• Zach Biles

AWX LDAP/Active Directory Authentication

An issue I ran into the other day when trying to setup Active Directory authentication in Ansible AWX, using LDAP auth type. These are a couple things that aren't exactly called out in the documentation from Red Hat, and might not be obvious to all.

  1. You can use ldap:// if you aren't setup for ldaps:// (secure LDAP). Just modify your LDAP Server URI as in the image above. Obviously this is not secure or recommended, but in a lab environment, or to just get you up and going when you aren't setup for ldaps, it will work.

  2. Make sure to use the full distinguished name for the Bind DN. Some guides online say to just use the username. I was unable to get this to work, so your mileage may vary.

  3. Specific to Active Directory, change your LDAP group type, to "ActiveDirectoryGroupType". Otherwise the group attributes won't match correctly.

  4. Set LDAP Group Type Parameters. Set that like the code snippet below.

  5. The remaining fields should all be pretty straightforward. Just make sure to use full LDAP paths in the places required. You can use PowerShell to get these really easily if you know the group or usernames that you need. This will save you a bunch of typing. (code below)


#LDAP Group Type Parameters
{
  "name_attr": "Name"
}


#powershell for distinguished names
Get-ADUser <username> -Properties name,distinguishedName
Get-ADGroup <groupname> -Properties name,distinguishedName


I'm still toying around with some of the other parameters like "admins, and "remove" in case there are any gotchas there, but so far they seem to work as advertised.


3 views

Recent Posts

See All

Ansible/AWX Custom Credential Types

Sometimes in Ansible you need to support legacy devices, or API’s that require hard coded passwords or API strings in your playbooks. One way around this is to use custom credential objects in AWX/Tow

Useful Ansible Ad-Hoc Commands

Ansible doesn’t always have to be crazy complex playbooks doing super cool stuff. Sometimes, it’s really useful to get some output from al your devices like versioning, VLANs, IP addresses, etc... Her

Ansible Inventory Scripts

# TIL It appears that you are required to use a .ini file with inventory scripts in Ansible. If you try and use static variables in the script, it will appear to work when running the raw Python or wh

LINKS
ABOUT

info@sisulink.com

Inside TechTank

3709 1st Ave

Hibbing, MN 55746, USA

SOCIAL
  • sisuLink on Facebook!

© 2020 sisuLink.