User Management based on Azure AD Groups

Get Help
, ,
1

I’m sure I’m missing something incredibly obvious, but I’m struggling to see what it is and hoping someone here can assist.

We have an integration with Azure AD for user authentication. I would like users to be added to teams and organizations based on their Azure AD security group rather than having to add them as individuals.

When I go to the documentation I only see an ability to add users based on their account identifier (emails in the example):
18. Setting up Social Authentication — Automation Controller Administration Guide v4.0.0 (ansible.com)

Is there something I can put in the admin/users field other than their direct login to tell it to check the user’s group membership and add them based on that? A regex on the user’s account identifier will not work as there’s nothing there that would assist in mapping to group membership.

Thanks!

2

@fhomess Did you ever figure this out, I am running into the same issue and can’t seem to get the org/teams to map to the members of the AzureAD group.

3

I did not, unfortunately.

4

You can do this with LDAP, but it does not look like it is possible with Azure AD.

5

@fhomess Before I go the route of SAML, are you using the AzureAD with Oauth or SAML?

@jiholland unfortunately in our environment the enterprise is pushing AzureAD to move away from LDAP.

6

@cmalarick15 We’re using AzureAD with Oauth.

7

@fhomess are you still manually adding each user or is there another method? I am working with my internal SSO team to see if we have any other options but we seem to be striking out as of now.

8

Why not use the API? awx.awx.user module – create, update, or destroy Automation Platform Controller users. — Ansible Community Documentation

9

Hello, new to the forum…Setting up SSO on most of our tools… Setting up Azure AD with our Ansible AWX… Got most setting correct but getting AADSTS900971: No reply address provided. It says got the wrong redirect URI… just not sure where to check. Thanks

10

Use SAML authentication, you can map groups to teams with the SAML Team Attribute Mapping.
https://docs.ansible.com/ansible-tower/latest/html/administration/ent_auth.html#saml-authentication-settings

1 Like
11

Thanks for the link. I was able to get the value to put in for the redirect URI on th ENTRA side.

12

I’m also running into the limitation of Azure AD not letting me map users to teams based on their AD groups or to make them super users, like we currently do with LDAP.

Another team is looking at SAML, which is much more complex of a configuration, but hopefully it will still let us use the AD groups.