Repository: ansible/awx

Issue:
Errors caused by Social Auth Organization and Team Mapping; Users unable to login
### Please confirm the following

- [X] I agree to follow this project's [code of conduct](http://docs.ansible.com/ansible/latest/community/code_of_conduct.html).
- [X] I have checked the [current issues](https://github.com/ansible/awx/issues) for duplicates.
- [X] I understand that AWX is open source software provided for free and that I am not entitled to status updates or other assurances.

### Summary

Attempting to configure Social Organization/Team Mapping prevents social-auth users from logging in.  `awx-web` and postgres show errors.  If ORGANIZATION_MAP and TEAM_MAP are reverted to default/empty, user is able to login.


### AWX version

19.2.2

### Installation method

kubernetes

### Modifications

yes

### Ansible version

_No response_

### Operating system

_No response_

### Web browser

Chrome

### Steps to reproduce

1. Fresh AWX 19.2.2 installation via awx-operator (0.12.0) with `create_preload_data: 'false'`
2.  Log in as Admin; Configure Github Organization OAuth2 Social Auth ( do not configure org/team maps )
```json
{
    "SOCIAL_AUTH_GITHUB_ORG_CALLBACK_URL": "https://my-awx-install.com/sso/complete/github-org/",
    "SOCIAL_AUTH_GITHUB_ORG_KEY": "<redacted>",
    "SOCIAL_AUTH_GITHUB_ORG_SECRET": "$encrypted$",
    "SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP": null,
    "SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP": null
}
```
3. Validate Step 2 configs by logging in via Github Org Social Auth
4. Log out.

5. Login as Admin; Configure Org/Team Maps (I tried this in both the Global and GitHub Org specific configs)
```json
{
    "SOCIAL_AUTH_GITHUB_ORG_CALLBACK_URL": "https://my-awx-install.com/sso/complete/github-org/",
    "SOCIAL_AUTH_GITHUB_ORG_KEY": "<redacted>",
    "SOCIAL_AUTH_GITHUB_ORG_SECRET": "$encrypted$",
    "SOCIAL_AUTH_GITHUB_ORG_NAME": "MyOrg",
    "SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP": {
        "MyOrg": {
            "users": [
                "me@example.com"
            ],
            "admins": [
                "admin@example.com"
            ],
            "remove_users": true,
            "remove_admins": true
        }
    },
    "SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP": {
        "operations-team": {
            "remove": true,
            "organization": "MyOrg",
            "users": [
                "me@example.com"
            ]
        }
    }
}
```

6. Attempt to login as user; Get redirected to login page; Observe error awx-web and postgres error logs

### Expected results

Organizations specified by valid Social Auth Org map(s) are created automatically
Teams specified by valid Social Auth Team map(s) are created automatically
Users are able to login as specified by Social Auth Org/Team maps

### Actual results

User was not able to login following Org/Map configuration.  Organization and Teams were not created on our behalf.

`postgres` errors
```bash
2021-08-13 21:39:42.438 UTC [2886] STATEMENT:  INSERT INTO "main_organizationgalaxycredentialmembership" ("organization_id", "credential_id", "position") VALUES (1, NULL, NULL) RETURNING "main_organizationgalaxycredentialmembership"."id"
2021-08-13 21:39:42.438 UTC [2886] ERROR:  null value in column "credential_id" violates not-null constraint
2021-08-13 21:39:42.438 UTC [2886] DETAIL:  Failing row contains (1, null, null, 1).
```

`awx-web` errors
```
2021-08-13 21:39:42,440 ERROR    [c6496ec03db747d3a7800f653acd316b] social null value in column "credential_id" violates not-null constraint
DETAIL:  Failing row contains (1, null, null, 1).
.
```

### Additional information

* Installed via awx-operator with `create_preload_data: false`
* Prior to opening this issue, I've also attempted this against 19.3.0 to no success.


Discussion:
While crawling previous issues I found #10277 but it was closed without a resolution
Just did some more testing: this issue is not encountered when working with an AWX installation implemented with `create_preload_data: true`.  This seems related to the fact that setting `create_preload_data: false` does not create the default AnsibleGalaxy credential.

#10421 seems related
Recently we added code to ensure that a SAML/LDAP-created org associates the default galaxy cred. It's possible that code fails if the cred doesn't exist.

Resolving patch:
diff --git a/awx/main/models/organization.py b/awx/main/models/organization.py
--- a/awx/main/models/organization.py
+++ b/awx/main/models/organization.py
@@ -118,7 +118,7 @@ def create_default_galaxy_credential(self):
         from awx.main.models import Credential
 
         public_galaxy_credential = Credential.objects.filter(managed=True, name='Ansible Galaxy').first()
-        if public_galaxy_credential not in self.galaxy_credentials.all():
+        if public_galaxy_credential is not None and public_galaxy_credential not in self.galaxy_credentials.all():
             self.galaxy_credentials.add(public_galaxy_credential)
 
 


Test patch: