Azure SSO login problem

[jovanradin]

Hi,
i can't make Azure SSO login working, helm chart version 4.1.1.

My config is:

values.yaml:

  - secret:
      secretName: netbox-azure
  - values:
      SOCIAL_AUTH_PIPELINE:
        [
          "social_core.pipeline.social_auth.social_details",
          "social_core.pipeline.social_auth.social_uid",
          "social_core.pipeline.social_auth.social_user",
          "social_core.pipeline.user.get_username",
          "social_core.pipeline.social_auth.associate_by_email",
          "social_core.pipeline.user.create_user",
          "social_core.pipeline.social_auth.associate_user",
          "netbox.authentication.user_default_groups_handler",
          "social_core.pipeline.social_auth.load_extra_data",
          "social_core.pipeline.user.user_details",
          "netbox.sso_pipeline_roles.set_role",
        ]
  
extraVolumes:
  - name: sso-pipeline-roles
    configMap:
      name: sso-pipeline-roles
extraVolumeMounts:
  - name: sso-pipeline-roles
    mountPath: /opt/netbox/netbox/netbox/sso_pipeline_roles.py
    subPath: sso_pipeline_roles.py
    readOnly: true

sso-configmap.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: sso-pipeline-roles
  namespace: netbox
data:
  sso_pipeline_roles.py: |
    from django.contrib.auth.models import Group
    def set_role(response, user, backend, *args, **kwargs):
      client_id = 'my-real-client-id'
      roles = []
      try:
        roles = response['resource_access'][client_id]['roles']
      except KeyError:
        pass
      user.is_staff = ('admin' in roles)
      user.is_superuser = ('superuser' in roles)
      user.save()
      groups = Group.objects.all()
      for group in groups:
        try:
          if group.name in roles:
            group.user_set.add(user)
          else:
            group.user_set.remove(user)
        except Group.DoesNotExist:
          continue

netbox-azure.yaml

SOCIAL_AUTH_AZUREAD_OAUTH2_KEY: my-real-key
SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET: my-real-secret
SOCIAL_AUTH_AZUREAD_OAUTH2_TENANT_ID: my-real-tenant-id

Whatever i tried, i'm always receiving same error:

<class 'social_core.exceptions.AuthForbidden'>
Your credentials aren't allowed

Error in netbox pod is:

Internal Server Error: /oauth/complete/azuread-oauth2/
Traceback (most recent call last):
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/utils.py", line 247, in wrapper
    return func(*args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/backends/oauth.py", line 392, in auth_complete
    response = self.request_access_token(
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/backends/oauth.py", line 370, in request_access_token
    return self.get_json(*args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/backends/base.py", line 242, in get_json
    return self.request(url, *args, **kwargs).json()
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/backends/base.py", line 238, in request
    response.raise_for_status()
  File "/opt/netbox/venv/lib/python3.10/site-packages/requests/models.py", line 1021, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://login.microsoftonline.com/common/oauth2/token
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
  File "/opt/netbox/venv/lib/python3.10/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
  File "/opt/netbox/venv/lib/python3.10/site-packages/django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/django/views/decorators/cache.py", line 62, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/django/views/decorators/csrf.py", line 54, in wrapped_view
    return view_func(*args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_django/utils.py", line 46, in wrapper
    return func(request, backend, *args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_django/views.py", line 31, in complete
    return do_complete(request.backend, _do_login, user=request.user,
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/actions.py", line 45, in do_complete
    user = backend.complete(user=user, *args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/backends/base.py", line 40, in complete
    return self.auth_complete(*args, **kwargs)
  File "/opt/netbox/venv/lib/python3.10/site-packages/social_core/utils.py", line 252, in wrapper
    raise AuthForbidden(args[0])
social_core.exceptions.AuthForbidden: Your credentials aren't allowed

Is it possible to make it work with azuread, documantation has only settings for github and keycloak?

[jovanradin]

It was probably just copy/paste error in SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET (didn't save secret)

After recreating secret in azure everything works.