Cognito idp and groups

[gabrielmorin1]

Dear community,

I'm new to netbox. I successfully deployed the software, but I'm struggling to integrate my idp to let people use SSO with netbox. I'm using version 3.2.8.
For now, in my settings file, I have the following configuration :

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.cognito.CognitoOAuth2'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_AUTO_CREATE_GROUPS = True
REMOTE_AUTH_GROUP_SYNC_ENABLED = True
SOCIAL_AUTH_COGNITO_KEY = 'my_own_key'
SOCIAL_AUTH_COGNITO_DOMAIN = 'my_own_domain'
SOCIAL_AUTH_COGNITO_SECRET = 'my_own_secret'

What works :

• The software,
• The SSO button,
• The automatic user creation

What I need and does not work :

• The automatic groups creation from the cognito groups the user belongs to,
• The automatic group assignation to a user (eg: admin rights for users that are in the cognito group netbox:admins)

Is it even possible ? I can't find a propoer cognito integration documentation. All seems to be made for Okta or AAD, but I don't use either of these.

Worst scenario, if it is not possible, is it even possible to give full admin right to users by default ? I'vealso tried the following lines in my config but it's not workng either...

REMOTE_AUTH_GROUP_SYNC_ENABLED = False
REMOTE_AUTH_DEFAULT_GROUP = 'Admins'
REMOTE_AUTH_DEFAULT_PERMISSIONS = {"*": "None"}

With and without the quotes for the dictionnary

Has someone successfully done this and would like to share it's method with me ?

[candlerb]

I was unable to get group membership working with python social auth at all - indeed, I broke it further trying to implement it, and it got rolled back. python-social-auth/social-core#690

I switched to remote auth.

Others appear to have built custom pipelines with custom code, at least for Azure AD: e.g. see #13129, #12688