Authentication and access management changes when upgrading to 2.7

In Ansible Automation Platform 2.7, all authentication has been consolidated through platform gateway. Direct API access to individual platform components has been removed.

Important

Only upgrades from Ansible Automation Platform 2.6 to 2.7 are supported. If you are running version 2.4 or 2.5, you must first upgrade to version 2.6 before upgrading to 2.7.

Architectural changes in Ansible Automation Platform 2.7
Copy link

Ansible Automation Platform 2.7 removes direct API access and component-level authentication. All external access to platform components must go through platform gateway.

The following features and access methods are removed in this release:

  • Direct API access to automation controller, automation hub, and Event-Driven Ansible controller.
  • Basic authentication at the component level.
  • Component-level Personal Access Tokens (PATs) and legacy OAuth applications.
  • Third-party authentication provider configuration (LDAP, SAML, RADIUS, TACACS+) within automation controller.
  • Direct external routes or ingress to automation controller and automation hub.
Important

If you use Red Hat Ansible Lightspeed and have automation or scripts that change the max_stream_duration or stream_idle_timeout global proxy settings, you must update your scripts. These global settings have been removed, and you should now use the per-route service timeouts that are configurable on any route.

How direct access is prevented in Ansible Automation Platform 2.7
Copy link

In Ansible Automation Platform 2.7, platform components are configured to accept only platform gateway JWT authentication, ensuring that all external access goes through platform gateway.

When deployed as part of Ansible Automation Platform, this enforcement is immutable and cannot be changed through configuration files or environment variables, ensuring no bypass is possible.

Prepare platform gateway accounts for the 2.7 upgrade
Copy link

In Red Hat Ansible Automation Platform 2.6, users without a platform gateway account can authenticate using an automation controller password. In Ansible Automation Platform 2.7, this fallback authentication mechanism is removed.

About this task
Copy link

Important

You must configure platform gateway accounts for all users before upgrading. Users cannot authenticate after the upgrade if they rely on the automation controller password fallback.

Procedure
Copy link

  1. Identify users who authenticate through the automation controller password fallback.
  2. Create platform gateway accounts for these users or instruct users to set platform gateway passwords.
    Note

    If you miss this step before upgrading, automation controller accounts are automatically created in platform gateway during the upgrade, but passwords are not set. Users with automatically-created accounts must reset their passwords before they can log in.

Results
Copy link

Confirm that all active users can log in to their platform gateway accounts.