Hello,
I’ve been able to make it working with ldap and keycloak auth.
If i’ve forgot nothing, here was all i’ve done :
in the awx repo folder :
from django-ansible-base/docs/Installation.md at devel · ansible/django-ansible-base · GitHub
curl -s https://raw.githubusercontent.com/ansible/django-ansible-base/refs/heads/devel/requirements/requirements_authentication.in >> requirements/requirements_dev.txt
upgrade social-auth-core to avoid issue with IAT by having JWT_LEEWAY option
sed -i 's/^social-auth-core.*/social-auth-core>=4.7/' requirements/requirements_dev.txt
cat >> awx/settings/settings.py << 'EOF'
OIDC_LEEWAY = 60
JWT_LEEWAY = 60
EOF
From django-ansible-base/docs/Installation.md at devel · ansible/django-ansible-base · GitHub
sed -i "/INSTALLED_APPS = \[/a\\ 'ansible_base.authentication'," awx/settings/defaults.py
some things are going to failed if still none
sed -i "s/SYSTEM_USERNAME = None/SYSTEM_USERNAME = 'awx'/" awx/settings/defaults.py
Add the possibility to have keycloak button in homepage
sed -i "/^from awx.main.views import handle_400/a\\
\\
from django.http import JsonResponse\\
from django.views import View\\
from ansible_base.authentication.views import UIAuth\\
\\
class AwxAuthView(View):\\
def get(self, request):\\
response = UIAuth.as_view()(request)\\
data = response.data\\
result = {}\\
for sso in data.get('ssos', []):\\
result[sso['type']] = {\\
'login_url': sso['login_url']\\
}\\
return JsonResponse(result)" awx/urls.py
add openldap-devel in dnf in tools/ansible/roles/dockerfile/templates/Dockerfile.j2 to be able to build library for django-ansible-base auth.
sed -i 's/ xmlsec1-openssl-devel/ xmlsec1-openssl-devel \\\n openldap-devel/' tools/ansible/roles/dockerfile/templates/Dockerfile.j2
Start building
eval "$(ssh-agent -s)"
git pull && nvm use 18 && make clean/ui ui && make ui/src/build && make docker-compose-build && make docker-compose
Once build and started, do some configuration from inside awx-manage shell_plus within docker :
from ansible_base.authentication.models import Authenticator
Authenticator.objects.filter(name="LDAP").delete()
Authenticator.objects.create(
name="LDAP",
enabled=True,
type="ansible_base.authentication.authenticator_plugins.ldap",
configuration={
"SERVER_URI": ["ldaps://ldap_server"],
"BIND_DN": "CN=account,OU=xxx,DC=xxx,DC=xxx,DC=xxx",
"BIND_PASSWORD": "account_password",
"START_TLS": False,
"CONNECTION_OPTIONS": {
"OPT_REFERRALS": 0,
"OPT_NETWORK_TIMEOUT": 30,
"OPT_X_TLS_REQUIRE_CERT": 0,
"OPT_X_TLS_NEWCTX": 0
},
"USER_SEARCH": [
"DC=xxx,DC=xxx,DC=xxx",
"SCOPE_SUBTREE",
"(cn=%(user)s)"
],
"USER_DN_TEMPLATE": "",
"USER_ATTR_MAP": {
"email": "mail",
"last_name": "sn",
"first_name": "givenName"
},
"GROUP_SEARCH": [
"DC=xxx,DC=xxx,DC=xxx",
"SCOPE_SUBTREE",
"(objectClass=group)"
],
"GROUP_TYPE": "PosixGroupType",
"GROUP_TYPE_PARAMS": {},
"USER_FLAGS_BY_GROUP": {},
"ORGANIZATION_MAP": {},
"TEAM_MAP": {},
}
)
Authenticator.objects.filter(name="Keycloak").delete()
Authenticator.objects.create(
name="Keycloak",
enabled=True,
type="ansible_base.authentication.authenticator_plugins.keycloak",
configuration={
"AUDIENCE": "name_of_your_client",
"ACCESS_TOKEN_URL": "https://keycloak/realms/my_realm/protocol/openid-connect/token",
"AUTHORIZATION_URL": "https://keycloak/realms/my_realm/protocol/openid-connect/auth",
"REVOKE_TOKEN_URL": "https://keycloak/realms/my_realm/protocol/openid-connect/revoke",
"USERINFO_URL": "https://keycloak/realms/my_realm/protocol/openid-connect/userinfo",
"PUBLIC_KEY": "public_key_of_your_realm",
"KEY": "name_of_your_client",
"SECRET": "secret_of_your_realm_or_client_i_forgot",
# Mapping des attributs utilisateur
"USERNAME_KEY": "preferred_username", # must match username in LDAP
"USER_ATTR_MAP": {
"first_name": "given_name",
"last_name": "family_name",
"email": "email"
},
}
)
if you want to sync user between ldap and keycloak, launch this in awx-manage shell_plus :
ldap_auth = Authenticator.objects.get(name="LDAP")
keycloak_auth = Authenticator.objects.get(name="Keycloak")
keycloak_auth.auto_migrate_users_from.add(ldap_auth)
keycloak_auth.save()
ldap_auth.auto_migrate_users_from.add(keycloak_auth)
ldap_auth.save()
feel free to change a param inside the file awx/settings/defaults.py to force a reload of the AWX. check the log for error and try the logins !
NB : i haven’t tested anything after that.
