Configuring Netbox for Automatic User Account Creation and Group Assignment with SSO

[F3d0s]

I would like to find a way to configure Netbox (with or without plug-in) so that when a new user, who does not have a Netbox account logs in via SSO, his account is automatically created and assigned to the related groups, based on which Azure AD groups his account belongs to. If his account already exists in Netbox, then a check should be made in case the user has been assigned to a new group, e.g. if he has been assigned to the Azure AD group netbox-admins, then he should be assigned to DCIM-Admins in Netbox, and Staff and Superuser should be flagged.

At the moment, I'm using django3_saml2_nbplugin, which for some reason, is not working as it should; I configured everything following the manual. Still, suppose a user is part of the netbox-admins group. In that case, he is not added to the related Netbox group nor assigned the Superuser flag.

To make a test, I removed my Test account from the Azure AD group netbox-admins, completely removed it from NetBox users, and then re-added it to the Azure AD group netbox-admins.

After logging back into Netbox via SSO, the Test account was not in DCIM-Admins, and the 'Superuser' flag wasn't checked; the account appears to be active, but nothing else. If I manually add the account to the DCIM-Admins group and check the 'Superuser' flag, the group and flag are automatically removed after logging back in.

Does someone know if there is a way to configure it properly, possibly using Auth0 instead of SAML?

This is how I configured django3_saml2_nbplugin in configuration.py (I hid some details)

# Remote authentication support
REMOTE_AUTH_ENABLED = True
#REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_BACKEND = 'django3_saml2_nbplugin.backends.SAML2CustomAttrUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

# Enable installed plugins. Add the name of each plugin to the list.
PLUGINS = ['django3_saml2_nbplugin']
#PLUGINS = []

# Plugins configuration settings. These settings are used by various plugins that the user may have installed.
# Each key in the dictionary is the name of an installed plugin and its value is a dictionary of settings.
PLUGINS_CONFIG = {
    'django3_saml2_nbplugin': {

        'AUTHENTICATION_BACKEND': REMOTE_AUTH_BACKEND,
        'ASSERTION_URL': 'https://dcimtest.server.cloud/api/plugins',
        'ENTITY_ID': 'https://dcimtest.server.cloud/',

        # Metadata is required, choose either remote url
        'METADATA_AUTO_CONF_URL': "https://login.microsoftonline.com/6d3fc077-0dff-####-####-44341fb2f###/federationmetadata/2007-06/federationmetadata.xml?appid=94b90929-####-497a-####-229cc###263b",
        # or local file path
        # 'METADATA_LOCAL_FILE_PATH': '/opt/netbox/DCIM.xml',

        # Settings for SAML2CustomAttrUserBackend. Optional.
        'CUSTOM_ATTR_BACKEND': {
            # Attribute containing the username. Optional.
            "USERNAME_ATTR": "name",
            # Attribute containing the user's email. Optional.
            "MAIL_ATTR": "emailAddress",
            # Attribute containing the user's first name. Optional.
            "FIRST_NAME_ATTR": "givenName",
            # Attribute containing the user's last name. Optional.
            "LAST_NAME_ATTR": "surname",
            # Set to True to always update the user on logon
            # from SAML attributes on logon. Defaults to False.
            'ALWAYS_UPDATE_USER': True,
            # Attribute that contains groups. Optional.
            'GROUP_ATTR': 'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups',
            # Dict of user flags to groups.
            # If the user is in the group then the flag will be set to True. Optional.
            'FLAGS_BY_GROUP': {
                'is_staff': 'dff13f8f-2167-####-bd7e-6a17574cc###', #DCIM-operator group
                'is_superuser': 'c273533e-####-4dc7-98d3-09841d1eb###' #DCIM-admins group
            },
            # Dict of SAML groups to NetBox groups. Optional.
            # Groups must be created beforehand in NetBox.
            'GROUP_MAPPINGS': {
                'd51a17ec-####-####-####-c9696a30efbf': 'DCIM-readonly',
                'dff13f8f-####-####-####-6a17574cce00': 'DCIM-operator',
                '0a310d41-####-####-####-d0c3a656ed5c': 'DCIM-tenant-admins',
                '5fafd340-####-####-####-2d2a9655141a': 'DCIM-Admins'
            }
        }
    }
}

[CTV-2023]

Hi,
Answered in another discussion, with backend social_core.backends.saml.SAMLAuth
Use a specific pipeline in settings.py to manage rights
Reddit link