Closed mp-strachan closed 2 years ago
Resolved this with the following config:
# Remote authentication support
REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'django3_saml2_nbplugin.backends.SAML2AttrUserBackend'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
PLUGINS = ["django3_saml2_nbplugin"]
PLUGINS_CONFIG = {
'django3_saml2_nbplugin': {
# Use different Name ID format
'NAME_ID_FORMAT': 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
# Use the Netbox default remote backend
'AUTHENTICATION_BACKEND': REMOTE_AUTH_BACKEND,
# Custom URL to validate incoming SAML requests against
'ASSERTION_URL': 'https://ipam.{{mydomain}}.cloud/',
# Populates the Issuer element in authn reques e.g defined as "Audience URI (SP Entity ID)" in SSO
'ENTITY_ID': 'https://ipam.{{mydomain}}.cloud/',
# Metadata is required, choose either remote url
'METADATA_AUTO_CONF_URL': "https://app.onelogin.com/saml/metadata/e0edbafc-4444-4735-a98a-43rfg434f4f4",
}
}
It's important to pay close attention to trailing slashes!!
All other values were as per above message: https://github.com/jeremyschulman/netbox-plugin-auth-saml2/issues/62#issue-1305608952
Hi all, I am trying to deploy this plugin, on top of the netbox-docker image.
I have got the plugin up and running, and I can click the login button (I am using the button during testing, not the proxy rewrite), and that successfully directs to our OneLogin domain. But after a successful authentication, I am directed back to a page (https://ipam.{{mydomain}}.cloud/sso/acs/) displaying the error "You do not have permission to access this page."
configuration.py
System is behind a Apache reverse proxy.
Apache.conf:
In the docker logs, I see the following errors:
OneLogin Configuration
Application details
RelayState: [blank]
Audience (EntityID): https://ipam.{{mydomain}}.cloud/
Recipient: [blank]
ACS (Consumer) URL Validator: https://ipam.{{mydomain}}.cloud/sso/acs/
ACS (Consumer) URL: https://ipam.{{mydomain}}.cloud/sso/acs/
Single Logout URL: [blank]
Login URL: https://ipam.{{mydomain}}.cloud/login
SAML not valid before: 3min (default)
SAML not valid on or after: 3min (default)
SAML initiator: OneLogin (default)
SAML nameID format: Email (default)
SAML issuer type: Specific (default)
SAML signature element: Response (default)
Encrypt assertion: [unticked] (default)
SAML encryption method: TRIPLEDES-CDC (default)
Send NameID Format in SLO Request: [unticked] (default)
Generate AttributeValue tag for empty values: [unticked] (default)
SAML sessionNotOnOrAfter: 1440min (default)
Sign SLO Request: [unticked] (default)
Sign SLO Response: [unticked] (default)
SSO Configuration
I've tried a variety of different configurations, but I don't seem to be able to get passed this issue.
Any assistance would be greatly appreciated!!