Issue with AzureAD SSO Configuration

[themmini]

Trying to implement Azure AD SSO by following this guide:
https://docs.netbox.dev/en/stable/administration/authentication/microsoft-azure-ad/

I'm able to click the sign in link -> login with AD credentials but I get redirected back to this error message after successfully signing in.

<class 'social_core.exceptions.AuthForbidden'>
Your credentials aren't allowed
Python version: 3.8.1
NetBox version: 3.2.2

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.azuread.AzureADOAuth2'
SOCIAL_AUTH_AZUREAD_OAUTH2_KEY = '{XXXX}'
SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET = '{XXXX}'
SOCIAL_AUTH_REDIRECT_IS_HTTPS = True
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = '{New}'

This is what I put in my config.py - is there anything else I am missing?

[markkuleinio]

SOCIAL_AUTH_AZUREAD_OAUTH2_KEY = '{XXXX}'
SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET = '{XXXX}'

Remove the {}'s from these strings first, restart NetBox and try again.

[themmini]

The XXX’s are obscuring the real values

…

________________________________ From: Markku Leiniö ***@***.***> Sent: Tuesday, May 10, 2022 4:20:38 PM To: netbox-community/netbox ***@***.***> Cc: Mini Man ***@***.***>; Author ***@***.***> Subject: Re: [netbox-community/netbox] Issue with AzureAD SSO Configuration (Discussion #9325) SOCIAL_AUTH_AZUREAD_OAUTH2_KEY = '{XXXX}' SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET = '{XXXX}' Remove the {}'s from these strings first, restart NetBox and try again. — Reply to this email directly, view it on GitHub<#9325 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACYAS6IAVDEHTVXH2YAIRTDVJH53NANCNFSM5VQM2Q7Q>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[markkuleinio]

I'm just saying that if you have the starting { or ending } characters in those strings just like you showed us, it won't work. If you don't have them, that's ok then, keep troubleshooting other things.

[themmini]

Ah, my mistake - I’ll try this in the morning.

…

________________________________ From: Markku Leiniö ***@***.***> Sent: Tuesday, May 10, 2022 4:41:05 PM To: netbox-community/netbox ***@***.***> Cc: Mini Man ***@***.***>; Author ***@***.***> Subject: Re: [netbox-community/netbox] Issue with AzureAD SSO Configuration (Discussion #9325) I'm just saying that if you have the starting { or ending } characters in those strings just like you showed us, it won't work. If you don't have them, that's ok then, keep troubleshooting other things. — Reply to this email directly, view it on GitHub<#9325 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACYAS6JWXEWCLXIC2QDK5ATVJIAIDANCNFSM5VQM2Q7Q>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[themmini]

Wow that worked thanks so much – now to setup access for users. I was also looking what else was required to enable guest/external access - is it just changing the backend source to social_core.backends.azuread_tenant.AzureADTenantOAuth2 ? Or are their additional configuration values required?