# Info on AWX RBAC changes pending release **URL:** \ **Category:** Project Discussions\ **Tags:** awx\ **Created:** [April 23, 2024, 6:40pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104 "2024-04-23T18:40:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\ **Post date:** [April 23, 2024, 6:40pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/1 "2024-04-23T18:40:58Z")
A few heads-up related to backend changes to the Role-based access control system in AWX, this was merged in: [https://github.com/ansible/awx/pull/14905](https://github.com/ansible/awx/pull/14905) This was mentioned in some community meetings lately, and I’m excited for it to go out in a release. Key points: - This changes the internals of the system in the backend, but adds a compatibility layer so the “old” roles API still exists temporarily - The updated UI to use the new system isn’t ready yet, so we are basically shipping the new backend system with the old UI, which will relay on the backwards API support - New functionality, specifically custom roles, are possible using direct API clients or the API browser. You can use this, but the presentation in the UI might not be complete. The main new thing this enables is creating _custom roles_ which can be done via the /api/v2/role\_definitions/ endpoint. Then these can only be assigned using the new endpoints, /api/v2/role\_user\_assignments/ and /api/v2/role\_team\_assignments/. If you absolutely don’t want to allow custom roles, you can change the setting `ANSIBLE_BASE_ALLOW_CUSTOM_ROLES` to False. This is still a file-based setting for now. The feature I believe will be most useful going forward is the “add” permissions. You could create a custom organization role that allows users to create all (or some) types of resources, and give this for a particular organization. So instead of allowing a user to edit all projects, they can create a new project, and after creating it, they will automatically get admin role just for the objects they created. ---
**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\ **Post date:** [April 24, 2024, 7:54pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/2 "2024-04-24T19:54:57Z")
> > > \### Please confirm the following > > \- \[X\] I agree to follow this project's \[code o…f conduct\](https://docs.ansible.com/ansible/latest/community/code\_of\_conduct.html). > \- \[X\] I have checked the \[current issues\](https://github.com/ansible/awx/issues) for duplicates. > \- \[X\] I understand that AWX is open source software provided for free and that I might not receive a timely response. > \- \[X\] I am \*\*NOT\*\* reporting a (potential) security vulnerability. (These should be emailed to \`security@ansible.com\` instead.) > > \### Bug Summary > > awx-migration-24.3.0 failing with following error: > > \`\`\` > Operations to perform: > Apply all migrations: auth, conf, contenttypes, dab\_rbac, dab\_resource\_registry, main, oauth2\_provider, sessions, sites, social\_django, sso > Running migrations: > 2024-04-24 11:57:29,309 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Project Admin pk=RoleDefinition object (156) with 5 permissions > 2024-04-24 11:57:29,313 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Project Admin pk=RoleDefinition object (157) with 7 permissions > 2024-04-24 11:57:29,317 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Project Use pk=RoleDefinition object (158) with 2 permissions > 2024-04-24 11:57:29,321 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition WorkflowJobTemplate Admin pk=RoleDefinition object (159) with 5 permissions > 2024-04-24 11:57:29,325 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization WorkflowJobTemplate Admin pk=RoleDefinition object (160) with 7 permissions > 2024-04-24 11:57:29,329 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition WorkflowJobTemplate Execute pk=RoleDefinition object (161) with 2 permissions > 2024-04-24 11:57:29,333 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition WorkflowJobTemplate Approve pk=RoleDefinition object (162) with 2 permissions > 2024-04-24 11:57:29,338 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition JobTemplate Admin pk=RoleDefinition object (163) with 4 permissions > 2024-04-24 11:57:29,342 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization JobTemplate Admin pk=RoleDefinition object (164) with 5 permissions > 2024-04-24 11:57:29,346 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition JobTemplate Execute pk=RoleDefinition object (165) with 2 permissions > 2024-04-24 11:57:29,350 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition NotificationTemplate Admin pk=RoleDefinition object (166) with 3 permissions > 2024-04-24 11:57:29,354 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization NotificationTemplate Admin pk=RoleDefinition object (167) with 5 permissions > 2024-04-24 11:57:29,358 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Team Admin pk=RoleDefinition object (168) with 4 permissions > 2024-04-24 11:57:29,362 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Team Admin pk=RoleDefinition object (169) with 6 permissions > 2024-04-24 11:57:29,366 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Team Member pk=RoleDefinition object (170) with 2 permissions > 2024-04-24 11:57:29,370 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Admin pk=RoleDefinition object (171) with 5 permissions > 2024-04-24 11:57:29,374 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Organization Admin pk=RoleDefinition object (172) with 5 permissions > 2024-04-24 11:57:29,378 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Member pk=RoleDefinition object (173) with 2 permissions > 2024-04-24 11:57:29,382 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Audit pk=RoleDefinition object (174) with 2 permissions > 2024-04-24 11:57:29,386 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Inventory Admin pk=RoleDefinition object (175) with 6 permissions > 2024-04-24 11:57:29,390 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Inventory Admin pk=RoleDefinition object (176) with 8 permissions > 2024-04-24 11:57:29,394 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Inventory Use pk=RoleDefinition object (177) with 2 permissions > 2024-04-24 11:57:29,398 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Inventory Adhoc pk=RoleDefinition object (178) with 2 permissions > 2024-04-24 11:57:29,402 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Credential Admin pk=RoleDefinition object (179) with 4 permissions > 2024-04-24 11:57:29,406 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization Credential Admin pk=RoleDefinition object (180) with 6 permissions > 2024-04-24 11:57:29,410 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Credential Use pk=RoleDefinition object (181) with 2 permissions > 2024-04-24 11:57:29,414 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition InstanceGroup Admin pk=RoleDefinition object (182) with 4 permissions > 2024-04-24 11:57:29,418 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization InstanceGroup Admin pk=RoleDefinition object (183) with 5 permissions > 2024-04-24 11:57:29,422 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition InstanceGroup Use pk=RoleDefinition object (184) with 2 permissions > 2024-04-24 11:57:29,426 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition ExecutionEnvironment Admin pk=RoleDefinition object (185) with 3 permissions > 2024-04-24 11:57:29,430 INFO \[-\] awx.main.migrations.\_dab\_rbac Created RoleDefinition Organization ExecutionEnvironment Admin pk=RoleDefinition object (186) with 5 permissions > Traceback (most recent call last): > File "/usr/bin/awx-manage", line 8, in \ > sys.exit(manage()) > ^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/awx/\_\_init\_\_.py", line 177, in manage > execute\_from\_command\_line(sys.argv) > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/core/management/\_\_init\_\_.py", line 442, in execute\_from\_command\_line > utility.execute() > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/core/management/\_\_init\_\_.py", line 436, in execute > self.fetch\_command(subcommand).run\_from\_argv(self.argv) > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/core/management/base.py", line 412, in run\_from\_argv > self.execute(\*args, \*\*cmd\_options) > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/core/management/base.py", line 458, in execute > output = self.handle(\*args, \*\*options) > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/core/management/base.py", line 106, in wrapper > res = handle\_func(\*args, \*\*kwargs) > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/core/management/commands/migrate.py", line 356, in handle > post\_migrate\_state = executor.migrate( > ^^^^^^^^^^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/db/migrations/executor.py", line 135, in migrate > state = self.\_migrate\_all\_forwards( > ^^^^^^^^^^^^^^^^^^^^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/db/migrations/executor.py", line 167, in \_migrate\_all\_forwards > state = self.apply\_migration( > ^^^^^^^^^^^^^^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/db/migrations/executor.py", line 252, in apply\_migration > state = migration.apply(state, schema\_editor) > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/db/migrations/migration.py", line 132, in apply > operation.database\_forwards( > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/django/db/migrations/operations/special.py", line 193, in database\_forwards > self.code(from\_state.apps, schema\_editor) > File "/var/lib/awx/venv/awx/lib64/python3.11/site-packages/awx/main/migrations/\_dab\_rbac.py", line 200, in migrate\_to\_new\_rbac > role\_definition\_name = f'{role.content\_type.model\_class().\_\_name\_\_} {action.title()}' > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > AttributeError: 'ContentType' object has no attribute 'model\_class' > Applying main.0192\_custom\_roles... > \`\`\` > > \### AWX version > > 24.3.0 > > \### Select the relevant components > > \- \[\] UI > \- \[\] UI (tech preview) > \- \[\] API > \- \[\] Docs > \- \[\] Collection > \- \[\] CLI > \- \[X\] Other > > \### Installation method > > kubernetes > > \### Modifications > > no > > \### Ansible version > > \_No response\_ > > \### Operating system > > \_No response\_ > > \### Web browser > > \_No response\_ > > \### Steps to reproduce > > upgrade ax-operator > > \### Expected results > > all working > > \### Actual results > > migration failed > > \### Additional information > > \_No response\_ We had a major error in the data migration for this. A fix for the issue was merged, and we’ll see about a new release before long. ---
**Author:** ![cnfrancis](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cnfrancis/32/2615_2.png) [@cnfrancis](https://forum.ansible.com/u/cnfrancis)\ **Post date:** [July 8, 2024, 11:48pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/3 "2024-07-08T23:48:19Z")
hello, where can we get the full list of permissions? or the logic to follow? is it something like > awx.\.\ where: \: [execute, view, write, delete] \: [jt, wt, project, organization, inventory, credential] ? also why using view instead of read? ````auto EXAMPLES = ''' - name: Create Role Definition role_definition: name: test_view_jt permissions: - awx.view_jobtemplate - awx.execute_jobtemplate content_type: awx.jobtemplate description: role definition to view and execute jt state: present '''``` ```` ---
**Author:** ![bottkars](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bottkars/32/4414_2.png) [@bottkars](https://forum.ansible.com/u/bottkars)\ **Post date:** [August 8, 2024, 11:08am UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/4 "2024-08-08T11:08:48Z")
@AlanCoding , banging my head against the wall ATM. I try to either use AWX CLI ( 24.6.1 ), api endpoints from ui , or awx.awx modules to assign role\_team\_assignments rbac to teams. However i do not get it to work. am i missing a dependency? I always receive Invalid PK Error from CLI: ![image](https://us1.discourse-cdn.com/ansible/original/2X/2/2f49f275f49c8cae93d7368c32b3790f39b5bf73.png) what i can see from when creating an assignment from the UI, the deprecated /api/v2/roles is used to create a new role, that is visible from cli via deprecated awx roles list However, i cannot create that from CLI. I assume this is a bug in api/v2/role\_team\_assignments ? or am i missing something ? ---
**Author:** ![yoonmin1030](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/yoonmin1030/32/2742_2.png) [@yoonmin1030](https://forum.ansible.com/u/yoonmin1030)\ **Post date:** [October 8, 2024, 3:44am UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/5 "2024-10-08T03:44:17Z")
here is a quick question about the NEW RBAC. when I looked up “/api/v2/role\_definitions/”, there are two permissions for adhoc\_inventory. they seems to have a bit different permissions. when I add permission for inventory adhoc on awx web UI, the “Inventory Adhoc Compat” is added, not “Inventory Adhoc”. When I want to give a user to have “Adhoc” for a single inventory, I should give the user “Adhoc” or “Adhoc Compat” ? if i give “Adhoc”, then the user can run only “Adhoc”, not “View the inventory”?? it does not make sense, thou. please let me clear the new concept. thank you in advance. ```auto ... { .. "permissions": [ "awx.adhoc_inventory", "awx.view_inventory" ], "content_type": "awx.inventory", ... "name": "Inventory Adhoc", "description": "Has adhoc permissions to a single inventory", ... } ... {... "permissions": [ "awx.adhoc_inventory", "awx.use_inventory", "awx.view_inventory" ], "content_type": "awx.inventory", ... "name": "Inventory Adhoc Compat", "description": "Has Adhoc permission to Inventory for backwards API compatibility", ... } ``` ---
**Author:** ![cnfrancis](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cnfrancis/32/2615_2.png) [@cnfrancis](https://forum.ansible.com/u/cnfrancis)\ **Post date:** [July 23, 2025, 6:34pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/6 "2025-07-23T18:34:08Z")
@AlanCoding gentle ping on this. I have this situation where users need to be able to cancel job spawned by automation users they owned without needed to be an admin of the organization since it is shared by different teams. I checked in the official redhat doc for AAP and nothing came up. Do you know know what permissions I need? is it **awx.job\_cancel**? Like so? ```auto - name: Create custom job definition role_definition: name: Cancel_Jobs permissions: - awx.job_cancel description: role definition for cancelling job within an organization state: present ``` @Denney-tech sorry to ping you, but would you know about any doc listing all permissions? Note: I checked `api/v2/role_definitions/` and nothing as well there for canceling jobs ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [July 24, 2025, 7:06pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/7 "2025-07-24T19:06:36Z")
According to the [userguide](https://ansible.readthedocs.io/projects/awx/en/24.6.1/userguide/rbac.html#custom-roles), > [@](#): > > (Alan will provide an endpoint containing dictionary for available permissions based on content type (The UI can use this to maintain static readable translatable texts on the client side) TBD) As of the documentation for `24.6.1`, there is no method for listing all the available permissions. I’m not sure where or if there’s any RBAC documentation for `latest`. Pinging @AlanCoding to confirm. ---
**Author:** ![cnfrancis](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/cnfrancis/32/2615_2.png) [@cnfrancis](https://forum.ansible.com/u/cnfrancis)\ **Post date:** [July 26, 2025, 7:28pm UTC](https://forum.ansible.com/t/info-on-awx-rbac-changes-pending-release/5104/8 "2025-07-26T19:28:43Z")
yeah i had to skim the codebase, its hardcoded there that if you’re not an admin then you cannot cancel a job you havent triggered. snippet in question: [awx/awx/main/access.py at 7977e8639cc3cbdea666d74786d3fc33a57c6359 · ansible/awx · GitHub](https://github.com/ansible/awx/blob/7977e8639cc3cbdea666d74786d3fc33a57c6359/awx/main/access.py#L1739) ```auto def can_cancel(self, obj): if not obj.can_cancel: return False # Users may always cancel their own jobs if self.user == obj.created_by: return True # Users with direct admin to JT may cancel jobs started by anyone if obj.job_template and self.user in obj.job_template.admin_role: return True # If orphaned, allow org JT admins to stop running jobs if not obj.job_template and obj.organization and self.user in obj.organization.job_template_admin_role: return True return False ``` as always ty for the help @Denney-tech