[4.0.0]Custom pipeline - Create groups for SAML

[CTV-2023]

Hi,
I hope my diagnostic will be accurate, I'm trying to understand what happens here...

In version 3.7, I had a custom pipeline creating groups for SAML users

from django.contrib.auth.models import Group
[...]
def set_role(response, user, backend, *args, **kwargs):
    try:
        roles = response['attributes']['http://schemas.microsoft.com/ws/2008/06/identity/claims/groups']
    except KeyError:
        user.groups.clear()
        raise AuthFailed("No role assigned")
    try:
        user.groups.clear()
        user.is_superuser = False
        user.is_staff = False
        user.save()
        for role in roles:
            if role == 'UTI-Netbox-Admin':
                user.is_superuser = True
                user.is_staff = True
                user.save()
                continue
            group, created = Group.objects.get_or_create(name=role)
            group.user_set.add(user)
    except Group.DoesNotExist:
        pass

This pipeline works in 3.7, and creates the user / the group if it doesn't exist, and puts the user in the group

In can find these groups in the DB in the table auth_group

netbox=# select * from auth_group;
id | name
----+----------------------------
7 | Group-X
9 | Group-Y

In Version 4.0 however, it seems auth_group is not used anymore, which might be expected from release notes.
Groups are now seen in the table users_group

netbox=# select * from users_group;
id | name | description
-----+-------------------------+-------------
104 | Group-X |
105 | Group-Y |

My pipeline still manages to create the user, but it has now 2 issues

• my pipeline still creates groups in the table auth_group (expected ?). Is it possible to populate the correct table ?
• adding a user to a group with its name raises a nasty error create_forward_many_to_many_manager..ManyRelatedManager.add() got an unexpected keyword argument 'name'. Working with new group IDs from table users_group works. Caused by Django 5.0 ?

To explain, my pipeline associates user to groups with

            elif role == 'Group-X':
                user.groups.add(104)
                user.save()

But not with

            elif role == 'Group-X':
                user.groups.add(name=role)
                user.save()

Many changes in this version... is it related to Django version going from 4.2 to 5.0 ? Should I enable DJANGO_ADMIN_ENABLED in config file ?

[pgodzwa]

Same issue here (using Authentik for SSO)

When trying to add groups via id using code below:

def add_groups(response, user, backend, *args, **kwargs):
    try:
        groups = response['groups']
    except KeyError:
        pass

    # Add all groups from oAuth token
    for group in groups:
        group, created = Group.objects.get_or_create(name=group)
        object_id=group.pk
        user.groups.add(object_id)

I get this error:

insert or update on table "users_user_groups" violates foreign key constraint "users_user_groups_group_id_9afc8d0e_fk_users_group_id" DETAIL: Key (group_id)=(7) is not present in table "users_group".

What is the correct way now to map groups via custom pipeline?

[CTV-2023]

@pgodzwa I found the solution reading docs 👍
As an introduction :
https://github.com/netbox-community/netbox/blob/develop/docs/development/models.md

We find the code here
https://github.com/netbox-community/netbox/blob/develop/netbox%2Fnetbox%2Fauthentication%2F__init__.py

I had to make 2 changes :
This line
from django.contrib.auth.models import Group

Is now
from netbox.authentication import Group

And in new Netbox group implementation, we can't assign users to a group, only groups to user (I'll submit a bug report just in case) so this line (in my original code)
group.user_set.add(user)

Is now
user.groups.add(group)

[francesco-noc]

Hi,

thank you for clarification.
As far as you know, will this functionality be added to the code base as for netbox-cloud or will we have to continue implementing it in a customised manner?