LDAP Auth Not Working As Expected #996

pts-jeffreyjewitt · 2023-04-24T16:28:56Z

pts-jeffreyjewitt
Apr 24, 2023

Current Behavior

Starting a fresh 3.4.8 container with docker compose
Set LDAP variables, as per: https://github.com/netbox-community/netbox-docker/wiki/LDAP
Added Caddy for TLS security

Try to login, cannot

AD account known good with prior version of netbox (<3.x)
AD account not locked out

Expected Behavior

I expected that when I try to login with LDAP account, I can login

Docker Compose Version

Docker Compose version v2.3.3

Docker Version

Client: Docker Engine - Community
 Version:           23.0.4
 API version:       1.42
 Go version:        go1.19.8
 Git commit:        f480fb1
 Built:             Fri Apr 14 10:32:04 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          23.0.4
  API version:      1.42 (minimum version 1.12)
  Go version:       go1.19.8
  Git commit:       cbce331
  Built:            Fri Apr 14 10:32:04 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.20
  GitCommit:        2806fc1057397dbaeefbea0e4e17bddfbd388f38
 runc:
  Version:          1.1.5
  GitCommit:        v1.1.5-0-gf19387a
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

The git Revision

61a3afb

The git Status

On branch release
Your branch is up to date with 'origin/release'.

Startup Command

docker compose up / docker compose start

NetBox Logs

docker logs 515de00833fe
↩️ Skip creating the superuser
🧬 loaded config '/etc/netbox/config/configuration.py'
🧬 loaded config '/etc/netbox/config/extra.py'
🧬 loaded config '/etc/netbox/config/logging.py'
🧬 loaded config '/etc/netbox/config/plugins.py'
✅ Initialisation is done.
⏳ Waiting for control socket to be created... (1/10)
2023/04/24 16:25:01 [warn] 7#7 Unit is running unprivileged, then it cannot use arbitrary user and group.
2023/04/24 16:25:01 [info] 7#7 unit 1.29.1 started
2023/04/24 16:25:01 [info] 22#22 discovery started
2023/04/24 16:25:01 [notice] 22#22 module: python 3.10.4 "/usr/lib/unit/modules/python3.10.unit.so"
2023/04/24 16:25:01 [info] 7#7 controller started
2023/04/24 16:25:01 [notice] 7#7 process 22 exited with code 0
2023/04/24 16:25:01 [info] 24#24 router started
2023/04/24 16:25:01 [info] 24#24 OpenSSL 3.0.2 15 Mar 2022, 30000020
⚙️ Applying configuration from /etc/unit/nginx-unit.json
2023/04/24 16:25:02 [info] 28#28 "netbox" prototype started
2023/04/24 16:25:02 [info] 29#29 "netbox" application started
🧬 loaded config '/etc/netbox/config/configuration.py'
🧬 loaded config '/etc/netbox/config/extra.py'
🧬 loaded config '/etc/netbox/config/logging.py'
🧬 loaded config '/etc/netbox/config/plugins.py'
2023/04/24 16:25:06 [info] 38#38 "netbox" application started
✅ Unit configuration loaded successfully
2023/04/24 16:25:06 [notice] 7#7 process 20 exited with code 0
🧬 loaded config '/etc/netbox/config/configuration.py'
🧬 loaded config '/etc/netbox/config/extra.py'
🧬 loaded config '/etc/netbox/config/logging.py'
🧬 loaded config '/etc/netbox/config/plugins.py'
127.0.0.1 - - [24/Apr/2023:16:25:14 +0000] "GET /api/ HTTP/1.1" 200 469 "-" "curl/7.81.0"
127.0.0.1 - - [24/Apr/2023:16:25:28 +0000] "GET /api/ HTTP/1.1" 200 469 "-" "curl/7.81.0"
127.0.0.1 - - [24/Apr/2023:16:25:41 +0000] "GET /api/ HTTP/1.1" 200 469 "-" "curl/7.81.0"
172.21.0.6 - - [24/Apr/2023:16:25:52 +0000] "GET /login/ HTTP/1.1" 200 4860 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"
127.0.0.1 - - [24/Apr/2023:16:25:56 +0000] "GET /api/ HTTP/1.1" 200 469 "-" "curl/7.81.0"
172.21.0.6 - - [24/Apr/2023:16:25:58 +0000] "POST /login/ HTTP/1.1" 200 5747 "https://netbox.points.com/login/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"
127.0.0.1 - - [24/Apr/2023:16:26:12 +0000] "GET /api/ HTTP/1.1" 200 469 "-" "curl/7.81.0"




root@tor-netbox:~# docker compose logs netbox
root@tor-netbox:~#

Content of docker-compose.override.yml

version: '3.4'
services:
  netbox:
    environment:
      REMOTE_AUTH_ENABLED: "True"
      REMOTE_AUTH_BACKEND: "netbox.authentication.LDAPBackend"
      AUTH_LDAP_SERVER_URI: "ldaps://AD DC DN"
      AUTH_LDAP_BIND_DN: "CN=BINDACCOUNTCN"
      AUTH_LDAP_BIND_PASSWORD: "SECRETPASSWORD"
      AUTH_LDAP_USER_SEARCH_BASEDN: "OU=Users,USERS OU"
      AUTH_LDAP_GROUP_SEARCH_BASEDN: "OU=Groups,GROUP OU"
      AUTH_LDAP_REQUIRE_GROUP_DN: "CN=Netbox-Users,GROUP DN"
      AUTH_LDAP_IS_ADMIN_DN: "CN=Netbox-Users,GROUP CN"
      AUTH_LDAP_IS_SUPERUSER_DN: "CN=Netbox-Admins,GROUP CN"
      LDAP_IGNORE_CERT_ERRORS: "true"
      AUTH_LDAP_GROUP_TYPE: "NestedGroupOfNamesType"

    Originally had these set too (from an older install of netbox copied the config to the new instance), have disabled, but still having issues with AD users and logging in
        #AUTH_LDAP_MIRROR_GROUPS: "true"
        #AUTH_LDAP_FIND_GROUP_PERMS: "true"
        #AUTH_LDAP_USER_FLAGS_BY_GROUP: 'Group settings'

All the DN/OU/CNs are the full path to the object in AD

boospy · 2023-07-16T20:23:26Z

boospy
Jul 16, 2023

Same here on 3.5.6 with LDAP Univention.

0 replies

boospy · 2023-07-16T20:46:36Z

boospy
Jul 16, 2023

Just found out something very interesting. The file:

/etc/netbox/config/ldap/ldap_config.py

is not described with Docker's information. Is the data mapped to a different file?

0 replies

dw72 · 2024-02-28T14:53:21Z

dw72
Feb 28, 2024

@boospy do you succed running ldap auth ?

0 replies

boospy · 2024-03-02T22:15:47Z

boospy
Mar 2, 2024

@dw72 not really, unfortunately without success so far. Although everything is entered correctly (according to the documentation).

0 replies

boospy · 2024-03-02T22:39:46Z

boospy
Mar 2, 2024

I also don't understand why there aren't even any reasonable debug logs. How are you supposed to solve such things...?

0 replies

ditshe · 2024-03-13T09:03:33Z

ditshe
Mar 13, 2024

What might work... regarding to https://github.com/netbox-community/netbox/blob/develop/docs/installation/6-ldap.md#example-configuration
but I have to try that myself first
If I understand https://github.com/netbox-community/netbox-docker/wiki/Configuration#custom-configuration-files correctly you need to edit
configuration/ldap/extra.py
+from django_auth_ldap.config import NestedGroupOfNamesType
honestly my problem with this solution is the file is still managed by the git repo

$ grep ldap .gitignore
configuration/ldap/*
!configuration/ldap/extra.py
!configuration/ldap/ldap_config.py

0 replies

boospy · 2024-09-07T11:02:47Z

boospy
Sep 7, 2024

Now here on Netbox 4.1, it works perfectly on docker with this workaround: #360 (comment)

1 reply

asyanaumova23 Sep 30, 2024

Can you show docker-compose.yaml? I tried to set up a workaround, all I get is 502 on my netbox site

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LDAP Auth Not Working As Expected #996

{{title}}

Replies: 7 comments 1 reply

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

LDAP Auth Not Working As Expected #996

Current Behavior

Expected Behavior

Docker Compose Version

Docker Version

The git Revision

The git Status

Startup Command

NetBox Logs

Content of docker-compose.override.yml

Replies: 7 comments · 1 reply

Replies: 7 comments 1 reply