Saml with google workspace

[jsfrerot]

Hi, I'm running into an issue and I'm stuck because I don't have any logs to point to a specific issue. The only think I have so far is a 503 error.

So here is the information I could gather I think could help. If anything else is needed please let me know. Could be great to have a good documentation on how to make SAML work properly :)

netbox version 3.7.5
Installed with docker behing traefik for https handling.

plugins.py

PLUGINS = [
        "netbox_topology_views",
        "netbox_ipcalculator",
        "netbox_inventory",
        "netbox_prometheus_sd",
        "netbox_dns",
        "netbox_documents",]

PLUGINS_CONFIG = {
  "netbox_inventory": {},
}

relevant config for configuration.py

CSRF_TRUSTED_ORIGINS = _environ_get_and_map('CSRF_TRUSTED_ORIGINS', '', _AS_LIST)
CSRF_TRUSTED_ORIGINS = ['https://accounts.google.com']

REMOTE_AUTH_ENABLED = _environ_get_and_map('REMOTE_AUTH_ENABLED', 'True', _AS_BOOL)
REMOTE_AUTH_BACKEND = _environ_get_and_map('REMOTE_AUTH_BACKEND', 'social_core.backends.saml.SAMLAuth', _AS_LIST)
REMOTE_AUTH_HEADER = environ.get('REMOTE_AUTH_HEADER', 'HTTP_REMOTE_USER')
REMOTE_AUTH_USER_FIRST_NAME = 'HTTP_REMOTE_USER_FIRST_NAME'
REMOTE_AUTH_USER_LAST_NAME = 'HTTP_REMOTE_USER_LAST_NAME'
REMOTE_AUTH_USER_EMAIL = 'HTTP_REMOTE_USER_EMAIL'
REMOTE_AUTH_AUTO_CREATE_USER = _environ_get_and_map('REMOTE_AUTH_AUTO_CREATE_USER', 'True', _AS_BOOL)
REMOTE_AUTH_DEFAULT_GROUPS = _environ_get_and_map('REMOTE_AUTH_DEFAULT_GROUPS', '', _AS_LIST)

SOCIAL_AUTH_SAML_SP_ENTITY_ID       = "https://netbox.mydomain.com/"
SOCIAL_AUTH_SAML_SP_PUBLIC_CERT = """-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----"""
SOCIAL_AUTH_SAML_SP_PRIVATE_KEY = """-----BEGIN PRIVATE KEY-----
REDACTED
-----END PRIVATE KEY-----"""

SOCIAL_AUTH_SAML_ORG_INFO  = {
    "en-US": {
      "name": "netbox",
      "displayname": "netbox",
      "url": "https://netbox.mydomain.com/oauth/complete/saml/"
    }
}
SOCIAL_AUTH_SAML_TECHNICAL_CONTACT = {
    "emailAddress": "mail@mydomain.com",
    "givenName": "Servicedesk"
}
SOCIAL_AUTH_SAML_SUPPORT_CONTACT = {
    "emailAddress": "sysadmin@mydomain.com",
    "givenName": "Servicedesk"
}

SOCIAL_AUTH_SAML_ENABLED_IDPS  = {
    "saml": {
      "entity_id": "https://accounts.google.com/o/saml2?idpid=REDACTED",
      "url": "https://accounts.google.com/o/saml2/idp?idpid=REDACTED",
      "attr_user_permanent_id": "attr_email",
      "attr_username": "attr_email",
      "attr_first_name": "attr_first_name",
      "attr_last_name": "attr_last_name",
      "attr_email": "attr_email",
      "x509cert": """-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----"""
    }
}

relevant info from env/netbox.env

DB_WAIT_DEBUG=1
DEBUG=True

logs after a saml login tentative

netbox-1  | 172.20.0.2 - - [19/Apr/2024:18:49:09 +0000] "GET /login/?next=/ HTTP/1.1" 200 5144 "https://netbox.mydomain.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
netbox-1  | 172.20.0.2 - - [19/Apr/2024:18:49:11 +0000] "GET /oauth/login/saml/?next=%2F&idp=saml HTTP/1.1" 302 0 "https://netbox.mydomain.com/login/?next=/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
netbox-1  | 2024/04/19 18:49:12 [alert] 23#23 app process 36 exited on signal 11 (core dumped)
netbox-1  | 172.20.0.2 - - [19/Apr/2024:18:49:12 +0000] "POST /oauth/complete/saml/ HTTP/1.1" 503 54 "https://accounts.google.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
netbox-1  | 2024/04/19 18:49:16 [info] 81#81 "netbox" application started
netbox-1  | 127.0.0.1 - - [19/Apr/2024:18:49:16 +0000] "GET /api/ HTTP/1.1" 200 549 "-" "curl/7.88.1"
netbox-1  | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox-1  | 🧬 loaded config '/etc/netbox/config/plugins.py'
netbox-1  | 127.0.0.1 - - [19/Apr/2024:18:49:31 +0000] "GET /api/ HTTP/1.1" 200 549 "-" "curl/7.88.1"

Error displayed on netbox's web page (url: https://netbox.mydomain.com/oauth/complete/saml/)
Error 503.

So how can I troubleshoot this further?
Thank you!