How to use local Netbox log in page

[F3d0s]

I will run a Netbox upgrade from 2.11.11 to 3.4.1 in a couple of weeks. I already made a couple of times in a dev environment, and I took notes of the issues I encountered during the process. I am now ready for the upgrade in production... but there's one last thing I have concerns.

The person who installed and configured Netbox in our company installed a plugin for the SAML login and groups & permissions mapping, with Azure called django3_saml2_nbplugin, which works fine, I don't have any complains with that... for now. But you know how it go sometimes, things can break at the wrong time, and I could need to log in to Netbox admin page with a local account.

At the moment, when I open our Netbox website, it will take me directly to the Microsoft log in page but how can I use the local log in, in the case something goes wrong with the plugin?

Thank you!

[markkuleinio]

How is your nginx service configured?

[F3d0s]

1. Go to NetBox - click your username - Admin - Config revisions - Add config revision - copy the whole "click here" thingy I showed you in the Login banner field - Save

When I do that, it won't let me write anything in Login banner field, it seems to be blocked for some reason

Perhaps I should remove the whole "location /login/" line from /opt/netbox-nginx/nginx.conf?

[markkuleinio]

When I do that, it won't let me write anything in Login banner field, it seems to be blocked for some reason

As it shows in the screenshot, you have already configured it but it is in configuration.py. I recommend removing it from configuration.py and restarting NetBox, then you can configure it in GUI (it doesn't require restarting NetBox so it is easier to use).

Perhaps I should remove the whole "location /login/" line from /opt/netbox-nginx/nginx.conf?

That's what I said above, yes

[F3d0s]

I recommend removing it from configuration.py and restarting NetBox, then you can configure it in GUI (it doesn't require restarting NetBox so it is easier to use).

Thanks for the suggestion, in the configuration.py there are a bunch of instructions lines that seems to synchronize Azure AD users, groups, and permissions to be created in netbox; I am not 100% sure how to remove the Login banner from it.

This is what I have:

# Remote authentication support
REMOTE_AUTH_ENABLED = True
#REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_BACKEND = 'django3_saml2_nbplugin.backends.SAML2CustomAttrUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

# Enable installed plugins. Add the name of each plugin to the list.
PLUGINS = ['django3_saml2_nbplugin']
#PLUGINS = []

# Plugins configuration settings. These settings are used by various plugins that the user may have installed.
# Each key in the dictionary is the name of an installed plugin and its value is a dictionary of settings.
PLUGINS_CONFIG = {
    'django3_saml2_nbplugin': {

        'AUTHENTICATION_BACKEND': REMOTE_AUTH_BACKEND,
        'ASSERTION_URL': 'https://dcimtest.company.cloud/api/plugins',
        'ENTITY_ID': 'https://dcimtest.company.cloud/',

        # Metadata is required, choose either remote url
        'METADATA_AUTO_CONF_URL': "https://login.microsoftonline.com/6d3fc033-6dff-31a1-b213-44341fb2f4d1/federationmetadata/2007-06/federationmetadata.xml?appid=94b90929-3085-497a-8032-9j4s984hc3f1",
        # or local file path
        # 'METADATA_LOCAL_FILE_PATH': '/opt/netbox/DCIM.xml',

        # Settings for SAML2CustomAttrUserBackend. Optional.
        'CUSTOM_ATTR_BACKEND': {
            # Attribute containing the username. Optional.
            "USERNAME_ATTR": "name",
            # Attribute containing the user's email. Optional.
            "MAIL_ATTR": "emailAddress",
            # Attribute containing the user's first name. Optional.
            "FIRST_NAME_ATTR": "givenName",
            # Attribute containing the user's last name. Optional.
            "LAST_NAME_ATTR": "surname",
            # Set to True to always update the user on logon
            # from SAML attributes on logon. Defaults to False.
            'ALWAYS_UPDATE_USER': True,
            # Attribute that contains groups. Optional.
            #'GROUP_ATTR': 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups',
            # Dict of user flags to groups.
            # If the user is in the group then the flag will be set to True. Optional.
            'FLAGS_BY_GROUP': {
                'is_staff': 'c273533e-60a5-4dc7-98d3-9j4s984hc3f1',
                'is_superuser': 'c273533e-60a5-4dc7-98d3-9j4s984hc3f1'
            },
            # Dict of SAML groups to NetBox groups. Optional.
            # Groups must be created beforehand in NetBox.
            'GROUP_MAPPINGS': {
                'd51a17ec-ebba-4647-ac49-9j4s984hc3f1': 'DCIM-readonly',
                'dff13f8f-2167-4ede-bd7e-9j4s984hc3f1': 'DCIM-operator',
                '0a310d41-3c26-44a0-91c9-9j4s984hc3f1': 'DCIM-tenant-admins',
                '5fafd340-f646-4e38-83e4-9j4s984hc3f1': 'DCIM-SOC'
            }
        }
    }
}
```

[markkuleinio]

That's not your full configuration.py, is it? Search for "BANNER_LOGIN"

[F3d0s]

No is not, I just reported what I thought was responsible for the login page, my bad.
This is the BANNER_LOGIN part:

BANNER_LOGIN = '<a href="/api/plugins/sso/login" class="btn btn-primary btn-block">Login with SSO</a>'

I put a comment that line and the line location /login/ { in /opt/netbox-nginx/nginx.conf, then I restarted netbox and nginx services and it works!