[AAP-64062] Enforce JWT-only authentication for Controller when deployed as part of AAP

[TheRealHaoLiu]

Summary

• When RESOURCE_SERVER__URL is set (i.e., deployed as part of AAP with Gateway), override DEFAULT_AUTHENTICATION_CLASSES to only allow AwxJWTAuthentication
• Applied after all settings files and env vars are loaded, making it immutable
• Same pattern as Hub (galaxy_ng#288) and EDA (eda-server#1474)

Jira

• AAP-64062
• ANSTRAT-1840

Test plan

• Authenticate directly to Controller using Basic auth → returns 401
• Authenticate directly using Session auth → returns 401
• Authenticate directly using OAuth2 token → returns 401
• Authenticate through Gateway → proxied request with Gateway JWT succeeds
• Internal service-to-service calls (resource sync, settings sync) continue to work
• Standalone AWX (no RESOURCE_SERVER__URL) retains all auth methods

🤖 Generated with Claude Code

---

Note

High Risk
Changes authentication behavior for all API requests in AAP deployments; misconfiguration or unexpected dependencies on other auth mechanisms could block access or integrations.

Overview
When RESOURCE_SERVER__URL is present (AAP/Gateway deployments), AWX now forces DRF DEFAULT_AUTHENTICATION_CLASSES to only AwxJWTAuthentication, preventing direct non-gateway access methods (e.g., basic/session/token) from being accepted.

This override is applied after settings files and environment variables are loaded, making the JWT-only behavior effectively mandatory in that deployment mode.

^{Written by Cursor Bugbot for commit ab6fd45. This will update automatically on new commits. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
50.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[AlanCoding]

I really don't like switches (if) for settings. It creates entanglements around load order.

awx/awx/settings/defaults.py

Lines 365 to 369 in 7ccc14d

	'DEFAULT_AUTHENTICATION_CLASSES': (
	'ansible_base.jwt_consumer.awx.auth.AwxJWTAuthentication',
	'awx.api.authentication.SessionAuthentication',
	'awx.api.authentication.LoggedBasicAuthentication',
	),

I would prefer that the defaults don't contain the 2nd two (what you're doing right here), and then those are only added back for development, tests, and perhaps add a standalone module or something?