External authentication users cannot create OAuth2 tokens in Ansible Automation Platform

Solution Verified - Updated -

Environment

  • Red Hat Ansible Automation Platform (Ansible Automation Platform) 2.4, 2.5, 2.6
  • Red Hat Ansible Tower

  • External authentication providers, including:

    • LDAP
    • SAML
    • Single Sign-On (SSO)
    • RADIUS
    • Other external identity providers

Issue

  • Users authenticated through an external identity provider (LDAP, SAML, SSO, RADIUS, or similar) are unable to create OAuth2 tokens.

  • Automation tasks that attempt to generate a token fail with an HTTP 403 error:

    TASK [tower_inventory] **************************************************************************************
fatal: [localhost]: FAILED! => {
    "changed": false, 
    "msg": "Failed to get token: HTTP Error 403: Forbidden", 
    "response": "{\"detail\":\"(access_denied) OAuth2 Tokens cannot be created by users associated with an external authentication provider (ldap)\"}"}

  • The following error may also be observed:

    OAuth2 Tokens cannot be created by users associated with an external authentication provider

Resolution

By default, users authenticated through external identity providers are not permitted to create OAuth2 tokens.

To allow external users to create OAuth2 tokens, enable the corresponding platform setting.

  • Ansible Automation Platform 2.5 and later

    • Navigate to:

      Settings -> Platform gateway -> Allow external users to create OAuth2 tokens

    • Set the option to Enabled.

  • Ansible Automation Platform 2.4

    • Navigate to:

      Settings → Miscellaneous Authentication → Allow external users to create OAuth2 tokens

    • Enable the setting.

  • Ansible Tower

    • Navigate to:

      Settings → System → Allow external users to create OAuth2 tokens

    • Enable the setting.

After enabling the setting, externally authenticated users can create OAuth2 tokens through the UI, API, and supported Ansible modules.

Root Cause

For security reasons, Ansible Automation Platform disables OAuth2 token creation for users authenticated through external identity providers by default.

When this restriction is enabled, token creation requests from externally authenticated users are rejected with an HTTP 403 response.

Enabling the Allow external users to create OAuth2 tokens setting overrides this default behavior and permits token creation.

Disabling the setting after tokens have been created does not remove or invalidate existing tokens.

Diagnostic Steps

  1. Configure an external authentication provider (for example, LDAP or SAML).
  2. Log in using an externally authenticated user account.
  3. Attempt to create an OAuth2 token using:
    • The UI
    • The API
    • An Ansible module that automatically generates a token

  4. Observe the request fails with:

    HTTP 403: Forbidden

  5. Verify the response contains:

    OAuth2 Tokens cannot be created by users associated with an external authentication provider
  6. Review the platform setting Allow external users to create OAuth2 tokens and confirm whether it is disabled.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments