# How to integrate awx  with RedHat IDM(IPA)

**URL:** <https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [April 28, 2020, 11:22am UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797 "2020-04-28T11:22:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Selvam\_Elangovan](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Selvam\_Elangovan](https://forum.ansible.com/u/Selvam_Elangovan)\
**Post date:** [April 28, 2020, 11:22am UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797/1 "2020-04-28T11:22:34Z")

</div>

Hi!

Could some one share the details of how to integrate awx with RedHat IDM(IPA) for authentication. I read through the doc in the ansibler tower web page but it is not working as expected.

Thanks & Regards,  
Selvam E.

---

<div class="post-metadata">

**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\
**Post date:** [April 28, 2020, 11:23am UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797/2 "2020-04-28T11:23:28Z")

</div>

What do you get a an error message?

---

<div class="post-metadata">

**Author:** ![Selvam\_Elangovan](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Selvam\_Elangovan](https://forum.ansible.com/u/Selvam_Elangovan)\
**Post date:** [April 29, 2020, 3:40am UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797/3 "2020-04-29T03:40:05Z")

</div>

I don’t see any error in /var/log/tower/ Seems config itself wrong under settings-\>authentication-\>ldap.

Could you please guide me here.

---

<div class="post-metadata">

**Author:** ![ffirg](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ffirg/32/10029_2.png) [@ffirg](https://forum.ansible.com/u/ffirg)\
**Post date:** [April 29, 2020, 7:20pm UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797/4 "2020-04-29T19:20:22Z")

</div>

You’re going to have to give us something to work with here.  
Can you post your tower auth lap settings? Hit the API with : [https://your\_tower/api/v2/settings/ldap/](https://infra-tower.demolab.local/api/v2/settings/ldap/)

---

<div class="post-metadata">

**Author:** ![Selvam\_Elangovan](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Selvam\_Elangovan](https://forum.ansible.com/u/Selvam_Elangovan)\
**Post date:** [April 30, 2020, 5:52am UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797/5 "2020-04-30T05:52:27Z")

</div>

Thanks. Here is the config. Please note ipa is integrated to AD hence we cannot search user accounts in ipa. The request will go to AD via group mapping.

HTTP 200 OK  
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS  
Content-Type: application/json  
Vary: Accept  
X-API-Node: awx-57c89d64df-5klj7  
X-API-Product-Name: AWX  
X-API-Product-Version: 11.1.0  
X-API-Time: 0.035s

{  
“AUTH\_LDAP\_SERVER\_URI”: “ldap://[ldap01.ipa.example.com:389](http://ldap01.ipa.example.com:389)”,  
“AUTH\_LDAP\_BIND\_DN”: “uid=admin,cn=users,cn=compat,dc=ipa,dc=example,dc=com”,  
“AUTH\_LDAP\_BIND\_PASSWORD”: “$encrypted$”,  
“AUTH\_LDAP\_START\_TLS”: false,  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_USER\_SEARCH”: [  
“cn=linux-server-admins,cn=groups,cn=accounts,dc=ipa,dc=example,dc=com”,  
“SCOPE\_SUBTREE”,  
“(sAMAccountName=%(user)s)”  
],  
“AUTH\_LDAP\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_GROUP\_TYPE”: “GroupOfNamesType”,  
“AUTH\_LDAP\_GROUP\_TYPE\_PARAMS”: {},  
“AUTH\_LDAP\_REQUIRE\_GROUP”: “cn=linux-server-admins,cn=groups,cn=accounts,dc=ipa,dc=example,dc=com”,  
“AUTH\_LDAP\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_1\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_1\_BIND\_DN”: “”,  
“AUTH\_LDAP\_1\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_1\_START\_TLS”: false,  
“AUTH\_LDAP\_1\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_1\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_1\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_1\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_1\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_1\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_1\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_1\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_1\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_1\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_1\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_1\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_2\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_2\_BIND\_DN”: “”,  
“AUTH\_LDAP\_2\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_2\_START\_TLS”: false,  
“AUTH\_LDAP\_2\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_2\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_2\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_2\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_2\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_2\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_2\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_2\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_2\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_2\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_2\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_2\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_3\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_3\_BIND\_DN”: “”,  
“AUTH\_LDAP\_3\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_3\_START\_TLS”: false,  
“AUTH\_LDAP\_3\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_3\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_3\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_3\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_3\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_3\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_3\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_3\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_3\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_3\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_3\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_3\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_4\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_4\_BIND\_DN”: “”,  
“AUTH\_LDAP\_4\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_4\_START\_TLS”: false,  
“AUTH\_LDAP\_4\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_4\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_4\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_4\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_4\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_4\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_4\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_4\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_4\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_4\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_4\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_4\_TEAM\_MAP”: {},  
“AUTH\_LDAP\_5\_SERVER\_URI”: “”,  
“AUTH\_LDAP\_5\_BIND\_DN”: “”,  
“AUTH\_LDAP\_5\_BIND\_PASSWORD”: “”,  
“AUTH\_LDAP\_5\_START\_TLS”: false,  
“AUTH\_LDAP\_5\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0,  
“OPT\_NETWORK\_TIMEOUT”: 30  
},  
“AUTH\_LDAP\_5\_USER\_SEARCH”: ,  
“AUTH\_LDAP\_5\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_5\_USER\_ATTR\_MAP”: {},  
“AUTH\_LDAP\_5\_GROUP\_SEARCH”: ,  
“AUTH\_LDAP\_5\_GROUP\_TYPE”: “MemberDNGroupType”,  
“AUTH\_LDAP\_5\_GROUP\_TYPE\_PARAMS”: {  
“member\_attr”: “member”,  
“name\_attr”: “cn”  
},  
“AUTH\_LDAP\_5\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_5\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_5\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_5\_ORGANIZATION\_MAP”: {},  
“AUTH\_LDAP\_5\_TEAM\_MAP”: {}  
}

---

<div class="post-metadata">

**Author:** ![ffirg](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ffirg/32/10029_2.png) [@ffirg](https://forum.ansible.com/u/ffirg)\
**Post date:** [April 30, 2020, 12:58pm UTC](https://forum.ansible.com/t/how-to-integrate-awx-with-redhat-idm-ipa/32797/6 "2020-04-30T12:58:42Z")

</div>

Ok, I don’t have your exact setup but do have a working integrated IPA setup (with Tower). From what I can see you’re not mapping anything into the AWX config though.

Here’s a snippet from my working config:

```auto
{
    "AUTH_LDAP_SERVER_URI": "ldap://idm8.demolab.local:389",
    "AUTH_LDAP_BIND_DN": "uid=svc-tower,CN=users,CN=accounts,DC=demolab,DC=local",
    "AUTH_LDAP_BIND_PASSWORD": "$encrypted$",
    "AUTH_LDAP_START_TLS": false,
    "AUTH_LDAP_CONNECTION_OPTIONS": {
        "OPT_REFERRALS": 0,
        "OPT_NETWORK_TIMEOUT": 30
    },
    "AUTH_LDAP_USER_SEARCH": [
        "cn=users,cn=accounts,dc=demolab,dc=local",
        "SCOPE_SUBTREE",
        "(uid=%(user)s)"
    ],
    "AUTH_LDAP_USER_DN_TEMPLATE": null,
    "AUTH_LDAP_USER_ATTR_MAP": {
        "first_name": "givenName",
        "last_name": "sn",
        "email": "mail"
    },
    "AUTH_LDAP_GROUP_SEARCH": [
        "cn=groups,cn=accounts,dc=demolab,dc=local",
        "SCOPE_SUBTREE",
        "(objectClass=ipausergroup)"
    ],
    "AUTH_LDAP_GROUP_TYPE": "GroupOfNamesType",
    "AUTH_LDAP_GROUP_TYPE_PARAMS": {
        "name_attr": "cn"
    },
    "AUTH_LDAP_REQUIRE_GROUP": "cn=tower-users,cn=groups,cn=accounts,dc=demolab,dc=local",
    "AUTH_LDAP_DENY_GROUP": null,
    "AUTH_LDAP_USER_FLAGS_BY_GROUP": {
        "is_superuser": [
            "cn=tower-admins,cn=groups,cn=accounts,dc=demolab,dc=local"
        ]
    },
    "AUTH_LDAP_ORGANIZATION_MAP": {
        "demolab": {
            "remove_admins": false,
            "remove_users": false,
            "users": true,
            "admins": [
                "cn=tower-admins,cn=groups,cn=accounts,dc=demolab,dc=local"
            ]
        }
    },
    "AUTH_LDAP_TEAM_MAP": {
        "Specialist": {
            "organization": "demolab",
            "remove": false,
            "users": "cn=specialist,cn=groups,cn=accounts,dc=demolab,dc=local"
        },
        "FSI": {
            "organization": "demolab",
            "remove": false,
            "users": "cn=fsi,cn=groups,cn=accounts,dc=demolab,dc=local"
        },
        "PubSec": {
            "organization": "demolab",
            "remove": false,
            "users": "cn=pubsec,cn=groups,cn=accounts,dc=demolab,dc=local"
        },
        "RET": {
            "organization": "demolab",
            "remove": false,
            "users": "cn=ret,cn=groups,cn=accounts,dc=demolab,dc=local"
        },
        "Alliances": {
            "organization": "demolab",
            "remove": false,
            "users": "cn=alliances,cn=groups,cn=accounts,dc=demolab,dc=local"
        },
        "MMS": {
            "organization": "demolab",
            "remove": false,
            "users": "cn=mms,cn=groups,cn=accounts,dc=demolab,dc=local"
        }
    },

```

```auto
You can see I'm mapping entries into org/team/users. 

```