NetBox, Unable to enable SAML SSO.

[HungryHowies]

Hello All,

Ubuntu 22.0.4, Nignx,NetBox version: 3.6.5, Python version: 3.10.12 && Let's encrypt.

The installation went good. I wanted to enable SAML SSO with my IDP called Zitadel, Very similar to Keycloak.
Having issues configuring/enabling NetBox for SAML SSO. The documentation isnt clear to me on what file/s need to be configured besides "configuration.py".

This was attempted (configuration shown below) and restart NetBox service, No Joy.

Used this documentation.

https://demo.netbox.dev/static/docs/administration/authentication/

From that, I think this needed?

https://github.com/jeremyschulman/django3-auth-saml2

source /opt/netbox/venv/bin/activate
pip install social-auth-core

Did not work as expected, No joy.

From the documentation above

"NetBox supports single sign-on authentication via the python-social-auth library"

Though I did that above?

https://python-social-auth.readthedocs.io/en/latest/backends/saml.html#basic-usage

Now Im getting confused on exactly what file should be configured or what package needs to be install.
I was unable to get it to work.

• NetBox configurations:

vi /opt/netbox/netbox/netbox/configuration.py

root@netbox:/opt/netbox/netbox/netbox# cat configuration.py | egrep -v "^\s*(#|$)"
ALLOWED_HOSTS = ["netbox.domain.com"]
DATABASE = {
    'NAME': 'netbox',         # Database name
    'USER': 'netbox',               # PostgreSQL username
    'PASSWORD': 'J5brHrAXFLQSif0K', # PostgreSQL password
    'HOST': 'localhost',      # Database server
    'PORT': '',               # Database port (leave blank for default)
    'CONN_MAX_AGE': 300,      # Max database connection age
}
REDIS = {
    'tasks': {
        'HOST': 'localhost',
        'PORT': 6379,
        'USERNAME': '',
        'PASSWORD': '',
        'DATABASE': 0,
        'SSL': False,
    },
    'caching': {
        'HOST': 'localhost',
        'PORT': 6379,
        'USERNAME': '',
        'PASSWORD': '',
        'DATABASE': 1,
        'SSL': False,
    }
}
SECRET_KEY = 'my_secert_key'
ADMINS = [
]
ALLOW_TOKEN_RETRIEVAL = False
AUTH_PASSWORD_VALIDATORS = [
]
BASE_PATH = ''
CORS_ORIGIN_ALLOW_ALL = False
CORS_ORIGIN_WHITELIST = [
]
CORS_ORIGIN_REGEX_WHITELIST = [
]
CSRF_COOKIE_NAME = 'csrftoken'
DEBUG = False
DEFAULT_LANGUAGE = 'en-us'
EMAIL = {
    'SERVER': 'localhost',
    'PORT': 25,
    'USERNAME': '',
    'PASSWORD': '',
    'USE_SSL': False,
    'USE_TLS': False,
    'TIMEOUT': 10,  # seconds
    'FROM_EMAIL': '',
}
ENABLE_LOCALIZATION = False
EXEMPT_VIEW_PERMISSIONS = [
]
INTERNAL_IPS = ('127.0.0.1', '::1')
LOGGING = {}
LOGIN_PERSISTENCE = False
LOGIN_REQUIRED = False
LOGIN_TIMEOUT = None
LOGOUT_REDIRECT_URL = 'home'
METRICS_ENABLED = False
PLUGINS = []
REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_USER_FIRST_NAME = 'HTTP_REMOTE_USER_FIRST_NAME'
REMOTE_AUTH_USER_LAST_NAME = 'HTTP_REMOTE_USER_LAST_NAME'
REMOTE_AUTH_USER_EMAIL = 'HTTP_REMOTE_USER_EMAIL'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
RELEASE_CHECK_URL = None
RQ_DEFAULT_TIMEOUT = 300
SESSION_COOKIE_NAME = 'sessionid'
SESSION_FILE_PATH = None
TIME_ZONE = 'America/Chicago'
DATE_FORMAT = 'N j, Y'
SHORT_DATE_FORMAT = 'Y-m-d'
TIME_FORMAT = 'g:i a'
SHORT_TIME_FORMAT = 'H:i:s'
DATETIME_FORMAT = 'N j, Y g:i a'
SHORT_DATETIME_FORMAT = 'Y-m-d H:i'

• Nignx configurations:

root@netbox:/etc/nginx/sites-available# cat netbox 
server {
    listen [::]:443 ssl ipv6only=off;

    # CHANGE THIS TO YOUR SERVER'S NAME
    server_name netbox.domain.com;
    ssl_certificate /etc/letsencrypt/live/netbox.domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/netbox.domain.com/privkey.pem; # managed by Certbot

    client_max_body_size 25m;

    location /static/ {
        alias /opt/netbox/netbox/static/;
    }

    location / {
        proxy_pass http://127.0.0.1:8001;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

}

server {
    # Redirect HTTP traffic to HTTPS
    listen [::]:80 ipv6only=off;
    server_name _;
    return 301 https://$host$request_uri;
}

Another attempt, assumed I needed this configuration

"SOCIAL_AUTH_SAML_ENABLED_IDPS = True"

I recieved the following error. Not sure what plugin.

What I was looking for to configure is something like this

IDP issuer	https://zitadel.cloud/saml/v2/metadata
IDP login url	https://zitadel.cloud/saml/v2/SSO
IDP logout url	https://zitadel.cloud/saml/v2/SLO
IDP X.509 public cert "MIIFIjCCAwqgAwIBAgICAx...................wwDQYJKoZIhvcNA"

Any advice or direction to documentation I over looked to at least enable SAML Authentication would be apperciated

Thank you in advance.

-- Gsmitt

EDIT: I came across this https://github.com/jeremyschulman/netbox-plugin-auth-saml2
Then went here to install django3-auth-saml2

[HungryHowies]

This is all new to me, still trying to get SAML to work on Netbox.

I might be on the right track to enable SAML on Netbox.

I have found the file needed to execute my configuration but it looks like I missing something. Using the following configurations I enabled the saml link on the login Web page.

Using these configurations.

vi /opt/netbox/netbox/netbox/configuration.py  

configurations

# Remote authentication support
REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.saml.SAMLAuth'
SOCIAL_AUTH_API_URL= 'https://domain.zitadel.cloud/saml/v2/SSO'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
SOCIAL_AUTH_SAML_SP_ENTITY_ID = 'netbox'

REMOTE_AUTH_USER_FIRST_NAME = 'HTTP_REMOTE_USER_FIRST_NAME'
REMOTE_AUTH_USER_LAST_NAME = 'HTTP_REMOTE_USER_LAST_NAME'
REMOTE_AUTH_USER_EMAIL = 'HTTP_REMOTE_USER_EMAIL'
REMOTE_AUTH_AUTO_CREATE_USER = True
SOCIAL_AUTH_PIPELINE = [
    "social_core.pipeline.social_auth.social_details",
    "social_core.pipeline.social_auth.social_uid",
    "social_core.pipeline.social_auth.auth_allowed",
    "social_core.pipeline.social_auth.social_user",
    "social_core.pipeline.social_auth.associate_by_email",
    "social_core.pipeline.user.create_user",
    "social_core.pipeline.social_auth.associate_user",
    "social_core.pipeline.social_auth.load_extra_data",
    "social_core.pipeline.user.user_details"
]

Results:

Any further advice would be apperciated.

[HungryHowies]

Made a small improvment with my config file.

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.saml.SAMLAuth'

SOCIAL_AUTH_API_URL= 'https://domainzitadel.cloud/saml/v2/metadata'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
SOCIAL_AUTH_SAML_SP_ENTITY_ID = 'netbox'

REMOTE_AUTH_USER_FIRST_NAME = 'HTTP_REMOTE_USER_FIRST_NAME'
REMOTE_AUTH_USER_LAST_NAME = 'HTTP_REMOTE_USER_LAST_NAME'
REMOTE_AUTH_USER_EMAIL = 'HTTP_REMOTE_USER_EMAIL'
REMOTE_AUTH_AUTO_CREATE_USER = True
SOCIAL_AUTH_PIPELINE = [
    "social_core.pipeline.social_auth.social_details",
    "social_core.pipeline.social_auth.social_uid",
    "social_core.pipeline.social_auth.auth_allowed",
    "social_core.pipeline.social_auth.social_user",
    "social_core.pipeline.social_auth.associate_by_email",
    "social_core.pipeline.user.create_user",
    "social_core.pipeline.social_auth.associate_user",
    "social_core.pipeline.social_auth.load_extra_data",
    "social_core.pipeline.user.user_details"
]
 SOCIAL_AUTH_SAML_ENABLED_IDPS = {

"ZITADEL": {

    "entity_id": "netbox",

    "url": "https://domain.zitadel.cloud/saml/v2/SSO"

 }
}                

Still error out with this

<class 'KeyError'>

'url'

Python version: 3.10.12
NetBox version: 3.6.5
Plugins: None installed