Netbox - Remote authentication failed #14021

Methil-net · 2023-10-11T17:02:12Z

Methil-net
Oct 11, 2023

Hello there,

after setting up the automatic creation of a user and its insertion into a group defined on a docker netbox in 2.10.3, I cannot get it to work in 3.3.10. I can access to my new server but cannot be auto-connected with my user and insert in the group 'Invités'.
My 2 servers work with a docker version and my 2 frontend are with authority based on OpenIdConnect.
I proxy between my frontend and the netbox container on port 8080. I tried through an Apache then Nginx frontend without success. I captured a .pcap between my front end and netbox and I see the REMOTE_USER variable appear with the connection account.

My docker-compose.yml :

version: '3.4'
services:
  netbox: &netbox
    # netbox-docker 2.3.0
    image: netbox:3.3.10
    depends_on:
    - redis
    - netbox-worker
    env_file: env/netbox.env
    user: '101'
    volumes:
    - ./startup_scripts:/opt/netbox/startup_scripts:z,ro
    - ./initializers:/opt/netbox/initializers:z,ro
    - ./configuration:/etc/netbox/config:z,ro
    - ./reports:/etc/netbox/reports:z,ro
    - ./scripts:/etc/netbox/scripts:z,ro
    - netbox-media-files:/opt/netbox/netbox/media:z
    - netbox-static-files:/opt/netbox/netbox/static:z

  netbox-worker:
    <<: *netbox
    depends_on:
    - redis
    command:
    - /opt/netbox/venv/bin/python
    - /opt/netbox/netbox/manage.py
    - rqworker
    ports: []

  # apache
  apache:
    image: docker-prod.artifactory.intrasec.interne/apache/apache-oidc-alpine:2.4.14.2
    container_name: apache
    env_file:
    - ./fic.env
    depends_on:
    - netbox
    ports:
    - 443:443
    volumes:
    - netbox-static-files:/opt/netbox/netbox/static:ro
    - ./keys/:/usr/local/apache2/conf/keys/:rw
    - ./apache/netbox-central.conf:/usr/local/apache2/conf/base_oidc.conf:ro
    - ./apache/logs:/var/log/apache:rw

  # redis
  redis:
    image: redis:7-alpine
    container_name: redis
    command:
    - sh
    - -c # this is to evaluate the $REDIS_PASSWORD from the env
    - redis-server --appendonly yes --requirepass $$REDIS_PASSWORD ## $$ because of docker-compose
    env_file: env/redis.env
    volumes:
    - netbox-redis-data:/data
  redis-cache:
    image: redis:7-alpine
    command:
    - sh
    - -c # this is to evaluate the $REDIS_PASSWORD from the env
    - redis-server --requirepass $$REDIS_PASSWORD ## $$ because of docker-compose
    env_file: env/redis-cache.env

volumes:
  netbox-media-files:
    driver: local
  netbox-redis-data:
    driver: local
  netbox-static-files:
    driver: local
  netbox-nginx-config:
    driver: local

My apache configuration :

<Location "/static/">
        alias "/opt/netbox/netbox/static/"
    </Location>

    <Location "/">
        ProxyPass "http://netbox:8080/"
        AuthType openid-connect
        Require claim GROUP:XXXXXXXXXXXXXXXXX
        RequestHeader set REMOTE_USER %{XXXXXXXXXXXXXXXXXXX}s
    </Location>

    <Location "/api/">
        ProxyPass "http://netbox:8080/api/"
        Require all denied
        # RESEAU 1
        Require ip X.X.X.X/X
        # RESEAU 2
        Require ip X.X.X.X/X
    </Location>

I tried to configure netbox in netbox.env and configuration.py :

REMOTE_AUTH_ENABLED=true
REMOTE_AUTH_AUTO_CREATE_USER=true
REMOTE_AUTH_HEADER="HTTP_REMOTE_USER"
REMOTE_AUTH_DEFAULT_GROUPS=Invités

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = ['Invités']
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

or 

REMOTE_AUTH_ENABLED = _environ_get_and_map('REMOTE_AUTH_ENABLED', 'True', _AS_BOOL)
REMOTE_AUTH_BACKEND = environ.get('REMOTE_AUTH_BACKEND', 'netbox.authentication.RemoteUserBackend')
REMOTE_AUTH_HEADER = environ.get('REMOTE_AUTH_HEADER', 'HTTP_REMOTE_USER')
REMOTE_AUTH_AUTO_CREATE_USER = _environ_get_and_map('REMOTE_AUTH_AUTO_CREATE_USER', 'True', _AS_BOOL)
REMOTE_AUTH_DEFAULT_GROUPS = _environ_get_and_map('REMOTE_AUTH_DEFAULT_GROUPS', '[Invités]', _AS_LIST)
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

This seems a simple use of authentication, on my version 2.10.3 I just had to add the 2 variables REMOTE_AUTH_ENABLED and REMOTE_AUTH_DEFAULT_GROUPS but I cannot do the same thing on a more recent version.
Any help would be appreciated, thank you in advance.

candlerb · 2023-10-11T19:58:36Z

candlerb
Oct 11, 2023

What error do you see? Does the user get created, and if so, can you add them to the group by hand?

It works fine for me. I'm using Netbox 3.6.3 standalone, not in docker. My configuration.py has:

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
REMOTE_AUTH_GROUP_HEADER = 'HTTP_OIDC_CLAIM_GROUPS'
REMOTE_AUTH_GROUP_SYNC_ENABLED = True
REMOTE_AUTH_GROUP_SEPARATOR = ','
REMOTE_AUTH_STAFF_GROUPS = ['netbox:staff']
REMOTE_AUTH_SUPERUSER_GROUPS = ['netbox:superuser']

and the complete Apache config:

<VirtualHost *:80>
    Redirect permanent / https://netbox.example.net/
</VirtualHost>

<VirtualHost *:443>
    ProxyPreserveHost On

    ServerName netbox.example.net

    SSLEngine on
    SSLCertificateFile /etc/dehydrated/certs/netbox.example.net/fullchain.pem
    SSLCertificateKeyFile /etc/dehydrated/certs/netbox.example.net/privkey.pem

    Alias /static /opt/netbox/netbox/static

    <Directory /opt/netbox/netbox/static>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Require all granted
    </Directory>

    <Location /static>
        ProxyPass !
    </Location>

    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
    ProxyPass / http://127.0.0.1:8001/
    ProxyPassReverse / http://127.0.0.1:8001/

    OIDCProviderMetadataURL https://vault.example.net:8200/v1/identity/oidc/provider/default/.well-known/openid-configuration
    OIDCClientID XXXXXXXXXXXXXX
    OIDCClientSecret XXXXXXXXXXXX

    OIDCRedirectURI /oauth2callback
    OIDCCryptoPassphrase XXXXXXXXXXXXXXXXXXXXXXX
    OIDCScope "openid email profile groups"
    OIDCSessionInactivityTimeout 43200
    OIDCCookieSameSite On
    #Only available in mod_auth_openidc 2.3.8+:
    OIDCStateMaxNumberOfCookies 7 true

    # Note that OIDC Providers (OP) don't guarantee the uniqueness of these claims
    #OIDCRemoteUserClaim email
    OIDCRemoteUserClaim preferred_username
    OIDCPassUserInfoAs claims
    OIDCPassClaimsAs headers
    RequestHeader unset REMOTE_USER
    RequestHeader set REMOTE_USER expr=%{REMOTE_USER}

    <Location />
        AuthType openid-connect
        Require claim groups:netbox:access
        AuthzSendForbiddenOnFailure on
    </Location>

    <Location ~ "^/(api|graphql)/">
        <RequireAny>
            AuthType openid-connect
            Require claim groups:netbox:access
            # Allow access to /api/ with token instead of OIDC Auth
            # https://httpd.apache.org/docs/2.4/howto/access.html#env
            Require expr "%{HTTP:Authorization} =~ /^Token /"
        </RequireAny>
        AuthzSendForbiddenOnFailure on
    </Location>

    <Location /metrics>
        <RequireAny>
            AuthType openid-connect
            Require claim groups:netbox:access
            Require ip 10.12.0.0/24
        </RequireAny>
        AuthzSendForbiddenOnFailure on
    </Location>

</VirtualHost>

This is Ubuntu 20.04 with apache2 (2.4.41) and libapache2-mod-auth-openidc (2.4.1)

5 replies

candlerb Oct 11, 2023

I think you should look carefully at your tcpdump, especially what the Remote-User: header contains.

Your config shown had this line:

RequestHeader set REMOTE_USER %{XXXXXXXXXXXXXXXXXXX}s

Firstly, I don't know why you're hiding the name of the variable you're referring to, and secondly I don't know why you have a trailing s - that implies you're substituting an SSL environment variable.

Methil-net Oct 12, 2023
Author

Thanks a lot for your answer Candlerb.

I can't see any error, i cannot directly connected to the new version, i stay on my home page with a "log in". No user created, no group created.

For the apache, i tried :

OIDCRemoteUserClaim preferred_username

and

RequestHeader set REMOTE_USER %{{OIDC_CLAIM_preferred_username}}s

Actually, the first parameter match and i can see in my tcpdump :

REMOTE_USER: **user**\r\n

I go to try differently configurations for the Apache and try to use HTTP_OIDC_CLAIM_PREFERRED_USERNAME in my netbox.env

candlerb Oct 12, 2023

If Apache is providing the right header but Netbox is ignoring it, then I suspect that the problem is around docker.

You cannot put arbitrary config settings in environment variables. Only certain ones are picked up (those which are defined in the special configuration.py that netbox-docker provides)
You shouldn't modify configuration.py. There is a file extra.py for additional user-defined settings.

That's assuming you're using the official netbox-docker image in the first place. I know there are other third-party docker images of Netbox out there.

The version numbers of netbox-docker don't match those for netbox itself, so I'm surprised you're using image: netbox:3.3.10. If it's a third-party image, probably you should take your problem to the supplier of that image.

EDIT: if I were you, I'd be planning to deploy the current version of Netbox (v3.6.3, or netbox-docker v3.6-2.7.0). It's more likely that if you find a problem, someone will help you fix it. Fixes are not backported to old versions of Netbox.

Methil-net Oct 12, 2023
Author

Understood for the configuration.py : i restored configuration.py and use environment file (netbox.env used by my docker-compose.yml).

I'm using official version of netbox-docker, actually netbox-docker-2.3.0 (As you said, the version are différent, this is why i placed à comment in my docker-compose.yml).

Unfortunately, i need to use this version in my production environment. Is there a solution to activate debug mode under the docker container and display more logs ?

candlerb Oct 12, 2023

I think if you really want to use this version, first you should run a non-docker test instance of exactly the same version and test that auth headers work. If they do, then you can try to isolate what's different between the test and docker instances. If it doesn't work, then you know the problem is with that particular version of Netbox. Either way to debug you're probably going to have to start putting print() statements in the python.

Methil-net · 2023-10-30T14:54:34Z

Methil-net
Oct 30, 2023
Author

After a lot of searching, i finally found this post : netbox-community/netbox-docker#441
After several tests on differents versions, you have 2 choices :

use an another variable than REMOTE_USER and set it with your frontend (With Apache, do not use _ )
force the configuration of nginx included in netbox with the parameters described in the previous post

1 reply

marsteel May 3, 2024

#9635 (comment)

then Netbox can fetch SSO group without extra configuration on reverse proxy.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Netbox - Remote authentication failed #14021

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 6 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Netbox - Remote authentication failed #14021

Methil-net Oct 11, 2023

Replies: 2 comments · 6 replies

candlerb Oct 11, 2023

candlerb Oct 11, 2023

Methil-net Oct 12, 2023 Author

candlerb Oct 12, 2023

Methil-net Oct 12, 2023 Author

candlerb Oct 12, 2023

Methil-net Oct 30, 2023 Author

marsteel May 3, 2024

Methil-net
Oct 11, 2023

Replies: 2 comments 6 replies

candlerb
Oct 11, 2023

Methil-net Oct 12, 2023
Author

Methil-net Oct 12, 2023
Author

Methil-net
Oct 30, 2023
Author