Server Error - LDAP Server

[resparis]

I tried to configure LDAP Authentication and it is not wroking when I submit the domain credentials and I got this error:
<class 'netaddr.core.AddrFormatError'>

failed to detect a valid IP address from ''

Python version: 3.10.12
NetBox version: 3.6.5
Plugins: None installed

I can access using local credentials

[candlerb]

Related: #14307, #14262

[xcdr]

Hi.

I have the same problem, occurs only when trying login with incorrect password.

[candlerb]

It doesn't do this at demo.netbox.dev, so it's something different about your environment.

Have you checked your front-end proxy behaviour as here and here ?

[resparis]

Authentication failed for rsordo@orchest.net: failed to map the username to a DN.

Any ideas?

[candlerb]

There's something wrong with your authentication configuration. Can't really help further since you haven't shown it.

[resparis]

Here is ldap_config.py

import ldap
from django_auth_ldap.config import LDAPSearch, NestedGroupOfNamesType

# Server URI
AUTH_LDAP_SERVER_URI = "ldap://my_server"

# The following may be needed if you are binding to Active Directory.
AUTH_LDAP_CONNECTION_OPTIONS = {
   ldap.OPT_REFERRALS: 0
}

# Set the DN and password for the NetBox service account.
AUTH_LDAP_BIND_DN = "CN=NETBOXSA,OU=Service Accounts,DC=orchest,DC=net"
AUTH_LDAP_BIND_PASSWORD = "mypass"

# Include this setting if you want to ignore certificate errors. This might be needed to accept a self-signed cert.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
LDAP_IGNORE_CERT_ERRORS = False

# Include this setting if you want to validate the LDAP server certificates against a CA certificate directory on your server
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, LDAP_CA_CERT_DIR)
LDAP_CA_CERT_DIR = '/etc/ssl/certs'

# Include this setting if you want to validate the LDAP server certificates against your own CA.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, LDAP_CA_CERT_FILE)
LDAP_CA_CERT_FILE = '/path/to/example-CA.crt'

# This search matches users with the sAMAccountName equal to the provided username. This is required if the user's
# username is not in their DN (Active Directory).
AUTH_LDAP_USER_SEARCH = LDAPSearch(
   "cn=Users,dc=orchest,dc=net",
   ldap.SCOPE_SUBTREE,
   "(|(userPrincipalName=%(user)s)(sAMAccountName=%(user)s))"
)

# If a user's DN is producible from their username, we don't need to search.
AUTH_LDAP_USER_DN_TEMPLATE = None

# You can map user attributes to Django attributes as so.
AUTH_LDAP_USER_ATTR_MAP = {
   "username": "sAMAccountName",
   "email": "mail",
   "first_name": "givenName",
   "last_name": "sn",
}

AUTH_LDAP_USER_QUERY_FIELD = "username"

# This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
# hierarchy.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
   "dc=orchest,dc=net",
   ldap.SCOPE_SUBTREE,
   "(objectClass=group)"
)
AUTH_LDAP_GROUP_TYPE = NestedGroupOfNamesType()

# Define a group required to login.
AUTH_LDAP_REQUIRE_GROUP = "CN=netbox-group,OU=Groups,DC=orchest,DC=net"

# Mirror LDAP group assignments.
AUTH_LDAP_MIRROR_GROUPS = True

# Define special user types using groups. Exercise great caution when assigning superuser status.
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
   "is_active": "CN=netbox-active,OU=Groups,DC=orchest,DC=net",
   "is_staff": "CN=netbox-staff,OU=Groups,DC=orchest,DC=net",
   "is_superuser": "CN=netbox-superadmin,OU=Groups,DC=orchest,DC=net"
}

# For more granular permissions, we can map LDAP groups to Django groups.
AUTH_LDAP_FIND_GROUP_PERMS = True

# Cache groups for one hour to reduce LDAP traffic
AUTH_LDAP_CACHE_TIMEOUT = 3600
AUTH_LDAP_ALWAYS_UPDATE_USER = True

From netbox server I tried this python code

connect = ldap.initialize('ldap://my_server')
connect.protocol_version = ldap.VERSION3
connect.set_option(ldap.OPT_REFERRALS, 0)
connect.simple_bind_s('NETBOXSA', 'my_pass')
result = connect.search_s('dc=orchest,dc=net',
                         ldap.SCOPE_SUBTREE,
                         'sAMAccountName=rsordo')

This is the result:

[('CN=Roberto Sordo,CN=Users,DC=orchest,DC=net', {'objectClass': [b'top', b'person', b'organizationalPerson', b'user'], 'cn': [b'Roberto Sordo'], 'sn': [b'Sordo'], 'givenName': [b'Roberto'], 'distinguishedName': [b'CN=Roberto Sordo,CN=Users,DC=orchest,DC=net'], 'instanceType': [b'4'], 'whenCreated': [b'20230909114250.0Z'], 'whenChanged': [b'20231127154920.0Z'], 'displayName': [b'Roberto Sordo'], 'uSNCreated': [b'29598'], 'memberOf': [b'CN=netbox-active,OU=Groups,DC=orchest,DC=net', b'CN=netbox-admin,OU=Groups,DC=orchest,DC=net', b'CN=netbox-superadmin,OU=Groups,DC=orchest,DC=net', b'CN=netbox-group,OU=Groups,DC=orchest,DC=net', b'CN=Radius,CN=Users,DC=orchest,DC=net', b'CN=Domain Admins,CN=Users,DC=orchest,DC=net'], 'uSNChanged': [b'279327'], 'name': [b'Roberto Sordo'], 'objectGUID': [b'\xf3zk\x1b .\xffF\x83\xff\x8cEi\xa8(\xe6'], 'userAccountControl': [b'66048'], 'badPwdCount': [b'0'], 'codePage': [b'0'], 'countryCode': [b'0'], 'badPasswordTime': [b'0'], 'lastLogoff': [b'0'], 'lastLogon': [b'0'], 'pwdLastSet': [b'133387333706614574'], 'primaryGroupID': [b'513'], 'objectSid': [b'\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00\x0b\xabo\xbd\xf7{\xdf\x94<\x80\xdeja\x04\x00\x00'], 'adminCount': [b'1'], 'accountExpires': [b'9223372036854775807'], 'logonCount': [b'0'], 'sAMAccountName': [b'rsordo'], 'sAMAccountType': [b'805306368'], 'userPrincipalName': [b'rsordo@orchest.net'], 'objectCategory': [b'CN=Person,CN=Schema,CN=Configuration,DC=orchest,DC=net'], 'dSCorePropagationData': [b'20230909124021.0Z', b'16010101000000.0Z'], 'lastLogonTimestamp': [b'133455010977844335'], 'mail': [b'rsordo@orchest.net']}), (None, ['ldap://ForestDnsZones.orchest.net/DC=ForestDnsZones,DC=orchest,DC=net']), (None, ['ldap://DomainDnsZones.orchest.net/DC=DomainDnsZones,DC=orchest,DC=net']), (None, ['ldap://orchest.net/CN=Configuration,DC=orchest,DC=net'])]