Configuration notes for all authentication types

Managing authentication configuration includes updating callback URLs for OAuth and SSO authenticators and configuring timeout values for password-based authenticators.

Address these configuration requirements after setting up authenticators to maintain proper integration with external identity providers.

Managing authentication configuration helps you to:
  • Maintain OAuth and SSO authentication in Ansible Automation Platform: Update callback URLs in your identity providers to redirect authentication flows from automation controller to platform gateway.
  • Prevent authentication request failures: Configure layered timeout values for password-based authenticators to ensure each upstream timeout exceeds the sum of its downstream timeouts.
  • Align timeout values with your environment: Set authenticator-specific timeout values that match the performance characteristics of your external authentication servers.

Update callback URLs for OAuth and SSO providers
Copy link

After architectural changes in Ansible Automation Platform 2.6, you must manually update the callback_url in your IdPs (GitHub, Entra ID, etc.). This redirect now points to the platform gateway instead of the controller and is dynamically generated for each authenticator.

Before you begin
Copy link

  • You have administrative access to the configuration settings of your external IdP.

About this task
Copy link

Important

After upgrading, your authentication method is disabled. As a platform administrator ensure that you enable the authenticator.

The callback_url is normally auto-generated by Ansible Automation Platform once the authentication method is configured. You must copy this generated URL from within Ansible Automation Platform and then paste it into your IdP’s settings.

Procedure
Copy link

  1. Go to your authenticator’s configuration details within the Ansible Automation Platform UI to locate the callback_url.

    For more information, see Displaying authenticator details.

  2. Identify and copy the auto-generated Callback URL, Redirect URL, or Reply URL that Ansible Automation Platform provides for your specific authentication method.
  3. Update your IdP’s configuration by pasting the copied redirect URL from Ansible Automation Platform into your IdP’s configuration where necessary.

Results
Copy link

Verify that the callback_url has been updated correctly and authentication is working:

  • Log in to Ansible Ansible Automation Platform as an administrator account and enable the authentication method, if you have not already.
  • Log in to Ansible Automation Platform using the newly configured or updated OAuth or SSO provider. A successful login indicates correct configuration.

Configure authenticator timeouts
Copy link

Configure layered timeout settings for password-based authenticators, such as LDAP, RADIUS, and TACACS+. Properly aligning these upstream and downstream timeouts helps ensure that your authentication requests do not fail.

The system processes authentication requests through a chain of services, each with its own timeout setting:

  • Envoy timeout: The total time a request can take before the initial entry point (Envoy) terminates the connection. This is the highest-level timeout.
  • gRPC timeout: A downstream timeout that bounds the time spent communicating with the internal authentication service.
  • Authenticator timeout: The lowest-level timeout, which defines how long an individual authenticator (LDAP, RADIUS, TACACS+) waits for a response from its third-party server.

Set timeout values
Copy link

Adjust your individual authenticator timeout values to align with the specific performance needs of your authentication servers. Fine-tuning these settings helps ensure stable and reliable authentication for your Ansible Automation Platform environment.

Procedure
Copy link

Configure authenticator timeouts: Adjust the timeout setting for each authenticator to a value that aligns with the expected response time of your external server.
  • For LDAP, set the OPT_NETWORK_TIMEOUT in seconds. For example, OPT_NETWORK_TIMEOUT: 30 sets an LDAP timeout of 30 seconds. For more information, see Configuring LDAP authentication.
  • For TACACS+ authentication, if you want to change the timeout you have to do it through the platform gateway API.
  • For RADIUS authentication, the timeout is not changeable and is set to 5 seconds.