Role-based Access Control (RBAC)

In this exercise you will explore how Ansible Automation Controller handles user and group management through Role-Based Access Control (RBAC). You will create a user, organize them into a team, grant scoped permissions on a job template, and verify that the restricted user can only see and run what they have been granted access to.

Ansible Automation Controller Users

There are three types of users in Ansible Automation Controller:

  • Normal User: Has read and write access limited to assigned inventories and projects.

  • Ansible Automation Platform Auditor: Read-only access to all objects within the automation controller environment.

  • Ansible Automation Platform Administrator: Full admin privileges over the entire automation controller installation.

Let’s create a user:

  1. Navigate to Access Management → Users.

  2. Click the Create user button.

  3. Fill in the following values:

Parameter Value

Username

wweb

Password

ansible

Confirm password

ansible

First name

Werner

Last name

Web

Email

wweb@example.com

User type

Normal user

Organizations

Default

  1. Click Create user.

create user

Ansible Automation Controller Teams

Teams are subdivisions of an organization that include users, projects, credentials, and permissions, helping to implement RBAC efficiently.

Create a Team:

  1. Navigate to Access Management → Teams.

  2. Click the Create team button and create a team named Web Content within the Default organization.

  3. Click Create team.

Add a User to the Team:

  1. Navigate to Access Management → Users and select the wweb user.

  2. Click the Teams tab.

  3. Click Assign teams, select Web Content, and click Confirm.

users list

Granting Permissions

To grant users the ability to execute tasks, permissions need to be set.

Grant Permission to Use a Template:

  1. Navigate to Automation Execution → Templates.

  2. Select the template Create index.html.

  3. Click the User Access tab.

  4. Click Assign users.

  5. In Select user(s), check the box for wweb and click Next.

  6. In Select roles to apply, choose JobTemplate Admin and/or JobTemplate Execute, depending on the required level of access, then click Next.

  7. Review the selections and click Finish.

Testing Permissions

Now, log out and log in again as the wweb user.

  1. Navigate to Automation Execution → Templates. You should only see the Create index.html template listed.

  2. Run the job by selecting Launch template. Enter the required values for the survey questions and launch the job.

Once the job completes, log back in as admin and verify the result using Run Command:

  1. Go to Automation Execution → Infrastructure → Inventories → Workshop Inventory and open the Hosts tab.

  2. Select node01 and node02, then click Run Command.

  3. In the Details window, set Module to command and Arguments to curl http://localhost. Click Next.

  4. In the Execution Environment window, select Default execution environment. Click Next.

  5. In the Credential window, select Workshop Credentials. Click Next.

  6. Review your inputs and click Finish.

Verify that the output contains the content set by wweb in the survey.

Think about what you just accomplished. You enabled a restricted user to run an Ansible playbook:

  • Without having access to the credentials

  • Without being able to change the playbook itself

  • But with the ability to change variables you predefined

This is one of the main strengths of Ansible Automation Controller — delegating the power to execute automation without handing out credentials or exposing the underlying code.
Taking Self-Service Further

The RBAC model you just configured works great inside automation controller, but what if your end users didn’t have to log into controller at all?

AAP offers a Self-Service Portal — a separate web interface that presents approved job templates as a simple catalog of actions. A user like wweb would open the portal, see a tile for "Deploy Web Content", fill in a short form, and click run — no knowledge of Ansible or controller required. The same RBAC rules you configure in controller govern what each user can see and launch in the portal.

Summary

In this exercise you:

  • Created a new user (wweb) in automation controller

  • Organized the user into a Team for RBAC management

  • Granted scoped permissions on a specific job template

  • Verified that the restricted user can only see and execute permitted templates