SSO with python-social-auth's oidc backend - users are provisioned with random hexadecimal usernames

[yrro]

I'm running into a problem with the oidc backend and I wonder if anyone else has used this backend with NetBox.

I am finding that my users are provisioned with a random hexadecimal username. Looking into the python-social-auth code, this happens if there's no username set by a previous pipeline stage & if python-social-auth isn't configured to fall back to the email address.

I believe this is a problem with python-social-auth rather than NetBox, so I filed python-social-auth/social-core#709; I wonder if anyone here has ever tried to use the oidc backend (not necessary with Azure AD, this is generic to OpenID Connect really) and seen this problem?

[yrro]

I solved this by overriding a method in the OpenIdConnectAuth class within my NetBox settings file. Details are all added to the ticket.

[jeremystretch]

Thanks for following up with your solution!

[yrro]

No problem. python-social-auth works a lot better than I originally feared. Even though it doesn't use (iss, sub) to identify users uniquely across multiple issuers. But then very few implementations get this right. At least the situation with OpenID Connect is a lot better than the disaster that was SAML!

Anyway. Next job is to try to get a custom class added to the pipeline so that I can use roles assigned in Azure AD to set users' is_staff and is_superuser attributes when they log in. :)

[candlerb]

If you can find out how to get group memberships synced via python-social-auth, please let me know. I wasn't able to do this, not with a generic openid connect provider anyway.

[yrro]

Will do. I was going to look into the approach shown in this thread: #9216 (comment); probably in your case you'd modify the set_role function to get the list of groups from backend.id_token['groups'].

[bandwiches]

Did anyone ever figure out how to do this? Currently setup using OIDC with Microsoft Entra ID, but having issues with attribute assignment since no groups are returned.