Workshop Exercise - Role-based access control

Read this in other languages:
uk English, japan日本語, brazil Portugues do Brasil, france Française, Español Español.

Table Contents


You have already learned how Ansible Tower separates credentials from users. Another advantage of Ansible Tower is the user and group rights management. This exercise demonstrates Role Based Access Control (RBAC)


Ansible Tower Users

There are three types of Tower Users:

Let’s create a user:

Parameter Value
Organization Default
PASSWORD ansible
USER TYPE Normal User

Ansible Tower Teams

A Team is a subdivision of an organization with associated users, projects, credentials, and permissions. Teams provide a means to implement role-based access control schemes and delegate responsibilities across organizations. For instance, permissions may be granted to a whole Team rather than each user on the Team.

Create a Team:

Now you can add a user to the Team:

Now click the PERMISSIONS button in the TEAMS view, you will be greeted with “No Permissions Have Been Granted”.

Permissions allow to read, modify, and administer projects, inventories, and other Tower elements. Permissions can be set for different resources.

Granting Permissions

To allow users or teams to actually do something, you have to set permissions. The user wweb should only be allowed to modify content of the assigned webservers.

Add the permission to use the template:

Test Permissions

Now log out of Tower’s web UI and in again as the wweb user.

Check the result: execute curl again on the control host to pull the content of the webserver on the IP address of node1 (you could of course check node2 and node3, too):

#> curl

Just recall what you have just done: You enabled a restricted user to run an Ansible Playbook

Effectively you provided the power to execute automation to another user without handing out your credentials or giving the user the ability to change the automation code. And yet, at the same time the user can still modify things based on the surveys you created.

This capability is one of the main strengths of Ansible Tower!

Previous Exercise - Next Exercise

Click here to return to the Ansible for Red Hat Enterprise Linux Workshop