Info on AWX RBAC changes pending release

Project Discussions
1

A few heads-up related to backend changes to the Role-based access control system in AWX, this was merged in:

This was mentioned in some community meetings lately, and I’m excited for it to go out in a release. Key points:

  • This changes the internals of the system in the backend, but adds a compatibility layer so the “old” roles API still exists temporarily
  • The updated UI to use the new system isn’t ready yet, so we are basically shipping the new backend system with the old UI, which will relay on the backwards API support
  • New functionality, specifically custom roles, are possible using direct API clients or the API browser. You can use this, but the presentation in the UI might not be complete.

The main new thing this enables is creating custom roles which can be done via the /api/v2/role_definitions/ endpoint. Then these can only be assigned using the new endpoints, /api/v2/role_user_assignments/ and /api/v2/role_team_assignments/.

If you absolutely don’t want to allow custom roles, you can change the setting ANSIBLE_BASE_ALLOW_CUSTOM_ROLES to False. This is still a file-based setting for now.

The feature I believe will be most useful going forward is the “add” permissions. You could create a custom organization role that allows users to create all (or some) types of resources, and give this for a particular organization. So instead of allowing a user to edit all projects, they can create a new project, and after creating it, they will automatically get admin role just for the objects they created.

4 Likes
2

We had a major error in the data migration for this. A fix for the issue was merged, and we’ll see about a new release before long.

3

hello, where can we get the full list of permissions? or the logic to follow?
is it something like

awx.<action>.<resource>

where:
<action>: [execute, view, write, delete]
<resource>: [jt, wt, project, organization, inventory, credential] ?

also why using view instead of read?

EXAMPLES = '''
- name: Create Role Definition
  role_definition:
    name: test_view_jt
    permissions:
      - awx.view_jobtemplate
      - awx.execute_jobtemplate
    content_type: awx.jobtemplate
    description: role definition to view and execute jt
    state: present
'''```
4

@AlanCoding , banging my head against the wall ATM. I try to either use AWX CLI ( 24.6.1 ), api endpoints from ui , or awx.awx modules to assign role_team_assignments rbac to teams. However i do not get it to work. am i missing a dependency?

I always receive Invalid PK

Error from CLI:

image
image1126×191 45.6 KB

what i can see from when creating an assignment from the UI, the deprecated
/api/v2/roles is used to create a new role, that is visible from cli via deprecated awx roles list
However, i cannot create that from CLI.
I assume this is a bug in api/v2/role_team_assignments ?
or am i missing something ?

5

here is a quick question about the NEW RBAC.
when I looked up “/api/v2/role_definitions/”, there are two permissions for adhoc_inventory.
they seems to have a bit different permissions.
when I add permission for inventory adhoc on awx web UI, the “Inventory Adhoc Compat” is added, not “Inventory Adhoc”.
When I want to give a user to have “Adhoc” for a single inventory, I should give the user “Adhoc” or “Adhoc Compat” ?
if i give “Adhoc”, then the user can run only “Adhoc”, not “View the inventory”?? it does not make sense, thou. please let me clear the new concept.
thank you in advance.

           ...

        { ..
            "permissions": [
                "awx.adhoc_inventory",
                "awx.view_inventory"
            ],
            "content_type": "awx.inventory",
            ...
            "name": "Inventory Adhoc",
            "description": "Has adhoc permissions to a single inventory",
           ...
        }
           ...
        {...
            "permissions": [
                "awx.adhoc_inventory",
                "awx.use_inventory",
                "awx.view_inventory"
            ],
            "content_type": "awx.inventory",
           ...
            "name": "Inventory Adhoc Compat",
            "description": "Has Adhoc permission to Inventory for backwards API compatibility",
           ...
        }