Trying to configure Okta/Auth0 OIDC on Netbox v3.6.4 but getting a 404 error

[erosa23]

I'm following the instructions here:
https://www.oasys.net/posts/okta-sso-with-netbox/
to configure my Netbox v3.6.4 to authenticate users via Okta/Auth0 OIDC. After entering my credentials on the Auth0 screen, I get the following error on my browser:

Server Error
There was a problem with your request. Please contact an administrator.
The complete exception is provided below:
<class 'requests.exceptions.HTTPError'>
404 Client Error: Not Found for url: https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/v1/token
Python version: 3.10.12
NetBox version: 3.6.4
Plugins: None installed

Netbox files and installation notes:

root@ip-10-176-80-98:# source /opt/netbox/venv/bin/activate
(venv) root@ip-10-176-80-98:# cd /opt/netbox/
(venv) root@ip-10-176-80-98:/opt/netbox# pip install python-jose
Requirement already satisfied: python-jose in ./venv/lib/python3.10/site-packages (3.3.0)
Requirement already satisfied: ecdsa!=0.15 in ./venv/lib/python3.10/site-packages (from python-jose) (0.18.0)
Requirement already satisfied: rsa in ./venv/lib/python3.10/site-packages (from python-jose) (4.9)
Requirement already satisfied: pyasn1 in ./venv/lib/python3.10/site-packages (from python-jose) (0.5.0)
Requirement already satisfied: six>=1.9.0 in ./venv/lib/python3.10/site-packages (from ecdsa!=0.15->python-jose) (1.16.0)
(venv) root@ip-10-176-80-98:/opt/netbox# echo python-jose >> local_requirements.txt
(venv) root@ip-10-176-80-98:/opt/netbox#
(venv) root@ip-10-176-80-98:/opt/netbox# cat local_requirements.txt
python-jose
python-jose
(venv) root@ip-10-176-80-98:/opt/netbox# deactivate

Excerpt from configuration.py:

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'social_core.backends.okta_openidconnect.OktaOpenIdConnect'
SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY= 'xxxxxxxxxx'
SOCIAL_AUTH_OKTA_OPENIDCONNECT_SECRET= 'yyyyyyyyyy'
SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL= 'https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/'
SOCIAL_AUTH_PIPELINE = [
"social_core.pipeline.social_auth.social_details",
"social_core.pipeline.social_auth.social_uid",
"social_core.pipeline.social_auth.auth_allowed",
"social_core.pipeline.social_auth.social_user",
"social_core.pipeline.social_auth.associate_by_email",
"social_core.pipeline.user.create_user",
"social_core.pipeline.social_auth.associate_user",
"social_core.pipeline.social_auth.load_extra_data",
"social_core.pipeline.user.user_details"
]
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_USER_FIRST_NAME = 'HTTP_REMOTE_USER_FIRST_NAME'
REMOTE_AUTH_USER_LAST_NAME = 'HTTP_REMOTE_USER_LAST_NAME'
REMOTE_AUTH_USER_EMAIL = 'HTTP_REMOTE_USER_EMAIL'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = {}

Screenshots of my Auth0 configs are attached. I see from the Auth0 logs that the authentications are successful. I'm likely missing something simple. Any help would be appreciated. Thanks.

[candlerb]

Looks to me like python-social-auth is broken.

PSA has hard-coded URL paths with "v1" in their name here:

class OktaMixin:
    def api_url(self):
        return append_slash(self.setting("API_URL"))

    def authorization_url(self):
        return self._url("v1/authorize")

    def access_token_url(self):
        return self._url("v1/token")

OktaMixin is inherited by OktaOAuth2, and in turn by OktaOpenIdConnect

But the Okta URL you gave clearly doesn't use v1 in the paths.

$ curl -sS https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/.well-known/openid-configuration | python3 -mjson.tool
{
    "issuer": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/",
    "authorization_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/authorize",
    "token_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/oauth/token",
    "device_authorization_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/oauth/device/code",
    "userinfo_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/userinfo",
    "mfa_challenge_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/mfa/challenge",
    "jwks_uri": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/.well-known/jwks.json",
    "registration_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/oidc/register",
    "revocation_endpoint": "https://dev-xyt2ijb2tbk2pnrt.us.auth0.com/oauth/revoke",
...

I think PSA would need to be changed so that OktaOpenIdConnect doesn't inherit the (bad) token URL. That's a problem you can isolate (with a test case not dependent on Netbox) and then take upstream.

[erosa23]

Thank you candlerb for your suggestion. I updated my okta.py to the below. I'm getting passed the token error but am seeing a username error instead. Please see screenshot. I did confirm that the username exists in Auth0 and that Auth0 is showing a successful login. Is my server not getting the username from Auth0?

ubuntu@ip-10-176-80-98:~$ cat /opt/netbox/venv/lib/python3.10/site-packages/social_core/backends/okta.py
"""
Okta OAuth2 and OpenIdConnect:
https://python-social-auth.readthedocs.io/en/latest/backends/okta.html
"""
from urllib.parse import urljoin

from ..utils import append_slash
from .oauth import BaseOAuth2

class OktaMixin:
def api_url(self):
return append_slash(self.setting("API_URL"))

def authorization_url(self):
return self._url("oauth/authorize")

def access_token_url(self):
return self._url("oauth/token")

def _url(self, path):
return urljoin(append_slash(self.setting("API_URL")), path)

def oidc_config(self):
return self.get_json(
self._url(
"/.well-known/openid-configuration?client_id={}".format(
self.setting("KEY")
)
)
)

class OktaOAuth2(OktaMixin, BaseOAuth2):
"""Okta OAuth authentication backend"""

name = "okta-oauth2"
REDIRECT_STATE = False
ACCESS_TOKEN_METHOD = "POST"
SCOPE_SEPARATOR = " "
ID_KEY = "preferred_username"

DEFAULT_SCOPE = ["openid", "profile", "email"]
EXTRA_DATA = [
("refresh_token", "refresh_token", True),
("expires_in", "expires"),
("token_type", "token_type", True),
]

def get_user_details(self, response):
"""Return user details from Okta account"""
return {
"username": response.get("preferred_username"),
"email": response.get("email") or "",
"first_name": response.get("given_name"),
"last_name": response.get("family_name"),
}

def user_data(self, access_token, *args, **kwargs):
"""Loads user data from Okta"""
return self.get_json(
self._url("userinfo"),
headers={
"Authorization": f"Bearer {access_token}",
},
)

[ahmedabrar914]

[candlerb]

Please don't ping me personally. I don't use Okta and I don't use python-social-auth.