Any way to sync groups with SSO?

[gboor]

I have configured Netbox to authenticate against Keycloak and that works very well, there only doesn't seem to be a way to sync groups and/or assign staff/superuser based on group membership.

With the RemoteUserBackend you can set which HTTP header contains groups and which groups grant superuser or staff status. The token I authenticate with includes the groups, but I can't figure out how to make them sync.

Is this possible at all?

[candlerb]

I couldn't get group sync to work with the python-social-auth stuff, but it's working with RemoteUserBackend.

I run mod_auth_openidc on the Apache reverse proxy which sits on the Netbox server in front of gunicorn.

Netbox configuration

# Remote authentication support
REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
REMOTE_AUTH_GROUP_HEADER = 'HTTP_OIDC_CLAIM_ROLES'
REMOTE_AUTH_GROUP_SYNC_ENABLED = True
REMOTE_AUTH_GROUP_SEPARATOR = ','
REMOTE_AUTH_STAFF_GROUPS = ['netbox:staff']
REMOTE_AUTH_SUPERUSER_GROUPS = ['netbox:superuser']

Also, you need to create groups in Netbox called "netbox:access", "netbox:staff" and "netbox:superuser" manually, before you turn on REMOTE_AUTH_ENABLED.

Apache configuration

    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    ProxyPass / http://127.0.0.1:8001/
    ProxyPassReverse / http://127.0.0.1:8001/

    OIDCProviderMetadataURL https://keycloak.example.net/realms/example.net/.well-known/openid-configuration
    OIDCClientID netbox
    OIDCClientSecret XXXXXXXX

    OIDCRedirectURI /oauth2callback
    OIDCCryptoPassphrase XXXXXsome-random-stringXXXXX
    OIDCScope "openid email profile roles"
    OIDCSessionInactivityTimeout 43200
    OIDCCookieSameSite On
    #Only available in mod_auth_openidc 2.3.8+:
    OIDCStateMaxNumberOfCookies 7 true

    # Note that OIDC Providers (OP) don't guarantee the uniqueness of these claims
    #OIDCRemoteUserClaim email
    OIDCRemoteUserClaim preferred_username
    OIDCPassUserInfoAs claims
    OIDCPassClaimsAs headers
    RequestHeader unset REMOTE_USER
    RequestHeader set REMOTE_USER expr=%{REMOTE_USER}

    <Location />
        AuthType openid-connect
        Require claim roles:netbox:access
        AuthzSendForbiddenOnFailure on
    </Location>

    <Location /api/>
        <RequireAny>
            AuthType openid-connect
            Require claim roles:netbox:access
            # Allow access to /api/ with token instead of OIDC Auth
            # https://httpd.apache.org/docs/2.4/howto/access.html#env
            Require expr "%{HTTP:Authorization} =~ /^Token /"
        </RequireAny>
        AuthzSendForbiddenOnFailure on
    </Location>

Keycloak configuration

I use Keycloak client roles, rather than groups, to control Netbox. This is more flexible, since you can add client roles to one or more groups as well as to individual users; it means the policy of who can do what is centralised in Keycloak, and Netbox doesn't know or care.

To create the client:

• Clients > Add
• Enter client ID: "netbox"
• "Settings" tab
  • set "Access Type" to "Confidential"
  • set "Valid Redirect URIs" to https://netbox.example.net/oauth2callback
  • click Save
• A new tab "Credentials" appears: get the client secret from here
• "Roles" tab: create roles "netbox:access", "netbox:staff" and "netbox:superuser"
• "Mappers" tab: "Add builtin", select "Client roles", click "Add selected"

You can add these roles selectively to groups. For example, if you have an "Admin" group which needs them all:

• Groups > Admin > Edit
• Role Mappings; Client Roles > Netbox
• add "netbox:access", "netbox:staff" and "netbox:superuser"

You also have to configure Keycloak to expose these roles as a flat list in the ID token:

• Clients > netbox > Mappers
• Add builtin; check "client roles"
• Click on "client roles"
• Change "Token claim name" to "roles"
• Change "Add to ID token" to On
• Save

Use tcpdump -i lo -nn -s0 -A tcp port 8001 to look at traffic going between the proxy and gunicorn. With this setting, you should see (for someone in the Admin group):

OIDC_CLAIM_roles: netbox:access,netbox:superuser,netbox:staff

Groups and roles

With this config, only users with "netbox:access" role are allowed to see Netbox, and the staff/superuser privileges work as expected. You can also create other roles which will sync as Netbox groups. (Note: these groups aren't created automatically in Netbox; I saw a patch which added REMOTE_AUTH_AUTO_CREATE_GROUPS but I don't think it's merged yet. What is synced is your membership of these groups, if they already exist as Netbox groups)

You don't have to prefix the role names with "netbox:". I just did so to make it clear what they were for (and because I was using groups instead of client roles previously)

You don't have to use the client roles if you don't want. You should be able to configure Keycloak to expose a 'groups' claim in the ID token, and modify the Apache config to use that. But then Netbox will need to see lots of groups that it doesn't care about; and you'll have to configure in Netbox itself the policy of which organizational groups are allowed to do what.

---

Aside: Since getting it to work with Keycloak, I've moved to using Vault as OIDC provider. That doesn't have any concept of "roles" so I'm using groups for that. Its web UI isn't as good as Keycloak for user management, but on the plus side it doesn't use java so it's much more lightweight, and it offers a whole bunch of other functionality including an SSH certificate authority.

[gboor]

I was already able to do this with REMOTE_AUTH and oauth2-proxy, which worked fine for syncing groups. I switched to the built-in SSO auth using social_core.backends.keycloak.KeycloakOAuth2 - which works too.

REMOTE_AUTH settings are no longer available. I was just wondering if I could sync groups with pure SSO, but it looks like it will require a proxy of some sort and REMOTE_AUTH to be able to do that. Am I understanding that correctly?

Would it be technically possible to achieve this with some changes? I could look into making an MR for it...

[candlerb]

I was just wondering if I could sync groups with pure SSO

By "pure SSO" do you mean with social_core.backends.<foo>? I spent quite a lot of time on this, but as I said, I wasn't able to get it to work.

What happens is: if you modify the PSA backend to return a list of strings as a 'groups' attribute from get_user_details(), then Django barfs. I couldn't work out how to fix this.

[gboor]

Thanks for the very complete breakdown. That's certainly a shame...

It does seem to me that this can be fixed in social-auth, no? Especially because it seems to work for other backends... I will try to do some testing. Thanks for the pointers!

[mtinberg]

Yes, this should work. You need to tell Netbox configure.py which header is used for the group info (eg. X-MyGroups or isMemberOf) and what record separator is used when the identity is members of multiple groups (eg, ',' or ':' or whatever) then you need to create matching group names in Netbox, you can also specify in configure.py a group that should toggle the Staff or Superuser bit, which is in the docs. If it's not clear which header has the info then you can tcpdump/wireshark the connection between the https proxy server and the http uWSGI/gunicorn process manager or create a dummy CGI that just prints out the environment so you can see exactly what is being passed to the application from the http server eg. from my ansible config REMOTE_AUTH_ENABLED: True REMOTE_AUTH_BACKEND: "netbox.authentication.RemoteUserBackend" REMOTE_AUTH_HEADER: 'HTTP_X_MYAUTH' #REMOTE_USER is also common REMOTE_AUTH_GROUP_HEADER: 'HTTP_X_MYGROUPS' #this may be auth-provider specific REMOTE_AUTH_GROUP_SEPARATOR: ';' REMOTE_AUTH_GROUP_SYNC_ENABLED: True REMOTE_AUTH_AUTO_CREATE_USER: True REMOTE_AUTH_DEFAULT_GROUPS: - my:saml:group1 REMOTE_AUTH_STAFF_GROUPS: - my:saml:group2 REMOTE_AUTH_SUPERUSER_GROUPS: - my:saml:group3 REMOTE_AUTH_DEFAULT_PERMISSIONS: {} Simple test CGI (do not leave on an active public server so it doesn't give away info you don't want) #! /usr/bin/perl -T use warnings; use strict; use CGI; use Data::Dumper; $Data::Dumper::Sortkeys=1; my $cgi = CGI->new(); print $cgi->header('text/plain'); print(Dumper($ENV)); — Mark Tinberg ***@***.***> Division of Information Technology-Network Services University of Wisconsin-Madison

…

________________________________ From: Gerard ***@***.***> Sent: Thursday, June 30, 2022 7:39 AM To: netbox-community/netbox ***@***.***> Cc: Subscribed ***@***.***> Subject: [netbox-community/netbox] Any way to sync groups with SSO? (Discussion #9635) I have configured Netbox to authenticate against Keycloak and that works very well, there only doesn't seem to be a way to sync groups and/or assign staff/superuser based on group membership. With the RemoteUserBackend you can set which HTTP header contains groups and which groups grant superuser or staff status. The token I authenticate with includes the groups, but I can't figure out how to make them sync. Is this possible at all? — Reply to this email directly, view it on GitHub<#9635>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAS7UM3Z75TUUT3RDFHD7MDVRWIQJANCNFSM52JGYPWQ>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[gboor]

See my reply to the earlier post - I know it can be done with REMOTE_AUTH and some proxy, but I'd like it to work with the built-in SSO.

[jschewebbn]

Based on the discussion here it looks like I need a webserver module to get group information into netbox when using an external authentication provider. Is that correct? Has anyone gotten it to work using the build-in SSO setup?

[jose-hernandez2]

I know this thread is old, but did anyone find a way to do this? We are also trying to sync groups using social_core.backends.keycloak.KeycloakOAuth2, but couldn’t find a way so far..

[candlerb]

People have apparently done it by inserting custom python code into the authentication pipeline. What I've seen seems mainly people using Azure AD rather than Keycloak, but I did find a Keycloak example here.

Try searching for SOCIAL_AUTH_PIPELINE in the discussions archive, e.g. #9216. You'll also find cases of people who can't get it to work, e.g. #13129

[jschewebbn]

I ended up using mod_auth_oidc with Apache and then the REMOTE_AUTH plugin for netbox.

[marsteel]

I ended up using mod_auth_oidc with Apache and then the REMOTE_AUTH plugin for netbox.

@jschewebbn @jose-hernandez2
To do SSO group sync without reverse proxy, you can follow https://github.com/netbox-community/netbox-chart/blob/develop/docs/auth.md and #12747 to add a new netbox.sso_pipeline_roles.set_role pipeline to SOCIAL_AUTH_PIPELINE in extra.py or settings.py

"netbox.sso_pipeline_roles.set_role" points to /opt/netbox/netbox/sso_pipeline_roles.py

Create a python script file as /opt/netbox/netbox/netbox/sso_pipeline_roles.py

set_role() in sso_pipeline_roles.py will parse SSO user groups passed from IdP and add the user to local netbox groups.

My version is at https://github.com/marsteel/netbox-docker/blob/release/.netbox/netbox/netbox/sso_pipeline_roles.py.

[jose-hernandez2]

Hi @marsteel ,

Yes, thank you for your answer. I was able to get the groups from Keycloak as described in the documentation that @candlerb provided me, which is basically what you mentioned as well. However, when I updated to Netbox v.4.0.1, it was necessary to change a few things in the sso_pipeline_roles.py as described here: #16098
In my case I had to change the Group import from django.contrib.auth.models import Group to netbox.authentication import Group and at the end of the script, change the group assignment to be done using group.users.add(user). Otherwise, I would get the error mentioned in the GitHub Discussion ('Group' object has no attribute 'user_set').

[marsteel]

@jose-hernandez2

Thank you for the reminder for this change.
Starting with Netbox v4.0.x , the "Group" in similiar statement of kinds of customized sso_pipeline_roles.py is empty if it is from "from django.contrib.auth.models import Group"

from django.contrib.auth.models import Group
  groups = Group.objects.all()

#Debug
  print("All available groups in Netbox setting: ")
  print(groups)

The Group is empty. As Group is empty, any logic iterating over this Emply group and adding user to each returned group item will break.

May 15, 2024 at 10:52 (UTC+2:00) | All available groups in Netbox setting: | netbox-container
May 15, 2024 at 10:52 (UTC+2:00) | <QuerySet []> | netbox-container

I have fixed my script accordingly.