From 627b935fc5359d623a6ff5e9005255af59a55f45 Mon Sep 17 00:00:00 2001 From: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> Date: Tue, 17 Feb 2026 14:10:47 -0500 Subject: [PATCH] [AAP-64062] Enforce JWT-only authentication for Controller when deployed as part of AAP (#16283) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After all settings are loaded, override DEFAULT_AUTHENTICATION_CLASSES to only allow Gateway JWT authentication when RESOURCE_SERVER__URL is set. This makes the lockdown immutable — no configuration file or environment variable can re-enable legacy auth methods (Basic, Session, OAuth2, Token). This is the same pattern used by Hub (galaxy_ng) and EDA (eda-server) for ANSTRAT-1840. Co-authored-by: Claude Opus 4.6 (1M context) --- awx/settings/__init__.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/awx/settings/__init__.py b/awx/settings/__init__.py index 2332863d7b..78afed70bd 100644 --- a/awx/settings/__init__.py +++ b/awx/settings/__init__.py @@ -63,6 +63,15 @@ assert_production_settings(DYNACONF, settings_dir, settings_file_path) # Load envvars at the end to allow them to override everything loaded so far load_envvars(DYNACONF) +# When deployed as part of AAP (RESOURCE_SERVER__URL is set), enforce JWT-only +# authentication. This ensures all requests go through the gateway and prevents +# direct API access to Controller bypassing the platform's authentication. +if DYNACONF.get('RESOURCE_SERVER__URL', None): + DYNACONF.set( + "REST_FRAMEWORK__DEFAULT_AUTHENTICATION_CLASSES", + ['ansible_base.jwt_consumer.awx.auth.AwxJWTAuthentication'], + ) + # This must run after all custom settings are loaded DYNACONF.update( merge_application_name(DYNACONF),