save the changes or proceed to configure the other platform options available.

Procedure

1. From the navigation panel, select Settings → Platform gateway.
2. The Platform gateway settings page is displayed.
3. To configure the options, click Edit platform gateway settings.
4. Enter the time in seconds before a session expires in the Session cookie age field.
5. Click Save platform gateway settings to save the changes or proceed to configure the other platform options available.

Procedure

1. From the navigation panel, select Settings → Platform gateway.
2. The Platform gateway settings page is displayed.
3. To configure the options, click Edit platform gateway settings.

4. You can configure the following Password Security options:

   • Password minimum uppercase letters: How many uppercase characters need to be in a local password.
   • Password minimum length: The minimum length of a local password.
   • Password minimum numerical digits: How many numerical characters need to be in a local password.
   • Password minimum special characters: How many special characters need to be in a local password.
5. Click Save platform gateway settings to save the changes or proceed to configure the other platform options available.

Procedure

1. Access the command line on the platform gateway node.

2. Use the aap-gateway-manage shell_plus command to open an interactive Django shell:

   aap-gateway-manage shell_plus

3. Inside the shell, run the following commands to import the encryption library, set your password, and generate the encrypted string:

   >>> from ansible_base.lib.utils.encryption import ansible_encryption
   >>> value = 'your-database-password' # REPLACE with your actual password
   >>> encrypted_value = ansible_encryption.encrypt_string(value)
   >>> print(encrypted_value)

4. Copy the entire output string starting with $encrypted$. This is your encrypted password.
5. Exit the shell using quit().

6. Open the platform gateway configuration file for editing:

   vi /etc/ansible-automation-platform/gateway/settings.py

7. Locate the section defining the DATABASES variable. You must insert the code to load the SECRET_KEY before the DATABASES dictionary is defined.

8. Update the file to include the highlighted code, replacing only the placeholder text for the PASSWORD key with your copied encrypted string:

   from ansible_base.lib.utils.encryption import ansible_encryption
   from django.conf import settings
   
   # ... other configuration settings ...
   
   # The GATEWAY_SECRET_KEY_FILE is typically defined earlier in settings.
   # The SECRET_KEY must be loaded before the decryption function is called.
   with open(GATEWAY_SECRET_KEY_FILE, 'rb') as f:
       settings.SECRET_KEY = f.read().strip()
   
   DATABASES = {
       'default': {
           'ENGINE': 'django.db.backends.postgresql',
           'HOST': '10.0.108.77', # Example host, use your value
           # ... other database settings ...
           'PASSWORD':
           ansible_encryption.decrypt_string('$encrypted$UTF8$AESCBC$Z0FBQUFBQnBBNU...
           <YOUR_ENCRYPTED_STRING>...QWdPUHM9'),
           # ... other database settings ...
           'PORT': '5432', # Example port, use your value
       }
   }

9. Save and close the file.

10. Restart platform gateway to load the new encrypted configuration:

    sudo systemctl restart aap-gateway

Procedure

1. From the navigation panel, select Settings → Platform gateway.
2. The Platform gateway settings page is displayed.
3. Click Edit platform gateway settings.

4. You can configure the following Other settings:

   • Jwt expiration buffer in seconds: The number of seconds before a JWT token’s expiration to revoke from the cache.

     When authentication happens a JWT token is created for the user and that token is cached. When subsequent calls happen to services such as automation controller or Event-Driven Ansible, the token is taken from the cache and sent to the service. Both the token and the cache of the token have an expiration time. If the token expires while in the cache the authentication process attempts results in a 401 error (unauthorized). This setting gives Red Hat Ansible Automation Platform a buffer by removing the JWT token from the cache before the token expires. When a token is revoked from cache a new token with a new expiration is generated and cached for the user. As a result, expired tokens from the cache are never used. This setting defaults to 2 seconds. If you have a large latency between platform gateway and your services and observe 401 responses you must increase this setting to lower the number of 401 responses.

   • Status endpoint backend timeout seconds: Timeout (in seconds) for the status endpoint to wait when trying to connect to a backend.
   • Status endpoint backend verify: Specifies whether SSL/TLS certificates of the services are verified when calling individual nodes for statuses.
   • Resource client request timeout: The timeout (in seconds) before the resource client will drop requests after forming connections.
   • Request timeout: Specifies, in seconds, the length of time before the proxy will report a timeout and generate a 504.

   • Manage organization auth: Controls whether any organization administrator has the privileges to create and manage users and teams. You might want to disable this ability if you are using an LDAP or SAML integration.

     Important

     The MANAGE_ORGANIZATION_AUTH setting is moved to platform gateway during an upgrade from Ansible Automation Platform 2.4 to 2.6. However, the values are not automatically synchronized between platform gateway and automation controller after the migration. To prevent administrative issues, keep the MANAGE_ORGANIZATION_AUTH value consistent across both environments, especially if automation workflows run directly against automation controller.

   • Stream idle timeout: Timeout in seconds for idle streaming connections, for example, for the Red Hat Ansible Lightspeed chatbot. Stream is closed if no data is transmitted within this period.
   • Max stream duration: Maximum total duration in seconds for streaming connections, for example, for the Red Hat Ansible Lightspeed chatbot. Stream is closed after this time regardless of activity.
   • Aap deployment type: The deployment type for this Ansible Automation Platform instance.
5. Click Save platform gateway settings to save the changes or proceed to configure the other platform options available.

Procedure

1. From the navigation panel, go to Settings → Platform gateway.
2. Click Edit platform gateway settings.
3. Change the Allow external users to create OAuth2 tokens setting to Enabled.
4. Click Save platform gateway settings.

Procedure

1. From the navigation panel, select Settings → Platform gateway.
2. The Platform gateway settings page is displayed.
3. To configure the options, click Edit platform gateway settings.

4. You can configure the following options:

   • Insights tracking state: Enables the service to gather data on automation and send it to Automation Analytics.
   • Red Hat console URL: This setting is used to configure the upload URL for data collection for Automation Analytics.
   • Red Hat password: This password is used to send data to Automation Analytics.
   • Subscriptions password: This password is used to retrieve subscription and content information.
   • Automation analytics gather interval: The maximum number of items allowed on a list page.
   • Notification rss feed url: URL for RSS feeds from which to load user notifications.
   • Notifications rss feed enabled: Enable or disable user notifications

1. Create a Personal Access Token (PAT): From the navigation panel, select Access Management → Users, select your user, go to the Tokens tab, and click Create token.
2. Copy the generated token value. Use this value as the <OAUTH2_TOKEN_VALUE> in the following commands.

Procedure

1. Go to the documentation endpoint by using the following URL structure, replacing $AAP_INSTANCE with your hostname:

   https://$AAP_INSTANCE/api/gateway/v1/docs/

2. Explore the available API endpoints, view required parameters, and test interactions with the resources exposed by platform gateway.