Let an organization admin to add new users to it's tower organization

[ivarmu]

SUMMARY

Let an organization admin to add new users to it's tower organization. An organization admin must be able to create new users to it's organization (and Tower)

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

• API

AWX VERSION

Ansible Automation Platform Controller 4.1.0

ADDITIONAL INFORMATION

BEFORE:

    - name: Configure Tower local users
      ansible.controller.tower_user:
        tower_username: "{{ configure_tower_username }}"
        tower_password: "{{ configure_tower_password }}"
        tower_host: "{{ configure_tower_server_url }}"
        validate_certs: "{{ configure_tower_validate_certs }}"
        username: "userorg2"
        password: "passorg2"

 👒 ivan@iamlabp1 -  ✝  iam/Orgs/organization2   dev±  ansible-playbook  test.yml --vault-password-file .vault_pass.txt
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [localhost] *****************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [Configure Tower local users] ***********************************************************************************************************************************************************************************************************
[WARNING]: You are using the controller version of this collection but connecting to Red Hat Ansible Tower
fatal: [localhost]: FAILED! => {"changed": false, "msg": "You don't have permission to POST to /api/v2/users/ (HTTP 403)."}

PLAY RECAP ***********************************************************************************************************************************************************************************************************************************
localhost                  : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   

AFTER:

    - name: Configure Tower local users
      ansible.controller.tower_user:
        tower_username: "{{ configure_tower_username }}"
        tower_password: "{{ configure_tower_password }}"
        tower_host: "{{ configure_tower_server_url }}"
        validate_certs: "{{ configure_tower_validate_certs }}"
        username: "BBB"
        password: "BBB"
        organization: "organization1"

 👒 ivan@iamlabp1 -  ✘  ✝  iam/Orgs/organization2   dev±  cd ../organization1 
 👒 ivan@iamlabp1 -  ✝  iam/Orgs/organization1   dev±  ansible-playbook  test.yml --vault-password-file .vault_pass.txt
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [localhost] *****************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [Configure Tower local users] ***********************************************************************************************************************************************************************************************************
[WARNING]: You are using the controller version of this collection but connecting to Red Hat Ansible Tower
[WARNING]: The field password of user 77 has encrypted data and may inaccurately report task is changed.
changed: [localhost]

PLAY RECAP ***********************************************************************************************************************************************************************************************************************************
localhost                  : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[sean-m-sullivan]

Addresses issue #8982

[sean-m-sullivan]

I think this looks good, addresses the issue, and give some flexibility for user creation.

[john-westcott-iv]

I'm pretty sure this PR is going to fail the completness test (awx_collection/test/awx/test_completeness.py) because organization is not part of the UI api options page. You will need to modify the field no_api_parameter_ok for users to add in organization. i.e. change

    # user parameters to rename a user.
    'user': ['new_username'],

to:

    # new_username parameters to rename a user and organization allows for org admin user creation
    'user': ['new_username', 'organization'],

[ivarmu]

Hi!

is there anything pending I can do to improve the PR?

[john-westcott-iv]

One thing I just thought of is that I'm pretty sure the tests run as admin. Because of this, in your additional test you have effectively tested that an admin user can run the module using the org field but we haven't tested that these changes will work for an org admin trying to create a user as intended. It will be some work but it would be nice if you created a new org admin, get a token for it and then use the token to do an assertion that they can't create a user (w/o org param) and then do an assertion that they can create a user (w/ the org param). Let me know if you need any help with this.

[ivarmu]

be some work but it would be nice if you created a new org admin, get a token for it and then use the token to do an assertion that they can't create a user (w/o org param) and then do an assertion that they can create a user (w/ the org param). Let me know if you need any help with this.

Done, instead of creating a token, I've used directly a username and password for the newly created user.

[john-westcott-iv]

@ivarmu One last linting error and then we can merge this.

[ivarmu]

Fixed! 😅