LDAPS with Ansible AWX

Archives AWX Project
1

I have a requirement to have Ansible work with LDAPS.

I have gone into the GUI and put in the correct address for LDAPS. Did not work.

I found a technical support article at RedHat that provided more to do with changing an LDAP.conf file and putting the LDAP server PEM key, did not work.

Did the same to an Ansible TOWER server that I had spun up with an EVAL license, it worked with the same steps as above.

Anyone here configure LDAPS for AWX and it works?

Thank you.

2

I do, though it works the same for me in AWX as it does in Tower.

3

What did you to to configure LDAPS? I have LDAP working, not secure LDAP (LDAPS).

4

Yoy have to create certificate In the base build of awx.

5

No that’s not how it works. Awx does it for you at build time. In the inventory file there is a variable you Put the cert in.

6

i got it to work after installation. 2 things need to happen

  • ca cert files need to be dropped into /etc/pki/ca-trust/source/anchors and then run “update-ca-trust extract” from within awx_web. To do this automatically, you might need to run docker-compose up -d again so that the containers are recreated. Make sure you drop the ca files into the directory on the Server where you specified the ca_files_dir during initial install.
  • if the containers are running centos8 you ll might need to downgrade openssl security level incase the remote ldaps endpoint isnt hardened.
    do a find under /etc for openssl.config and opensslcnf.config and change seclevel=2 to seclevel=1.
7

i edited the docker-compose and downloaded the 2 openssl files > edited them > and added them as a volume to the awx_web container. Run the docker-compose up -d after all the changes and it should work.

8

You should not have to edit the docker compose file at all. The ansible playbook templates it all for you when you run the playbook

9

yes. but the scenario i mentioned was after installation of the awx platform. Not sure if a reinstall would destroy existing configs and data.

10

IIRC when i did my installation it didnt…and after using the Redhat-cop Tower Configuration at

https://github.com/redhat-cop/tower_configuration

ALL my tower configuration is listed as code. And can be ‘reapplied’ at any time. In fact what I do is to use yaml datastructures and playbooks to drive the tower configuration.

11

Not sure if my previous reply posted properly so doing it again.
The scenario i mentioned was post installation. Not sure if a reinstall would have preserved data and configs on the existing awx instance. so far my upgrades arent preserving data.