# LDAP mappings and Role/Permissions assigment **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [December 4, 2019, 7:45pm UTC](https://forum.ansible.com/t/ldap-mappings-and-role-permissions-assigment/31761 "2019-12-04T19:45:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Nik\_Tetteh-Lartey](https://avatars.discourse-cdn.com/v4/letter/n/9e8a1a/32.png) [@Nik\_Tetteh-Lartey](https://forum.ansible.com/u/Nik_Tetteh-Lartey)\ **Post date:** [December 4, 2019, 7:45pm UTC](https://forum.ansible.com/t/ldap-mappings-and-role-permissions-assigment/31761/1 "2019-12-04T19:45:21Z")
Hi Team, I have been looking at the LDAP to awx mapping in the ldap settings part of AWX 9.x. I can see how to get crude admin/auditor rights assigned to teams/Orgs and users, for example. But I’m lost to know if it is possible to map/assign/json-code in the same LDAP configurations, some of the more detailed elements of roles existing in the GUI such as USE, EXECUTE, READ, UPDATE etc, on users, jobs, inventories, projects, orgs and teams etc as described in [https://docs.ansible.com/ansible-tower/latest/html/userguide/projects.html](https://docs.ansible.com/ansible-tower/latest/html/userguide/projects.html) or is this just not possible except with post processing of existing users by the gui? Is there such a mechanism for specifying RBAC json code in the LDAP settings or I’m I stuck with using the GUI to get my finer grained RBAC completed? Best Regards, Nik ---
**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\ **Post date:** [December 4, 2019, 7:55pm UTC](https://forum.ansible.com/t/ldap-mappings-and-role-permissions-assigment/31761/2 "2019-12-04T19:55:47Z")
Your correct, GUI only. But remember, the GUI is just another consumer of the API. You can use the API in automated scripts to accomplish your finer grained RBAC settings. ---
**Author:** ![Jesse\_Keating1](https://avatars.discourse-cdn.com/v4/letter/j/eb9ed0/32.png) [@Jesse\_Keating1](https://forum.ansible.com/u/Jesse_Keating1)\ **Post date:** [December 4, 2019, 7:58pm UTC](https://forum.ansible.com/t/ldap-mappings-and-role-permissions-assigment/31761/3 "2019-12-04T19:58:54Z")
I believe the convention is to create mappings between LDAP groups and AWX Teams. Then you can create role permissions at the team level. In fact, this is the only way you can do things reliably, as trying to set permissions at the USER level will fail until the user has actually logged into AWX for the first time (which causes the account creation). Personally I make use of the “tower\_role” Ansible module to configure roles within an Ansible playbook. ---
**Author:** ![Konstantin1](https://avatars.discourse-cdn.com/v4/letter/k/e495f1/32.png) [@Konstantin1](https://forum.ansible.com/u/Konstantin1)\ **Post date:** [December 5, 2019, 10:09am UTC](https://forum.ansible.com/t/ldap-mappings-and-role-permissions-assigment/31761/4 "2019-12-05T10:09:49Z")
Hi Nik, You can use the following ansible modules for RBAC management: - [tower\_role – create, update, or destroy Ansible Tower role](https://docs.ansible.com/ansible/latest/modules/tower_role_module.html#tower-role-module) - [tower\_settings – Modify Ansible Tower settings](https://docs.ansible.com/ansible/latest/modules/tower_settings_module.html#tower-settings-module) - [tower\_team – create, update, or destroy Ansible Tower team](https://docs.ansible.com/ansible/latest/modules/tower_team_module.html#tower-team-module) - [tower\_user – create, update, or destroy Ansible Tower user](https://docs.ansible.com/ansible/latest/modules/tower_user_module.html#tower-user-module) There’re is quite a number of other ansible tower\_\* modules for managing Tower/AWX: [https://docs.ansible.com/ansible/latest/modules/list\_of\_all\_modules.html](https://docs.ansible.com/ansible/latest/modules/list_of_all_modules.html) Cli tools and raw API can be used for unsupported cases. Konstantin.