Closed bonzi closed 3 years ago
@LordBonzi can you share your nginx config for NetBox?
server {
listen ip:80;
# CHANGE THIS TO YOUR SERVER'S NAME
server_name netboxd.testing;
client_max_body_size 25m;
location /static/ {
alias /opt/netbox/netbox/static/;
}
location / {
proxy_pass http://127.0.0.1:8001;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
}
location /login/ {
proxy_pass http://127.0.0.1:8001/api/plugins/sso/login/;
}
location /sso/ {
proxy_pass http://127.0.0.1:8001/api/plugins/sso/; # Must have a trailing slash to strip the original path
}
}
(venv) root@MemeMachine:/opt/netbox/netbox#
And what URL did you configure as Destination/Redirection URL on keycloak side for the app?
Those are correct as well, not sure what else could be causing this. May be try not using DEFAULT_NEXT_URL
even though it should get overwritten and not sure if that would cause this but worth a try.
Even with the DEFAULT_NEXT_URL
commented out, It still loops.
Hi @LordBonzi - apologize for the delay responding Hi @log1cb0mb - thanks for jumping in to assist!
@LordBonzi - I could not tell from your screenshots if you had configured your KeyCloak system to provide the specific SAML attributes the code is looking for in that backend.
https://github.com/jeremyschulman/netbox-plugin-auth-saml2/blob/master/django3_saml2_nbplugin/backends.py#L32
Specifically:
The KeyCloak system needs to provide the first_name
and last_name
values as attributes in the response payload. Could you please confirm that the system is configured accordingly?
Another approach is to change your plugin config to use the other backend: https://github.com/jeremyschulman/netbox-plugin-auth-saml2/blob/master/django3_saml2_nbplugin/backends.py#L12
In which case only the email-address attribute is used.
Hope this helps!
Hi @jeremyschulman,
Here is a list of all attributes sent to the SP.
SAML2DottedEmailUserBackend does not work for our use case as we do not use first_name.last_name as our email schema. However, our usernames do match the beginning of our email. e.g. bonzi@netboxd.testing
, jeremy@netbox.testing
, etc
Here is a full dump of the SAML attributes returned to NetBox:
...
<saml:AttributeStatement>
<saml:Attribute FriendlyName="nb-sso email" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">bonzi@netboxd.testing</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="email" Name="urn:oid:1.2.840.113549.1.9.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">bonzi@netboxd.testing</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="nb-sso last-name" Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Foster</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="nb-saml2 first_name" Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Alfie</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="surname" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Foster</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Alfie</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
...
My SSO server returns Email, First name and Lastname, both in standard SAML terms (using urn:oid
's) and the ways specified by you.
This can create accounts, as witnessed when disabling SSO and entering the admin panel manually. See below image.
the alfie.foster
account was generated by the SAML2AttrUserBackend backend, yet is stuck in the loop. Therefore proving my SSO server send the correct attributes.
I hope this helps.
I am starting to think that it might be related to the fact that configuration.py probably has two different backends. You are defining plugin one directly in PLUGIN_CONFIG
and then what about NetBox system level parameter i.e REMOTE_AUTH_BACKEND = 'backend_name'
. I am hoping that either only one is defined (considering NetBox accepts that if only plugin config is calling backend) or you have two different backends?
How about you define:
REMOTE_AUTH_BACKEND = 'django3_saml2_nbplugin.backends.SAML2AttrUserBackend'
and then in PLUGIN_CONFIG below just call that variable:
'AUTHENTICATION_BACKEND': REMOTE_AUTH_BACKEND
I suspect even though plugin is creating user profile as per plugin_config but NetBox app itself is looking to verify user against: REMOTE_AUTH_BACKEND
OK, apparently that worked like a charm! Now my only gripe is the lack of an email user as username backend as then I'd be able to log in to my existing accounts
I'd most certainly used that exact conf before, so something else must be at play but I won't try to fix what's not technically broken.
Thanks for your help, I shall open another issue/pr to add an email user as username backend.
Perfect! And email as username? Isnt that already there, the first backend available in this plugin backend called: SAML2DottedEmailUserBackend
Also, FYI the one that you are currently using has a small caveat which i explained here: https://github.com/jeremyschulman/netbox-plugin-auth-saml2/issues/8#issuecomment-663051804
SAML2DottedEmailUserBackend
would not work for our use case as it extrapolates a person's name based off of the email
For example, an email of bonzi@netboxd.testing
lacks a .
in the middle of the name for it to split to get their name. What would be needed is taking the Firstname/Lastname generation from the SAML2AttrUserBackend
backend, but keeping the extracting the username from the email, (e.g. bonzi
from bonzi@netboxd.testing
) as this matches our normal username/email schema.
closing issue as I believe it is resolved. we can re-open if not.
When logging in to NetBox with this SAML2 plugin, it causes an infinite loop of authentication requests to my IDP (Keycloak), See the attached image and console output for an example of the redirection loop
Keycloak reports that my client has successfully authenticated and has sent the correct assertion to NetBox.
My config looks like this: