Improve API Access Control in AWX

[krivenkoa]

Please confirm the following

• I agree to follow this project's code of conduct.
• I have checked the current issues for duplicates.
• I understand that AWX is open source software provided for free and that I might not receive a timely response.

Feature type

Enhancement to Existing Feature

Feature Summary

To meet security requirements, there is sometimes a need to restrict unauthorized access to the AWX API, including the root endpoint and documentation. By default, some endpoints are accessible without authentication, which may pose a risk of information leakage.

Proposal:
Introduce a new configuration parameter (API_RESTRICT_ANONYMOUS_ACCESS) that allows administrators to control unauthorized access to the API.

Select the relevant components

• UI
• API
• Docs
• Collection
• CLI
• Other

Steps to reproduce

1. Deploy AWX with default settings.
2. Navigate to the root API endpoint (/api/) or documentation endpoint (/api/doc/) without authentication.
3. Observe that certain information is accessible without requiring authentication.

Current results

Some API endpoints, including the root and documentation endpoints, are accessible to unauthenticated users by default. This may lead to potential information exposure in environments with heightened security requirements.

Sugested feature result

• Introduce a configuration parameter: API_RESTRICT_ANONYMOUS_ACCESS.
• When enabled:
  • Require authentication for all API endpoints except those essential for login.
  • Restrict access to /api/ and /api/doc/ for unauthorized users.
• By default, this parameter should be disabled to maintain the current behavior and ensure compatibility with existing installations.

Additional information

• This feature would allow organizations with strict security policies to use AWX without the need for custom modifications.
• Administrators can enable or disable the feature based on their specific security needs.
• The default settings ensure seamless upgrades for current installations.