Chapter 3. Ansible Automation Platform post-upgrade steps After a successful upgrade to Ansible Automation Platform 2.5, the crucial step is migrating your users to the latest version of the platform. User data and legacy authentication settings from automation controller and private automation hub are carried over during the upgrade process and allow seamless initial access to the platform after upgrade. Customers can log in without additional action. However, to fully transition authentication to use all of the features and capabilities of the 2.5 platform gateway, a manual process is required post-upgrade to leverage the new authentication framework. In the context of upgrading to Ansible Automation Platform 2.5, this manual process is referred to as migration . There are important notes and considerations for each type of user migration, including the following: Admin users Normal users SAML users Be sure to read through the important notes highlighted for each user type to help make the migration process as smooth as possible. 3.1. Migrating admin users Upgrades from Ansible Automation Platform 2.4 to 2.5 allows for the migration of administrators for each component with their existing component-level admin privileges maintained. However, escalation of privileges to platform gateway administrator is not automatic during the upgrade process. This ensures a secure privilege escalation process that can be customized to meet the organization's specific needs. Prerequisites Review current admin roles for the individual services in your current deployment. Confirm the users who will require platform gateway admin rights post-upgrade. 3.1.1. Key considerations Component-level admin privileges are retained: Administrators for automation controller and automation hub will retain their existing admin privileges for those respective services post-upgrade. For example, an admin of automation controller will continue to have full administration privileges for automation controller resources. Note Users previously designated as automation controller or automation hub administrators are labeled as Normal in the User type column of the Users list view. This is a mischaracterization. You can verify that these users have, in fact, retained their service level administrator privileges, by editing the account: Procedure From the navigation panel of the platform gateway, select Access Management Users . Select the check box for the user that you want to modify. Click the Pencil icon and select Edit user . The Edit user page is displayed where you can see the service level administrator privileges assigned by the User type checkboxes. See Editing a user for more information on these user types. Note Only a platform administrator can escalate your privileges. Escalation to platform gateway admin must be manually configured post-upgrade: During the upgrade process, admin privileges for individual services are not automatically translated to platform administrator privileges. Escalation to platform gateway admin must be granted by the platform administrator after upgrade and migration. Each service admin retains the original scope of their access until the access is changed. As a platform administrator, you can escalate a user's privileges by selecting the Ansible Automation Platform Administrator checkbox. 3.2. Migrating normal users When you upgrade from Ansible Automation Platform 2.4 to 2.5, your existing user account is automatically migrated to a single platform account. However, if you have multiple component accounts (such as, automation controller, private automation hub and Event-Driven Ansible), your accounts must be linked to use the centralized features of the platform. 3.2.1. Key considerations service accounts are prefixed: Users with accounts on multiple services in 2.4 are migrated as individual users in 2.5 and prefixed to identify the service from which they were migrated. For example, automation hub accounts are prefixed as hub_<username> . Automation controller user names do not include a prefix. Automation controller user accounts take precedence: When an individual user had accounts on multiple services in 2.4, priority is given to their automation controller account during migration, so those are not renamed. Component level roles are retained until user migration is complete: When users log in using an existing service account and do not perform the account linking process, only the roles for that specific service account are available. The migration process is completed once the user performs the account linking process. At that time, all roles for all services are migrated into the new platform gateway user account. 3.2.2. Additional resources See Creating a user for more information on user types. 3.2.3. Linking your account Ansible Automation Platform 2.5 provides a centralized location for users, teams and organizations to access the platform's services and features. The first time you log in to Ansible Automation Platform 2.5, the platform searches through the existing services to locate a user account with the credentials you entered. When there is a match to an existing account, that account is registered and becomes centrally managed by the platform. Any subsequent component accounts in the system are orphaned and cannot be used to log into the platform. To address this problem, use the account linking procedure to authenticate from any of your existing component accounts and still be recognized by the platform. Linking accounts associates existing component accounts with the same user profile. Prerequisites You have completed the upgrade process and have a legacy Ansible Automation Platform account and credentials. Procedure If you have completed the upgrade process and have a legacy Ansible Automation Platform subscription, follow the account linking procedure below to migrate your account to Ansible Automation Platform 2.5. Navigate to the login page for Ansible Automation Platform. In the login modal, select either I have an automation controller account or I have an automation hub account based on the credentials you have. On the screen, enter the legacy credentials for the component account you selected and click Log in . Note If you are logging in using OIDC credentials, see How to fix broken OIDC redirect after upgrading to AAP 2.5 . If you have successfully linked your account, the screen shows your username with a green checkmark beside it. If you have other legacy accounts that you want to link, enter those account credentials and click Link to link them to your centralized platform gateway account. Click Submit to complete linking your legacy accounts. After your accounts are linked, depending on your authentication method, you might be prompted to create a new username and password. These credentials will replace your legacy credentials for each component account. You can also link your legacy account manually by taking the following steps: Select your user icon at the top right of your screen, and select User details . Select the More Actions icon ... > Link user accounts . Enter the credentials for the account that you want to link. If you encounter an error message telling you that your account could not be authenticated, contact your platform administrator. Note If you log into Ansible Automation Platform for the first time and are prompted to change your username, this is an indication that another user has already logged into Ansible Automation Platform with the same username. To proceed with account migration, follow the prompts to change your username. Ansible Automation Platform uses your password to authenticate which account or accounts belong to you. A diagram of the account linking flow After you have migrated your user account, you can manage your account from the Access Management menu. See Managing access with role based access control . 3.3. Migrating Single Sign-On (SSO) users When upgrading from Ansible Automation Platform 2.4 to 2.5, you must migrate your Single Sign-On (SSO) user accounts if you want to continue using SSO capabilities after the upgrade. Follow the steps in this procedure to ensure a smooth SSO user migration. 3.3.1. Key considerations SSO configurations are not migrated automatically during upgrade to 2.5: While the legacy authentication settings are carried over during the upgrade process and allow seamless initial access to the platform after upgrade, SSO configurations must be manually migrated over to a new Ansible Automation Platform 2.5 authentication configuration. The legacy configuration acts as a reference to preserve existing authentication capabilities and facilitate the migration process. The legacy authentication configuration should not be modified directly or used after migration is complete. SSO migration is not currently supported in the UI: While migration of SSO accounts is supported in 2.5, the configuration is not supported through the platform UI and must be done through the API /api/gateway/v1/authenticators/ . Migration of SSO must happen before users log in and start account linking: You must enable the Auto migrate users to setting after configuring SSO in 2.5 and before any users log in. Prerequisites You have configured a SSO authentication method in the platform gateway following the steps in Configuring an authentication type . This will be the configuration that you will migrate your SSO users to. Note Ansible Automation Platform 2.4 SSO configurations are renamed during the upgrade process and are displayed in the Authentication Methods list view with a prefix to indicate a legacy configuration: for example, legacy_sso-saml-<entity id> . The Authentication type is also listed as legacy sso . These configurations can not be modified. Procedure Log in to the platform gateway API. Go to /api/gateway/v1/authenticators/ , locate the legacy authenticator and click the link. This opens the HTML form for that authenticator. Select the new platform gateway authenticator from the Auto migrate users to list. Click PUT . Once you set up the auto migrate functionality, you should be able to login with SSO in the platform gateway and it will automatically link any matching accounts from the legacy SSO authenticator. Additional resources Refer to Ansible Automation Platform 2.4 to 2.5. Linking accounts post upgrade, and Setting up SAML authentication for a demonstration of the post upgrade steps.

Commands: