# AWX LDAP configuration in a declarative way **URL:** \ **Category:** Get Help\ **Tags:** awx, ee\ **Created:** [November 30, 2023, 4:27pm UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678 "2023-11-30T16:27:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [November 30, 2023, 4:27pm UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678/1 "2023-11-30T16:27:34Z")
Hi, In order to fully configure my AWX instance in a declarative way, I set up an Ansible playbook I launch from my Debian server to my AWX instance (K8s hosting). Everything works great, i’m able to configure teams webhook, custom EE image, organization etc… but I face some issues when talking about some LDAP settings. First of all, I tested my LDAP configuration manually through AWX GUI and everything works great, so my queries in this post will be about the way of configure it through a playbook rather than LDAP syntax. According to [this documentation](https://docs.ansible.com/ansible/latest/collections/awx/awx/settings_module.html#ansible-collections-awx-awx-settings-module) I set up a bunch of task to configure each and every LDAP settings I need (AUTH\_LDAP\_SERVER\_URI, AUTH\_LDAP\_BIND\_PASSWORD, AUTH\_LDAP\_GROUP\_TYPE and so on…) Also, as settings name are based on django-auth-ldap, I took the settings names I need [right here](https://django-auth-ldap.readthedocs.io/en/latest/authentication.html). For instance, a single task with 1x set of name,value is working great: ```auto - name: Configuration AUTH_LDAP_SERVER_URI settings: name: "AUTH_LDAP_SERVER_URI" value: "ldap://my-ldap:389" tower_config_file: "./tower_config_file.cfg" ``` But it comes tricky when I have to set different values, so let’s focus on the first task failling : ```auto tasks: - name: Configuration AUTH_LDAP_USER_SEARCH settings: name: AUTH_LDAP_USER_SEARCH value: 'LDAPSearch("OU=MyGroup,DC=MyDC,DC=net",ldap.SCOPE_SUBTREE,"(sAMAccountName=%(user)s)",)' tower_config_file: "./tower_config_file.cfg" ``` Here’s the error message about `"Expected a list of items but got type \"str\"."` ```auto "changed": false, "invocation": { "module_args": { "controller_config_file": "./tower_config_file.cfg", "controller_host": null, "controller_oauthtoken": null, "controller_password": null, "controller_username": null, "name": "AUTH_LDAP_USER_SEARCH", "request_timeout": null, "settings": null, "tower_config_file": "./tower_config_file.cfg", "validate_certs": null, "value": "LDAPSearch(\"OU=MyGroup,DC=MyDC,DC=net\",ldap.SCOPE_SUBTREE,\"(sAMAccountName=%(user)s)\",)" } }, "msg": "Unable to update settings, see response", "response": { "json": { "AUTH_LDAP_USER_SEARCH": [ "Expected a list of items but got type \"str\"." ] }, "status_code": 400 } } ``` I tried to convert my task as a list of items : ```auto tasks: - name: Configuration AUTH_LDAP_USER_SEARCH settings: name: AUTH_LDAP_USER_SEARCH value: - "OU=MyGroup" - "DC=MyDC" - "DC=net" - "SCOPE_SUBTREE" - "(sAMAccountName=%(user)s)" tower_config_file: "./tower_config_file.cfg" ``` But got a different error message : ```auto fatal: [localhost]: FAILED! => { "changed": false, "invocation": { "module_args": { "controller_config_file": "./tower_config_file.cfg", "controller_host": null, "controller_oauthtoken": null, "controller_password": null, "controller_username": null, "name": "AUTH_LDAP_USER_SEARCH", "request_timeout": null, "settings": null, "tower_config_file": "./tower_config_file.cfg", "validate_certs": null, "value": "['OU=MyGroup', 'DC=MyDC', 'DC=net', 'SCOPE_SUBTREE', '(sAMAccountName=%(user)s)']" } }, "msg": "Unable to update settings, see response", "response": { "json": { "AUTH_LDAP_USER_SEARCH": [ "In order to ultilize LDAP Union, input element No. 1 should be a search query array." ] }, "status_code": 400 } } ``` **I don’t have any other ideas at the moment, does someone still face that kind of issue ?** Thanks a lot Gael ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [December 1, 2023, 8:39am UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678/2 "2023-12-01T08:39:25Z")
After reading [this code](https://github.com/ansible/awx/blob/devel/awx/sso/fields.py) at line 383 `def to_internal_value(self, data):`, I saw that the function is looking for `[]`. I set some tests and the working solution is : ```auto tasks: - name: Configuration AUTH_LDAP_USER_SEARCH settings: name: AUTH_LDAP_USER_SEARCH value: - ["ou=users,dc=example,dc=com","SCOPE_SUBTREE","(sAMAccountName=%(user)s)"] tower_config_file: "./tower_config_file.cfg" ``` **Be careful** : the collection is waiting for a list of 3 items (in my above example, separated by a `,` for instance: `("item1","item2","item3")` else you got this error : ```auto "json": { "AUTH_LDAP_USER_SEARCH": [ "Error parsing LDAP Union element No. 1:", "Expected a list of three items but got 1 instead." ``` ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [December 1, 2023, 12:41pm UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678/3 "2023-12-01T12:41:54Z")
\*\*For those who need a working LDAP configuration within an ansible-playbook, here’s mine (read before use it as you may have differents needs): \*\* ```auto - name: Configure AWX LDAP hosts: localhost connection: local collections: - awx.awx tasks: ####### Configuration LDAP ####### - name: Configuration AUTH_LDAP_SERVER_URI settings: name: "AUTH_LDAP_SERVER_URI" value: "ldap://XXXXX:389" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_BIND_PASSWORD settings: name: "AUTH_LDAP_BIND_PASSWORD" value: "XXXXX" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_GROUP_TYPE settings: name: AUTH_LDAP_GROUP_TYPE value: "ActiveDirectoryGroupType" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_BIND_DN settings: name: AUTH_LDAP_BIND_DN value: "CN=XXXXX,OU=YYYY,DC=mYdc,DC=net" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_REQUIRE_GROUP settings: name: AUTH_LDAP_REQUIRE_GROUP value: "CN=XXXXX,OU=YYYY,DC=mYdc,DC=net" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_USER_SEARCH settings: name: AUTH_LDAP_USER_SEARCH value: - ["CN=XXXXX,OU=YYYY,DC=mYdc,DC=net",SCOPE_SUBTREE,"(sAMAccountName=%(user)s)"] tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_GROUP_SEARCH settings: name: AUTH_LDAP_GROUP_SEARCH value: - "CN=XXXXX,OU=YYYY,DC=mYdc,DC=net" - "SCOPE_SUBTREE" - "(objectClass=group)" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_USER_ATTR_MAP settings: name: AUTH_LDAP_USER_ATTR_MAP value: email: "userPrincipalName" last_name: "sn" first_name: "givenName" tower_config_file: "./tower_config_file.cfg" - name: Configuration AUTH_LDAP_ORGANIZATION_MAP settings: name: AUTH_LDAP_ORGANIZATION_MAP value: Service-Infrastructure: users: "true" admins: "CN=XXXXX,OU=YYYY,DC=mYdc,DC=net" remove_users: "false" remove_admins: "false" tower_config_file: "./tower_config_file.cfg" ``` ---
**Author:** ![sirjaren](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sirjaren](https://forum.ansible.com/u/sirjaren)\ **Post date:** [December 2, 2023, 2:37am UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678/4 "2023-12-02T02:37:55Z")
Thinking about it, would it not work if you did this instead? ```auto tasks: - name: Configuration AUTH_LDAP_USER_SEARCH settings: name: AUTH_LDAP_USER_SEARCH value: - 'ou=users,dc=example,dc=com' - 'SCOPE_SUBTREE' - '(sAMAccountName=%(user)s)' tower_config_file: "./tower_config_file.cfg" ``` To me, that is a bit easier to read and maintain, unless I’m misreading your answer. ---
**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\ **Post date:** [December 4, 2023, 8:21am UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678/5 "2023-12-04T08:21:19Z")
> [@motorbass](#): > > ```auto > tasks: > - name: Configuration AUTH_LDAP_USER_SEARCH > settings: > name: AUTH_LDAP_USER_SEARCH > value: > - "OU=MyGroup" > - "DC=MyDC" > - "DC=net" > - "SCOPE_SUBTREE" > - "(sAMAccountName=%(user)s)" > tower_config_file: "./tower_config_file.cfg" > > ``` Hi, indeed it’s working and easier to maintain. Actually at the top of my post I did a test like that but I missed to split the OU,DC,DC and I had an error message. Thanks for your solution too 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [January 3, 2024, 8:21am UTC](https://forum.ansible.com/t/awx-ldap-configuration-in-a-declarative-way/2678/6 "2024-01-03T08:21:59Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.