Awx: Ability for AWX user with limited permission to edit notifications settings on templates

[cg-cnu]

ISSUE TYPE

• Bug Report or missing feature

COMPONENT NAME

• UI

SUMMARY

Couldn't find a way to assign a person with admin permission on a project to give access to edit success/failure notifications settings on templates.

ENVIRONMENT

• AWX version: 1.0.8.0
• AWX install method: docker on linux
• Ansible version: 2.6.4
• Operating System: Cent6
• Web Browser: Chrome

STEPS TO REPRODUCE

Created a user in AWX with admin access to only one project. When the user creates a new templates, he/she does not have access to enable/disable notifications.

While the system administrator have access to notifications...

The new user does not have access to notifications....

I was looking for a way to grant permissions to an user to edit success and failure notification settings. Even having organization level notification admin permissions won't give access to the template notification settings.

Is this intended? Am i missing something here? Thanks!

[wenottingham]

This is a known issue where the notification tab does not show up. You should be able to toggle them via the API.

[ms-harmonic]

@wenottingham What is the plan and timeline for fixing this issue? Is there any workaround apart from using the API?

[abedwardsw]

I think you might be able to use the tower-cli as another workaround,

tower-cli job_template associate_notification_template --job-template templatename --notification-template notification_name --status error

[sharkcus]

This is a known issue where the notification tab does not show up. You should be able to toggle them via the API.

Is there an actual issue/bug open for it, besides this? I've tried every combination I can think of to try to allow a non system-admin to view and can't seem to make it work. Can confirm this is an issue with version 3.0.0 too.

edit: Submitted a new bug, as it's still an issue with v3.0.0 (current) https://github.com/ansible/awx/issues/3150

[sshvetsov]

This is also an issue in Ansible Tower v3.3.4.

[mabashian]

This should be addressed by https://github.com/ansible/awx/pull/3181. #3181 addresses the fact that notification admin users were not seeing the notifications tab on resources. I've outlined the expected behavior for other users/roles in that PR.

[benapetr]

This is also an issue in tower v 4.0.0

[ansiblejunky]

As of version 3.4.2, it can verify the following:

• user with only Job Template Admin rights can view/edit the JT but cannot see the Notifications button at all
• user with JT Admin and Notification Admin rights can view/edit the JT and can now see the Notifications button, but cannot enable/disable the notifications for that JT
• user with OrgAdmin rights, can view/edit the JT and can see the Notifications button, but cannot enable/disable the notifications for that JT
• user with sysadmin rights can do everything on the JT

I would assume that the Job Template Admin right is all that is necessary to be able to see the Notifications button and enable/disable notifications for that JT. Notifications for a JT are just another setting on that JT. The JT Admin can already add/modify permissions for that JT as well as modifying other settings.

However, the Notifications Admin should only be able to create Notifications in the settings area for Ansible Tower.