# Use tower\_user for organization admin user

**URL:** <https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [December 4, 2020, 2:45pm UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281 "2020-12-04T14:45:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mickael\_besse](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mickael_besse/32/5343_2.png) [@mickael\_besse](https://forum.ansible.com/u/mickael_besse)\
**Post date:** [December 4, 2020, 2:45pm UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281/1 "2020-12-04T14:45:36Z")

</div>

Hello

I’m using awx collection to manage our AWX platform.  
I have an issue when an organisation admin wants to create a user with tower\_user.

He received this error “You don’t have permission to POST to /api/v2/users/ (HTTP 403).” as he can’t specify the organisation. The API call is not done to the organisation level.  
Is there a workaround for organisation admin to create user using awx collection ?

Regards

Mickael

---

<div class="post-metadata">

**Author:** ![ffirg](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ffirg/32/10029_2.png) [@ffirg](https://forum.ansible.com/u/ffirg)\
**Post date:** [December 10, 2020, 7:12pm UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281/2 "2020-12-10T19:12:09Z")

</div>

Hi Mickael

Are you trying to create a user in another organisation that the admin user is not part of? That is not allowed, as it’s considered a security loophole (that’s why you can’t specify an org)

Phil.

---

<div class="post-metadata">

**Author:** ![mickael\_besse](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mickael_besse/32/5343_2.png) [@mickael\_besse](https://forum.ansible.com/u/mickael_besse)\
**Post date:** [December 11, 2020, 9:50am UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281/3 "2020-12-11T09:50:53Z")

</div>

Hi

Here a simple tasks of what I am trying to do :

- name: AWX configuration  
hosts: localhost  
environment:  
TOWER\_USERNAME: test  
TOWER\_PASSWORD: testtest  
TOWER\_HOST: [https://XXXXXXXXX/](https://XXXXXXXXX/)  
TOWER\_VERIFY\_SSL: “false”  
collections:
- awx.awx
- community.general  
tasks:
- name: Add tower user  
tower\_user:  
username: jdoe  
password: foobarbaz  
email: [jdoe@example.org](mailto:jdoe@example.org)  
first\_name: John  
last\_name: Doe  
state: present

I received this error :

TASK [Add tower user] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [localhost]: FAILED! =\> {“changed”: false, “msg”: “You don’t have permission to POST to /api/v2/users/ (HTTP 403).”}

The user test is not system administrator but he is organisation admin of a test organisation.

The module tower\_user doesn’t got any organisation parameter. It does an API call to /api/v2/users/ , this API create a user not member to any organisation.

I would like our organisation admin to use awx.tower\_user instead of the GUI but it seems not possible.  
Any idea ?

Regards  
Mickael

---

<div class="post-metadata">

**Author:** ![ffirg](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ffirg/32/10029_2.png) [@ffirg](https://forum.ansible.com/u/ffirg)\
**Post date:** [December 11, 2020, 10:44am UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281/4 "2020-12-11T10:44:29Z")

</div>

I can’t get environment to behave properly, this maybe a bug or design omission for the module.  
Use a config file as per the module documentation and it’ll work.

---

<div class="post-metadata">

**Author:** ![mickael\_besse](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mickael_besse/32/5343_2.png) [@mickael\_besse](https://forum.ansible.com/u/mickael_besse)\
**Post date:** [December 11, 2020, 11:58am UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281/5 "2020-12-11T11:58:32Z")

</div>

Yes, it works as the admin user:

TASK [Add tower user] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
changed: [localhost]

---

<div class="post-metadata">

**Author:** ![ffirg](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ffirg/32/10029_2.png) [@ffirg](https://forum.ansible.com/u/ffirg)\
**Post date:** [December 11, 2020, 2:51pm UTC](https://forum.ansible.com/t/use-tower-user-for-organization-admin-user/34281/6 "2020-12-11T14:51:31Z")

</div>

So I’m assuming the org admin role doesn’t have permissions to hit the API endpoint, only admin.