Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suggested fix for SAML authentication #15219

Open
5 of 11 tasks
conrad-fox opened this issue May 23, 2024 · 0 comments
Open
5 of 11 tasks

Suggested fix for SAML authentication #15219

conrad-fox opened this issue May 23, 2024 · 0 comments
Labels
community component:awx_collection issues related to the collection for controlling AWX needs_triage type:bug

Comments

@conrad-fox
Copy link

Please confirm the following

  • I agree to follow this project's code of conduct.
  • I have checked the current issues for duplicates.
  • I understand that AWX is open source software provided for free and that I might not receive a timely response.
  • I am NOT reporting a (potential) security vulnerability. (These should be emailed to [email protected] instead.)

Bug Summary

When trying to use the collection with SAML configured for user authentication it fails to GET details on various endpoints

AWX version

4.5.6

Select the relevant components

  • UI
  • UI (tech preview)
  • API
  • Docs
  • Collection
  • CLI
  • Other

Installation method

openshift

Modifications

no

Ansible version

No response

Operating system

No response

Web browser

Chrome

Steps to reproduce

Run any module against AWX where authentication is controlled via SAML. Use user oauth token as auth mechanism

Expected results

modules should be able to connect and deploy changes to AWX

Actual results

Receiving 403 on various endpoints:

The full traceback is:
  File "/tmp/ansible_awx.awx.job_template_payload_u48uimg9/ansible_awx.awx.job_template_payload.zip/ansible_collections/awx/awx/plugins/module_utils/controller_api.py", line 506, in make_request
    response = self.session.open(
  File "/tmp/ansible_awx.awx.job_template_payload_u48uimg9/ansible_awx.awx.job_template_payload.zip/ansible/module_utils/urls.py", line 1578, in open
    r = urllib_request.urlopen(request, None, timeout)
  File "/usr/lib64/python3.9/urllib/request.py", line 214, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/lib64/python3.9/urllib/request.py", line 523, in open
    response = meth(req, response)
  File "/usr/lib64/python3.9/urllib/request.py", line 632, in http_response
    response = self.parent.error(
  File "/usr/lib64/python3.9/urllib/request.py", line 561, in error
    return self._call_chain(*args)
  File "/usr/lib64/python3.9/urllib/request.py", line 494, in _call_chain
    result = func(*args)
  File "/usr/lib64/python3.9/urllib/request.py", line 641, in http_error_default
    raise HTTPError(req.full_url, code, msg, hdrs, fp)
fatal: [localhost]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "allow_simultaneous": true,
            "ask_credential_on_launch": true,
            "ask_diff_mode_on_launch": null,
            "ask_execution_environment_on_launch": null,
            "ask_forks_on_launch": null,
            "ask_instance_groups_on_launch": null,
            "ask_inventory_on_launch": null,
            "ask_job_slice_count_on_launch": null,
            "ask_job_type_on_launch": null,
            "ask_labels_on_launch": null,
            "ask_limit_on_launch": true,
            "ask_scm_branch_on_launch": null,
            "ask_skip_tags_on_launch": null,
            "ask_tags_on_launch": null,
            "ask_timeout_on_launch": null,
            "ask_variables_on_launch": null,
            "ask_verbosity_on_launch": true,
            "become_enabled": null,
            "controller_config_file": null,
            "controller_host": "https://REDACTED",
            "controller_oauthtoken": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "controller_password": null,
            "controller_username": null,
            "copy_from": null,
            "credential": null,
            "credentials": null,
            "custom_virtualenv": null,
            "description": "Print the image tag",
            "diff_mode": null,
            "execution_environment": "REDACTED",
            "extra_vars": null,
            "force_handlers": null,
            "forks": null,
            "host_config_key": null,
            "instance_groups": null,
            "inventory": "REDACTED",
            "job_slice_count": null,
            "job_tags": null,
            "job_type": "run",
            "labels": null,
            "limit": "Enter the hostname",
            "name": "awx collection test 2",
            "new_name": null,
            "notification_templates_error": null,
            "notification_templates_started": null,
            "notification_templates_success": null,
            "organization": "REDACTED",
            "playbook": "playbooks/sample_playbook.yml",
            "prevent_instance_group_fallback": null,
            "project": "REDACTED",
            "request_timeout": null,
            "scm_branch": null,
            "skip_tags": null,
            "start_at_task": null,
            "state": "present",
            "survey_enabled": null,
            "survey_spec": null,
            "timeout": null,
            "use_fact_cache": null,
            "validate_certs": null,
            "vault_credential": null,
            "verbosity": null,
            "webhook_credential": null,
            "webhook_service": null
        }
    },
    "msg": "You don't have permission to GET to /api/v2/organizations/ (HTTP 403)."
    ```

### Additional information

Code fix suggested on `awx_collection/plugins/module_utils/controller_api.py`
    try:
        response = requests.request(
            method,
            url.geturl(),
            headers=headers,
            data=data,
        )
        response.raise_for_status()

        if 'application/json' in response.headers.get('Content-Type', ''):
            return {'status_code': response.status_code, 'json': response.json()}
        return {'status_code': response.status_code, 'json': response.content}
@github-actions github-actions bot added component:awx_collection issues related to the collection for controlling AWX needs_triage type:bug community labels May 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
community component:awx_collection issues related to the collection for controlling AWX needs_triage type:bug
Projects
None yet
Development

No branches or pull requests

1 participant