Chapter 2. Getting started as a platform administrator
Chapter 2. Getting started as a platform administrator As a platform administrator, Ansible Automation Platform can help you enable your users and teams to develop and run automation. This guide walks you through the basic steps to get set up as an administrator for Ansible Automation Platform, including configuring and maintaining the platform for users. To get started as an administrator, see the following: Logging in for the first time Configure authentication Managing user access with role-based access control 2.1. Logging in for the first time Log in to the Ansible Automation Platform as an administrator and enter your subscription information. You can then create user profiles and assign roles. Procedure With the login information provided after your installation completed, open a web browser and log in to Red Hat Ansible Automation Platform by navigating to its server URL at: https://<AAP_SERVER_NAME>/ Use the credentials specified during the installation process to login: The default username is admin . The password for admin is the value specified during installation. After your first login, you are prompted to add your subscription manifest. Procedure You can select between uploading a copy of your subscription manifest or entering your login credentials to find the subscription associated with your profile: To upload a subscription manifest, drag the file to the field beneath Red Hat subscription manifest or browse for the file on your local machine. To find your subscription, click the tab labeled Username / password and enter your credentials. Your subscription appears in the list menu labeled Subscription . Select your subscription. After you have added your subscription, click . On the screen labeled Analytics , check the box if you want to share data with Red Hat and click . Check the box indicating that you agree to the End User License Agreement . Review your information and click Finish . Tip After logging in, review the quick starts section for useful guidance. 2.2. Configure authentication After your first login as an administrator you must configure authentication for your users. Depending on your organization's needs and resources, you can either: Set up authentication by creating users, teams, and organizations manually. Use an external source such as GitHub to configure authentication for your system. 2.3. Managing user access with role-based access control Role-based access control (RBAC) restricts user access based on their role within an organization. The roles in RBAC refer to the levels of access that users have to the network. You can control what users can do with the components of Ansible Automation Platform at a broad or granular level depending on your RBAC policy. You can select whether the user is a system administrator or normal user and align roles and access permissions with their positions within the organization. You can define roles with many permissions that can then be assigned to resources, teams, and users. The permissions that make up a role dictate what the assigned role allows. Permissions are allocated with only the access needed for a user to perform the tasks appropriate for their role. 2.4. Creating an organization Ansible Automation Platform automatically creates a default organization. If you have a self-support level license, you have only the default organization available and cannot delete it. Procedure From the navigation panel, select Access Management Organizations . Click Create organization . Enter the Name and optionally provide a Description for your organization. Note If automation controller is enabled on the platform, continue with Step 4. Otherwise, proceed to Step 6. Select the name of the Execution environment or search for one that exists that members of this team can run automation. Enter the name of the Instance Groups on which to run this organization. Optional: Enter the Galaxy credentials or search from a list of existing ones. Select the Max hosts for this organization. The default is 0. When this value is 0, it signifies no limit. If you try to add a host to an organization that has reached or exceeded its cap on hosts, an error message displays: You have already reached the maximum number of 1 hosts allowed for your organization. Contact your System Administrator for assistance. Click . If you selected more than 1 instance group, you can manage the order by dragging and dropping the instance group up or down in the list and clicking Confirm . Note The execution precedence is determined by the order in which the instance groups are listed. Click and verify the organization settings. Click Finish . 2.5. Creating a team You can create new teams, assign an organization to the team, and manage the users and administrators associated with each team. Users associated with a team inherit the permissions associated with the team and any organization permissions to which the team has membership. To add a user or administrator to a team, the user must have already been created. Procedure From the navigation panel, select Access Management Teams . Click Create team . Enter a Name and optionally give a Description for the team. Select an Organization to be associated with this team. Note Each team can only be assigned to one organization. Click Create team . The Details page opens, where you can review and edit your team information. 2.6. Creating a user There are three types of users in Ansible Automation Platform: Normal user Normal users have read and write access limited to the resources (such as inventory, projects, and job templates) for which that user has been granted the appropriate roles and privileges. Normal users are the default type of user. Ansible Automation Platform Administrator An administrator (also known as a Superuser) has full system administration privileges - with full read and write privileges over the entire installation. An administrator is typically responsible for managing all aspects of and delegating responsibilities for day-to-day work to various users. Ansible Automation Platform Auditor Auditors have read-only capability for all objects within the environment. Procedure From the navigation panel, select Access Management Users . Click Create user . Enter the details about your new user in the fields on the Create user page. Fields marked with an asterisk (*) are required. Normal users are the default when no User type is specified. To define a user as an administrator or auditor, select a User type checkbox. Note If you are modifying your own password, log out and log back in again for it to take effect. Select the Organization to be assigned for this user. For information about creating a new organization, refer to Creating an organization . Click Create user . When the user is successfully created, the User dialog opens. From here, you can review and modify the user's Teams, Roles, Tokens and other membership details. Note If the user is not newly-created, the details screen displays the last login activity of that user. If you log in as yourself, and view the details of your user profile, you can manage tokens from your user profile by selecting the Tokens tab. 2.7. Configuring GitHub authentication You can connect GitHub identities to Ansible Automation Platform using OAuth. To set up GitHub authentication, you need to obtain an OAuth2 key and secret by registering your organization-owned application from GitHub using the registering the new application with GitHub . The OAuth2 key (Client ID) and secret (Client Secret) are used to supply the required fields in the UI. To register the application, you must supply it with your webpage URL, which is the Callback URL shown in the Authenticator details for your authenticator configuration. Procedure From the navigation panel, select Access Management Authentication Methods . Click Create authentication . Select GitHub from the Authentication type list and click . Enter a Name for this authentication configuration. When the application is registered, GitHub displays the Client ID and Client Secret : Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator. Note Values defined in this field override the dedicated fields provided in the UI. To automatically create organizations, users, and teams upon successful login, select Create objects . To enable this authentication method upon creation, select Enabled . To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users . Click . Verification To verify that the authentication is configured correctly, log out of Ansible Automation Platform and check that the login screen displays the logo of your authentication chosen method to enable logging in with those credentials. steps To control which users are allowed into the Ansible Automation Platform server, and placed into Ansible Automation Platform organizations or teams based on their attributes (like username and email address) or to what groups they belong, continue to Mapping .
You have already reached the maximum number of 1 hosts allowed for your organization. Contact your System Administrator for assistance.