Azure AD group mapping integration

[F3d0s]

Hi everyone, I could configure Netbox to access via SSO following the documentation, but I can't configure the group mapping. For example, I'd like to assign Superuser status and Staff status to the users who are part of the AD group "Admins" and those who are part of the AD group "Operators" to be assigned to the Operators group in Netbox.

It is possible to do that without using external plugins?

[CTV-2023]

Until we find another working solution we use SAML on AzureAD enterprise application (and SAML as netbox social auth backend, not AzureAD) and store groups in extra data. Then we create/populate groups with a custom pipeline. Search in discussion for other topics about this.
*Edit oh I already answered you previously for the same topic

[F3d0s]

Until we find another working solution we use SAML on AzureAD enterprise application (and SAML as netbox social auth backend, not AzureAD) and store groups in extra data. Then we create/populate groups with a custom pipeline. Search in discussion for other topics about this. *Edit oh I already answered you previously for the same topic

Sure, I read your answer and the Reddit post you linked; thank you for that. Unfortunately, it doesn't work for me as I would like to use OAuth authentication instead of SAML.

At the moment, my configuration looks like this, I can log in via SSO, but the group mapping that should assign permission to users doesn't work as it needs to be configured.

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.azuread.AzureADOAuth2'
SOCIAL_AUTH_AZUREAD_OAUTH2_KEY = '***************'
SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET = '***************'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

(Sorry for the late reply6, I was on holiday)

[candlerb]

You haven't said why you want to do it differently to the suggested working solution, but I can tell you that Python Social Auth is unable to sync Django groups with any OpenID provider (at least, I've pulled my hair out trying).

The way I do it is to use Apache with mod_auth_openidc as the proxy in front of Netbox, and REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'. For full config see #8579 (reply in thread)

This picks up group membership from a HTTP header, and can do the superuser/staff groups as well.

At different times I have used this config with Keycloak and Hashicorp Vault as the upstream OIDC providers. If you are using AzureAD directly then I seem to remember that the group claims you get will be the group GUIDs, not the group names.

v3.5.2 has just added REMOTE_AUTH_AUTO_CREATE_GROUPS as well, although I don't use it because I don't want a load of random groups created in Netbox - I manually create the groups I'm interested in.