No option for OKTA on logon screen

[benek984]

NetBox version

v3.4.6

Python version

3.8

Steps to Reproduce

I have setup app in OKTA so I got all relevant information for configuratio.py

Added below line to configuration.py

REMOTE_AUTH_BACKEND = 'social_core.backends.okta_openidconnect.OktaOpenIdConnect'
SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY = 'xxxxx'
SOCIAL_AUTH_OKTA_OPENIDCONNECT_SECRET = 'xxxxx'
SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL = 'https://xxxx.okta.com/oauth2/'

where xxxx my proper values were specyfied

Expected Behavior

Expecting OKTA logon options on the logon screen.

Observed Behavior

NO OKTA LOGON OPTION ON THE LOGON SCREE

[benek984]

When trying access app from OKTA dashboard this appears:

[Dragnell87]

I am in the same problem with keycloack, did you find the solution ?

[candlerb]

What did you put in configuration.py?

I did get Netbox to work with Keycloak last year, but I had to contribute a fix to python-social-auth to make it work. This was merged, so current versions of PSA should have it.

According to my notes, this is what I did (but I won't guarantee they'll work today, as I'm now using Hashicorp Vault instead of Keycloak, and mod_auth_openidc instead of PSA)

Keycloak doesn't/didn't support OIDC discovery so you have to give the exact endpoint URLs.

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.keycloak.KeycloakOAuth2'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}
SOCIAL_AUTH_KEYCLOAK_KEY = 'netbox-test'
SOCIAL_AUTH_KEYCLOAK_SECRET = 'XXXXXXXX'
SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = 'XXXXXXXXXXXVERYLONGXXXXXXXXXXXXX'
SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = 'https://keycloak.example.net/realms/example.net/protocol/openid-connect/auth'
SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = 'https://keycloak.example.net/realms/example.net/protocol/openid-connect/token'

Also, the documentation says you need to create a mapper for "audience", and this true - Netbox will reject the authentication unless you do this.

Finally: with python-social-auth there is (or was) no group/role syncing to Keycloak - groups are maintained entirely within Netbox itself.

[candlerb]

I do still have the Keycloak server instance. You can see below what needs to go in the OIDC client configuration.

[Dragnell87]

Thanks i will look into this, my current info is:
environment:
- REMOTE_AUTH_ENABLE=True
- REMOTE_AUTH_BACKEND=social_core.backends.keycloak.KeycloakOAuth2
- REMOTE_AUTH_HEADER=HTTP_REMOTE_USER
- REMOTE_AUTH_AUTO_CREATE_USER=True
- REMOTE_AUTH_GROUP_HEADER=HTTP_X_FORWARDED_GROUPS
- REMOTE_AUTH_GROUP_SYNC_ENABLED=True
- REMOTE_AUTH_SUPERUSER_GROUPS=['netbox-admin']
- SOCIAL_AUTH_KEYCLOAK_KEY=netbox
- SOCIAL_AUTH_KEYCLOAK_SECRET=secret
- SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY=MIIBILONG
- SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL=https://infra-auth.local/realms/local/protocol/openid-connect/auth
- SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL=https://infra-auth.local/realms/local/protocol/openid-connect/token

[candlerb]

I suggest you open your browser's developer console and do a login: it should capture all the requests between client-Netbox and client-Keycloak. You should be able to see if the user is being redirected to Keycloak correctly, and what redirect_uri parameter is given, and what URI it gets redirected back to.

[Dragnell87]

Din´t find anything usefull i belive, no clue from where the redirect_uri is coming from. The keycloack.py need to be edited?
Are this values ok? or need to be changed ?
name = "keycloak"
ID_KEY = "username"

Sorry to bother you. Thanks for all the time.

[candlerb]

The keycloack.py [sic] need to be edited?

Which file do you mean? In social_core? No, you shouldn't touch any library code. The settings in your configuration.py override this.

You are showing that Netbox is fetching /auth/login/keycloak/?next=%2Foauth%2Flogin%2Fkeycloak%2FNone. The "next" URL is clearly wrong: it should be the page you were trying to access prior to being forced to the login page.

But what's more interesting is the steps which involve communication with the Keycloak server, and those are missing from your screenshot.

What happens if you go to the root page, https://netbox.example.net/ or whatever? Maybe the Keycloak login already took place, and you'll see the home page successfully. If it redirects you back to the login page, then clicking on "Login with Keycloak" button should redirect you to the Keycloak server, i.e. https://infra-auth.local/..., and therefore your browser should show these additional accesses.

[candlerb]

Thanks i will look into this, my current info is:

environment:
...
- SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL=https://infra-auth.local/realms/local/protocol/openid-connect/auth
- SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL=https://infra-auth.local/realms/local/protocol/openid-connect/token

Aha, you mention "environment" - are you running Netbox in a Docker container by any chance?

If you are, all bets are off. Those settings should go directly in configuration.py, with quotation marks around the string values. netbox-docker only supports a subset of settings via environment variables: see its configuration.py

However it is possible to create an additional file extra.py which you mount inside the container, containing the necessary settings. See here.

[Dragnell87]

Yep, that was IT. Let me invite you to a beer!