using openidconnectauth (oidc) #17549

davama · 2024-09-19T18:46:21Z

davama
Sep 19, 2024

Greetings,

Trying to get this backend working social_core.backends.open_id_connect.OpenIdConnectAuth

My config:

REMOTE_AUTH_BACKEND="netbox.authentication.LDAPBackend social_core.backends.open_id_connect.OpenIdConnectAuth"
REMOTE_AUTH_ENABLED=True
REMOTE_AUTH_AUTO_CREATE_USER=True
REMOTE_AUTH_AUTO_CREATE_GROUPS=True
SOCIAL_AUTH_OIDC_KEY='mykey'
SOCIAL_AUTH_OIDC_SECRET='mysecret'
SOCIAL_AUTH_OIDC_USERNAME_KEY='preferred_username'
SOCIAL_AUTH_OIDC_SCOPE=['groups']
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT="https://authelia.domain.net"

Traceback:

Environment:


Request Method: GET
Request URL: https://netbox-dev1.domain.net/oauth/login/oidc/?next=%2F

Django Version: 5.0.9
Python Version: 3.12.3
Installed Applications:
['django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'django.contrib.humanize',
 'django.forms',
 'corsheaders',
 'debug_toolbar',
 'django_filters',
 'django_htmx',
 'django_tables2',
 'django_prometheus',
 'strawberry_django',
 'mptt',
 'rest_framework',
 'social_django',
 'taggit',
 'timezone_field',
 'core',
 'account',
 'circuits',
 'dcim',
 'ipam',
 'extras',
 'tenancy',
 'users',
 'utilities',
 'virtualization',
 'vpn',
 'wireless',
 'django_rq',
 'drf_spectacular',
 'drf_spectacular_sidecar',
 'netbox_branching.AppConfig',
 'netbox_diode_plugin.NetBoxDiodePluginConfig']
Installed Middleware:
['django_prometheus.middleware.PrometheusBeforeMiddleware',
 'strawberry_django.middlewares.debug_toolbar.DebugToolbarMiddleware',
 'corsheaders.middleware.CorsMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.locale.LocaleMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 'django.middleware.security.SecurityMiddleware',
 'django_htmx.middleware.HtmxMiddleware',
 'netbox.middleware.RemoteUserMiddleware',
 'netbox.middleware.CoreMiddleware',
 'netbox.middleware.MaintenanceModeMiddleware',
 'django_prometheus.middleware.PrometheusAfterMiddleware',
 'netbox_branching.middleware.BranchMiddleware']



Traceback (most recent call last):
  File "/opt/netbox/venv/lib/python3.12/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
               ^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/django/views/decorators/cache.py", line 80, in _view_wrapper
    response = view_func(request, *args, **kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_django/utils.py", line 63, in wrapper
    return func(request, backend, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_django/utils.py", line 49, in wrapper
    return func(request, backend, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_django/views.py", line 23, in auth
    return do_auth(request.backend, redirect_name=REDIRECT_FIELD_NAME)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/actions.py", line 34, in do_auth
    return backend.start()
           ^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/backends/base.py", line 34, in start
    return self.strategy.redirect(self.auth_url())
                                  ^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/backends/oauth.py", line 352, in auth_url
    params = self.auth_params(state)
             ^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/backends/open_id_connect.py", line 132, in auth_params
    params["nonce"] = self.get_and_store_nonce(self.authorization_url(), state)
                                               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/backends/open_id_connect.py", line 73, in authorization_url
    ) or self.oidc_config().get("authorization_endpoint")
         ^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/utils.py", line 308, in wrapped
    cached_value = fn(this)
                   ^^^^^^^^
  File "/opt/netbox/venv/lib/python3.12/site-packages/social_core/backends/open_id_connect.py", line 114, in oidc_config
    return self.get_json(self.oidc_endpoint() + "/.well-known/openid-configuration")
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Exception Type: TypeError at /oauth/login/oidc/
Exception Value: unsupported operand type(s) for +: 'NoneType' and 'str'

netbox version v4.1.1 on docker

Could this be an config issue or upstream issue?

Any input is appreciated!

Best,
Dave

Answered by davama

Sep 30, 2024

@julianstolp
I'm so dumb

I kept working with env variables but never added those variables to the configuration.py file 😮‍💨

Using the below in configuration.py

SOCIAL_AUTH_BACKEND_ATTRS = {
    'oidc': ("Sign in with authelia", ""),
}

if 'SOCIAL_AUTH_OIDC_OIDC_ENDPOINT' in environ:
    SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = environ.get('SOCIAL_AUTH_OIDC_OIDC_ENDPOINT', None)

if 'SOCIAL_AUTH_OIDC_KEY' in environ:
    SOCIAL_AUTH_OIDC_KEY = environ.get('SOCIAL_AUTH_OIDC_KEY', None)

if 'SOCIAL_AUTH_OIDC_SECRET' in environ:
    SOCIAL_AUTH_OIDC_SECRET = environ.get('SOCIAL_AUTH_OIDC_SECRET', None)

if 'SOCIAL_AUTH_VERIFY_SSL' in environ:
    SOCIAL_AUTH_VERIFY_SSL = environ.get('SOCIAL_AUTH_VERI…

View full answer

julianstolp · 2024-09-25T14:00:46Z

julianstolp
Sep 25, 2024

I'm trying to implement this as well using NetBox 4.1.1 but without Docker. I'm wondering why your configuration even works. If I use your REMOTE_AUTH_BACKEND config I get this error <class 'ModuleNotFoundError'> No module named 'netbox.authentication.LDAPBackend social_core'

Putting those strings inside a list works.
REMOTE_AUTH_BACKEND = ['netbox.authentication.LDAPBackend', 'social_core.backends.open_id_connect.OpenIdConnectAuth'] #REMOTE_AUTH_BACKEND = "netbox.authentication.LDAPBackend social_core.backends.open_id_connect.OpenIdConnectAuth"

I am not getting your error, not sure why we should be using the same packages. My connection is failing because Authelia is not yet configured correctly.

<class 'social_core.exceptions.AuthFailed'>

Authentication failed: HTTPSConnectionPool(host='auth.domain.com', port=443): Max retries exceeded with url: /.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

3 replies

davama Sep 25, 2024
Author

@julianstolp
Thank you very much for replying!

I'm trying to implement this as well using NetBox 4.1.1 but without Docker. I'm wondering why your configuration even works. If I use your REMOTE_AUTH_BACKEND config I get this error <class 'ModuleNotFoundError'> No module named 'netbox.authentication.LDAPBackend social_core'

My setting worked because I used the config from here configuration.py. If you notice the AS_LIST, it splits the string using an empty space as a delimiter. Multiple auth_backends was added on 3.4.7

I am not getting your error, not sure why we should be using the same packages. My connection is failing because Authelia is not yet configured correctly.
<class 'social_core.exceptions.AuthFailed'>

Authentication failed: HTTPSConnectionPool(host='auth.domain.com', port=443): Max retries exceeded with url: /.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)')))

Im also using authelia. Your error looks like netbox does not recognize the cert. I would assume that I would eventually reach your issue too, since I don't have any certs configured on netbox. But one step at a time...
How did you configure authelia?

Here is mine:

      -
        client_id: 'myid'
        client_name: 'netbox'
        client_secret: 'mysecret'
        public: false
        authorization_policy: 'one_factor'
        consent_mode: 'implicit'
        redirect_uris:
          - 'https://netbox-dev.domain.net/oauth/complete/oidc'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        userinfo_signed_response_alg: 'none'

Also, how does pip freeze look in netbox?

Mine:

> docker exec -it netbox bash
> source ../venv/bin/activate
> pip freeze
aniso8601==9.0.1
apache-libcloud==3.8.0
asgiref==3.8.1
attrs==24.2.0
azure-core==1.31.0
azure-storage-blob==12.22.0
babel==2.16.0
bcrypt==4.2.0
boto3==1.35.20
botocore==1.35.20
cachetools==5.5.0
certifi==2024.8.30
cffi==1.17.1
charset-normalizer==3.3.2
click==8.1.7
colorama==0.4.6
cryptography==43.0.1
defusedxml==0.8.0rc2
Django==5.0.9
django-auth-ldap==4.8.0
django-cors-headers==4.4.0
django-debug-toolbar==4.4.6
django-filter==24.3
django-graphiql-debug-toolbar==0.2.0
django-htmx==1.19.0
django-js-asset==2.2.0
django-mptt==0.16.0
django-pglocks==1.0.4
django-prometheus==2.3.1
django-redis==5.4.0
django-rich==1.11.0
django-rq==2.10.2
django-storages==1.14.4
django-tables2==2.7.0
django-taggit==6.0.0
django-timezone-field==7.0
djangorestframework==3.15.2
drf-spectacular==0.27.2
drf-spectacular-sidecar==2024.7.1
dropbox==12.0.2
dulwich==0.22.1
feedparser==6.0.11
future==1.0.0
ghp-import==2.1.0
google-api-core==2.19.2
google-auth==2.34.0
google-cloud-core==2.4.1
google-cloud-storage==2.18.2
google-crc32c==1.6.0
google-resumable-media==2.7.2
googleapis-common-protos==1.65.0
graphene==3.3
graphene-django==3.2.2
graphql-core==3.2.4
graphql-relay==3.2.0
idna==3.10
inflection==0.5.1
isodate==0.6.1
Jinja2==3.1.4
jmespath==1.0.1
jsonschema==4.23.0
jsonschema-specifications==2023.12.1
junos-eznc==2.7.1
lxml==5.3.0
Markdown==3.7
markdown-it-py==3.0.0
MarkupSafe==2.1.5
mdurl==0.1.2
mergedeep==1.3.4
mkdocs==1.6.1
mkdocs-autorefs==1.2.0
mkdocs-get-deps==0.2.0
mkdocs-material==9.5.34
mkdocs-material-extensions==1.3.1
mkdocstrings==0.26.1
mkdocstrings-python-legacy==0.2.4
napalm==5.0.0
napalm-procurve==0.6.0
napalm-s350==0.5.1
napalm_aruba505==0.0.168
ncclient==0.6.15
ndg-httpsclient==0.5.1
netaddr==1.3.0
netboxlabs-diode-netbox-plugin==0.4.1
netboxlabs-netbox-branching==0.5.0
netmiko==4.4.0
netutils==1.9.1
nh3==0.2.18
ntc_templates==7.0.0
oauthlib==3.2.2
packaging==24.1
paginate==0.5.7
paramiko==3.5.0
pathspec==0.12.1
pillow==10.4.0
platformdirs==4.3.3
ply==3.11
prometheus_client==0.20.0
promise==2.3
proto-plus==1.24.0
protobuf==5.28.1
psycopg==3.2.1
psycopg-c==3.2.1
psycopg-pool==3.2.3
pyasn1==0.6.1
pyasn1_modules==0.4.1
pycparser==2.22
pyeapi==1.0.4
Pygments==2.18.0
PyJWT==2.9.0
pymdown-extensions==10.9
PyNaCl==1.5.0
pyOpenSSL==24.2.1
pyparsing==3.1.4
pyserial==3.5
python-dateutil==2.9.0.post0
python-ldap==3.4.4
python3-openid==3.2.0
python3-saml==1.16.0
pytkdocs==0.16.2
PyYAML==6.0.2
pyyaml_env_tag==0.1
redis==5.0.8
referencing==0.35.1
regex==2024.9.11
requests==2.32.3
requests-oauthlib==2.0.0
rich==13.8.1
rpds-py==0.20.0
rq==1.16.2
rsa==4.9
s3transfer==0.10.2
scp==0.15.0
sentry-sdk==2.13.0
setuptools==75.1.0
sgmllib3k==1.0.0
six==1.16.0
social-auth-app-django==5.4.2
social-auth-core==4.5.4
sqlparse==0.5.1
stone==3.3.1
strawberry-graphql==0.240.2
strawberry-graphql-django==0.47.2
svgwrite==1.4.3
tablib==3.6.1
text-unidecode==1.3
textfsm==1.1.3
transitions==0.9.2
ttp==0.9.5
ttp-templates==0.3.6
typing_extensions==4.12.2
tzdata==2024.1
uritemplate==4.1.1
urllib3==2.2.3
watchdog==5.0.2
wheel==0.44.0
xmlsec==1.3.14
yamlordereddictloader==0.4.2

julianstolp Sep 26, 2024

Im also using authelia. Your error looks like netbox does not recognize the cert. I would assume that I would eventually reach your issue too, since I don't have any certs configured on netbox. But one step at a time...
How did you configure authelia?

I have not set up the open id connect in Authelia yet. Will try tomorrow. Thank you for your configuration, I share mine once it's set up.

Also, how does pip freeze look in netbox?

We have a lot of different packages installed, but the same of version of social-auth-app-django==5.4.2 and social-auth-core==4.5.4. The only version difference between the packages we share are platformdirs==4.3.6 / 4.3.3 and ntc_templates==6.0.0 / 7.0.0. I tested NetBox with your version, but I still did not get your error.

amqp==5.2.0
aniso8601==9.0.1
asgiref==3.8.1
attrs==24.2.0
babel==2.16.0
bcrypt==4.2.0
billiard==4.2.0
celery==5.4.0
certifi==2024.8.30
cffi==1.17.1
charset-normalizer==3.3.2
click==8.1.7
click-didyoumean==0.3.1
click-plugins==1.1.1
click-repl==0.3.0
colorama==0.4.6
cryptography==43.0.1
defusedxml==0.8.0rc2
Django==5.0.9
django-auth-ldap==4.8.0
django-cors-headers==4.4.0
django-debug-toolbar==4.4.6
django-extensions==3.2.3
django-filter==24.3
django-graphiql-debug-toolbar==0.2.0
django-htmx==1.19.0
django-js-asset==2.2.0
django-mptt==0.16.0
django-netfields==1.3.2
django-pglocks==1.0.4
django-prometheus==2.3.1
django-redis==5.4.0
django-rich==1.11.0
django-rq==2.10.2
django-tables2==2.7.0
django-taggit==6.0.0
django-timezone-field==7.0
djangorestframework==3.15.2
drf-extra-fields==3.7.0
drf-spectacular==0.27.2
drf-spectacular-sidecar==2024.7.1
feedparser==6.0.11
filetype==1.2.0
future==1.0.0
ghp-import==2.1.0
graphene==3.3
graphene-django==3.2.2
graphql-core==3.2.4
graphql-relay==3.2.0
gunicorn==23.0.0
idna==3.10
inflection==0.5.1
Jinja2==3.1.4
jsonschema==4.23.0
jsonschema-specifications==2023.12.1
kombu==5.4.1
Markdown==3.7
markdown-it-py==3.0.0
MarkupSafe==2.1.5
mdurl==0.1.2
mergedeep==1.3.4
mkdocs==1.6.1
mkdocs-autorefs==1.2.0
mkdocs-get-deps==0.2.0
mkdocs-material==9.5.34
mkdocs-material-extensions==1.3.1
mkdocstrings==0.26.1
mkdocstrings-python-legacy==0.2.4
natsort==8.4.0
netaddr==1.3.0
netbox-attachments==6.0.0
netbox-documents==0.7.0
netbox-kea==1.0.1
netbox_reorder_rack==1.1.1
netmiko==4.4.0
nh3==0.2.18
ntc_templates==6.0.0
oauthlib==3.2.2
packaging==24.1
paginate==0.5.7
paramiko==3.5.0
pathspec==0.12.1
pillow==10.4.0
platformdirs==4.3.6
ply==3.11
prometheus_client==0.20.0
promise==2.3
prompt_toolkit==3.0.47
psycopg==3.2.1
psycopg-c==3.2.1
psycopg-pool==3.2.3
psycopg2==2.9.9
pyasn1==0.6.1
pyasn1_modules==0.4.1
pycparser==2.22
Pygments==2.18.0
PyJWT==2.9.0
pymdown-extensions==10.9
PyNaCl==1.5.0
pynetbox==7.4.0
pyserial==3.5
pysmi==1.5.0
pysnmp==7.1.4
python-dateutil==2.9.0.post0
python-dotenv==1.0.1
python-ldap==3.4.4
python3-openid==3.2.0
pytkdocs==0.16.2
pyuwsgi==2.0.26
PyYAML==6.0.2
pyyaml_env_tag==0.1
redis==5.0.8
referencing==0.35.1
regex==2024.9.11
requests==2.32.3
requests-oauthlib==2.0.0
rich==13.8.1
rpds-py==0.20.0
rq==1.16.2
scp==0.15.0
setuptools==75.1.0
sgmllib3k==1.0.0
six==1.16.0
social-auth-app-django==5.4.2
social-auth-core==4.5.4
sqlparse==0.5.1
strawberry-graphql==0.240.2
strawberry-graphql-django==0.47.2
svgwrite==1.4.3
tablib==3.6.1
text-unidecode==1.3
textfsm==1.1.3
typing_extensions==4.12.2
tzdata==2024.1
uritemplate==4.1.1
urllib3==2.2.3
vine==5.1.0
watchdog==5.0.2
wcwidth==0.2.13
wheel==0.44.0

julianstolp Sep 27, 2024

Hi @davama as promised I share my config from Authelia and NetBox. I got everything working as expected.

Authelia Config - configuration.acl.yml

    - domain:
        - "netbox-test.domain.net"
      subject:
       - 'group:<ldap-group>'
      policy: 'two_factor'

The following command is used to create an individual OIDC client secret.
Each client receives an individual password → Important: The client must receive the password in plain text!

The digest must be stored in the configuration!

> docker run authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
 
Random Password: ejcFHZHatOHud_BJ.Hs6UI6xk.IJUwh0cq~hhhKoZF31OvOYOVTtnONUvCxIyAXugBn7nYRh
Digest: $pbkdf2-sha512$310000$ByPJhVV/fIZJNVpaZCPlAw$LLeOsuhQ8NwLvBuEtlswoCW2Ao7ZTOV1L5nPgLKaTB8.xiozx0gLX/HZplYg97jyWzJKEky/6YJpuzpIyxjFoA

The random values and passwords from the output are shown for demonstration purposes only and do not correspond to the values set on the server!

Authelia Config - configuration.yml

identity_providers:
  oidc:
    hmac_secret: '<hmac_secret>'
    jwks:
      - key: |
          -----BEGIN PRIVATE KEY-----
          <KEYPRIV IN PEM>
          -----END PRIVATE KEY-----
        certificate_chain: |
          -----BEGIN CERTIFICATE-----
          <CERT IN PEM>
          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----
          <SUBCERT IN PEM>
          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----
          <ROOTCERT IN PEM>
          -----END CERTIFICATE-----
    authorization_policies:
      policy_name:
        default_policy: 'two_factor'
        rules:
          - policy: 'deny'
            subject: 'group:<ldap_group1>'
    lifespans:
      access_token: '1h'
      authorize_code: '1m'
      id_token: '1h'
      refresh_token: '90m'
    cors:
      endpoints:
        - 'authorization'
        - 'token'
        - 'revocation'
        - 'introspection'
      allowed_origins:
        - 'https://domain.net'

    clients:
      - client_id: '01-test-netbox'
        client_name: 'netbox-test'
        client_secret: '<oidc_client_secret_digest>'
        public: false
        authorization_policy: 'two_factor'
        consent_mode: 'auto'
        redirect_uris:
           - 'https://netbox-test.domain.net/oauth/complete/oidc/'
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        userinfo_signed_response_alg: 'none'

NetBox - configuration.py

# Remote authentication support
REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = ['netbox.authentication.LDAPBackend', 'social_core.backends.open_id_connect.OpenIdConnectAuth']
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = False
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
 
# Python social auth
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = 'https://auth.domain.net'
SOCIAL_AUTH_OIDC_KEY = '01-test-netbox'
SOCIAL_AUTH_OIDC_SECRET = '<oidc_client_secret>'
SOCIAL_AUTH_VERIFY_SSL = '/etc/ssl/certs/'
SOCIAL_AUTH_PIPELINE = [
    'social_core.pipeline.social_auth.social_details',
    'social_core.pipeline.social_auth.social_uid',
    'social_core.pipeline.social_auth.auth_allowed',
    'social_core.pipeline.social_auth.social_user',
    'social_core.pipeline.social_auth.associate_by_email',
    'social_core.pipeline.social_auth.associate_user',
    'social_core.pipeline.social_auth.load_extra_data',
    'social_core.pipeline.user.user_details'
]

davama · 2024-09-27T19:44:49Z

davama
Sep 27, 2024
Author

@julianstolp
Thank you very much!
will try it out

0 replies

davama · 2024-09-30T13:34:08Z

davama
Sep 30, 2024
Author

@julianstolp
I'm so dumb

I kept working with env variables but never added those variables to the configuration.py file 😮‍💨

Using the below in configuration.py

SOCIAL_AUTH_BACKEND_ATTRS = {
    'oidc': ("Sign in with authelia", ""),
}

if 'SOCIAL_AUTH_OIDC_OIDC_ENDPOINT' in environ:
    SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = environ.get('SOCIAL_AUTH_OIDC_OIDC_ENDPOINT', None)

if 'SOCIAL_AUTH_OIDC_KEY' in environ:
    SOCIAL_AUTH_OIDC_KEY = environ.get('SOCIAL_AUTH_OIDC_KEY', None)

if 'SOCIAL_AUTH_OIDC_SECRET' in environ:
    SOCIAL_AUTH_OIDC_SECRET = environ.get('SOCIAL_AUTH_OIDC_SECRET', None)

if 'SOCIAL_AUTH_VERIFY_SSL' in environ:
    SOCIAL_AUTH_VERIFY_SSL = environ.get('SOCIAL_AUTH_VERIFY_SSL', None)

if 'SOCIAL_AUTH_OIDC_USERNAME_KEY' in environ:
    SOCIAL_AUTH_OIDC_USERNAME_KEY = environ.get('SOCIAL_AUTH_OIDC_USERNAME_KEY', None)

if 'SOCIAL_AUTH_OIDC_SCOPE' in environ:
    SOCIAL_AUTH_OIDC_SCOPE = _environ_get_and_map('SOCIAL_AUTH_OIDC_SCOPE ', '', _AS_LIST)

And these env vars:

SOCIAL_AUTH_OIDC_OIDC_ENDPOINT="https://myendpoint.net"
SOCIAL_AUTH_OIDC_KEY="mykey"
SOCIAL_AUTH_OIDC_SECRET="mysecret"
SOCIAL_AUTH_VERIFY_SSL="/path/to/root/ca"
SOCIAL_AUTH_OIDC_USERNAME_KEY="preferred_username"
SOCIAL_AUTH_OIDC_SCOPE="openid profile groups email"

oidc works well.

Need to figure out how to sync different groups (staff,super,etc)

Thanks!

1 reply

davama Oct 1, 2024
Author

figured out the group issue:

needed to add below to configuration.py file

SOCIAL_AUTH_OIDC_IGNORE_DEFAULT_SCOPE = True
SOCIAL_AUTH_PIPELINE = [
    'social_core.pipeline.social_auth.social_details',
    'social_core.pipeline.social_auth.social_uid',
    'social_core.pipeline.social_auth.social_user',
    'social_core.pipeline.user.get_username',
    'social_core.pipeline.social_auth.associate_by_email',
    'social_core.pipeline.user.create_user',
    'social_core.pipeline.social_auth.associate_user',
    'netbox.authentication.user_default_groups_handler',
    'social_core.pipeline.social_auth.load_extra_data',
    'social_core.pipeline.user.user_details',
    'netbox.custom_pipeline.set_role'
]
SOCIAL_AUTH_OIDC_EXTRA_DATA = [('roles','roles')]

and used this custom_pipeline.py script from here with minor adjustsments

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

using openidconnectauth (oidc) #17549

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

using openidconnectauth (oidc) #17549

Uh oh!

Uh oh!

davama Sep 19, 2024

Replies: 3 comments · 4 replies

Uh oh!

julianstolp Sep 25, 2024

Uh oh!

davama Sep 25, 2024 Author

Uh oh!

julianstolp Sep 26, 2024

Uh oh!

Uh oh!

julianstolp Sep 27, 2024

Uh oh!

davama Sep 27, 2024 Author

Uh oh!

davama Sep 30, 2024 Author

Uh oh!

davama Oct 1, 2024 Author

davama
Sep 19, 2024

Replies: 3 comments 4 replies

julianstolp
Sep 25, 2024

davama Sep 25, 2024
Author

davama
Sep 27, 2024
Author

davama
Sep 30, 2024
Author

davama Oct 1, 2024
Author