LDAP - AUTH_LDAP_USER_FLAGS_BY_GROUP - assign permissions v2.11.10

[isweluiz]

Problem

I'm looking for some help, long days that I'm trying to connect my netbox to the LDAP assign the permissions group to the local group using the AUTH_LDAP_USER_FLAGS_BY_GROUP option, with active directory I had success but using the OpenLDAP server and freeipa as I'll show below I can't sync, is this a bug to the problem?

I was using version 2.6 and I updated to 2.11.10 where one bug #5442 was found related to this, but with 2.11.10 this should be solved.

Version

Netbox: 2.11.10
Python: 3.8

Logs and troubleshooting

The logs are not clean about the reason, because the user is a member of all required groups.

search_s('cn=users,cn=accounts,dc=lab,dc=local', 2, '(uid=%(user)s)') returned 1 objects: uid=luiz,cn=users,cn=accounts,dc=lab,dc=local
Caught LDAPError while authenticating luiz: UNWILLING_TO_PERFORM({'msgtype': 111, 'msgid': 5, 'result': 53, 'desc': 'Server is unwilling to perform', 'ctrls': []})

Ldap configuration file

If I disable the following options I can log in:

# Simple group restrictions
AUTH_LDAP_REQUIRE_GROUP = "cn=netbox_users,cn=groups,cn=compat,dc=lab,dc=local"
AUTH_LDAP_DENY_GROUP = "cn=netbox_disable,cn=groups,cn=compat,dc=lab,dc=local"

AUTH_LDAP_USER_FLAGS_BY_GROUP = { 
}

The same configuration file as we have on the official Django documentation

import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType


# Baseline configuration.
AUTH_LDAP_SERVER_URI = "ldap://freeipa.lab.local"

AUTH_LDAP_BIND_DN = "uid=admin,cn=users,cn=accounts,dc=lab,dc=local"
AUTH_LDAP_BIND_PASSWORD = "********"
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "cn=users,cn=accounts,dc=lab,dc=local", ldap.SCOPE_SUBTREE, "(uid=%(user)s)"
)
# Or:
# AUTH_LDAP_USER_DN_TEMPLATE = 'uid=%(user)s,ou=users,dc=example,dc=com'

# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    "cn=groups,cn=compat,dc=lab,dc=local",
    ldap.SCOPE_SUBTREE,
    "(objectClass=groupOfNames)",
)
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType(name_attr="cn")

# Simple group restrictions
AUTH_LDAP_REQUIRE_GROUP = "cn=netbox_users,cn=groups,cn=compat,dc=lab,dc=local"
AUTH_LDAP_DENY_GROUP = "cn=netbox_disable,cn=groups,cn=compat,dc=lab,dc=local"

# Populate the Django user from the LDAP directory.
AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "CN=active,CN=groups,CN=compat,dc=lab,dc=local",
    "is_staff": "CN=staff,CN=groups,CN=compat,dc=lab,dc=local",
    "is_superuser": "CN=superuser,CN=groups,CN=compat,dc=lab,dc=local",
}

# This is the default, but I like to be explicit.
AUTH_LDAP_ALWAYS_UPDATE_USER = True

# Use LDAP group membership to calculate group permissions.
AUTH_LDAP_FIND_GROUP_PERMS = True

# Cache distinguished names and group memberships for an hour to minimize
# LDAP traffic.
AUTH_LDAP_CACHE_TIMEOUT = 3600

# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS = (
    "django_auth_ldap.backend.LDAPBackend",
    "django.contrib.auth.backends.ModelBackend",
)

[isweluiz]

SOLVED.

If more anyone have this issue with freeipa here you are what i did to solve:

LOGS after the solution works

search_s('cn=users,cn=accounts,dc=lab,dc=local', 2, '(uid=%(user)s)') returned 1 objects: uid=luiz,cn=users,cn=accounts,dc=lab,dc=local
Populating Django user luiz
uid=luiz,cn=users,cn=accounts,dc=lab,dc=local is a member of cn=active,cn=groups,cn=accounts,dc=lab,dc=local
uid=luiz,cn=users,cn=accounts,dc=lab,dc=local is a member of cn=staff,cn=groups,cn=accounts,dc=lab,dc=local
uid=luiz,cn=users,cn=accounts,dc=lab,dc=local is a member of cn=superuser,cn=groups,cn=accounts,dc=lab,dc=local

1. Changed the CN=compat,dc=lab,dc=local to CN=accounts,dc=lab,dc=local
2. Added the AUTH_LDAP_GROUP_BASE option
3. Changed the backend method search per groupOfNames

New configuration file

import ldap
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType, PosixGroupType , LDAPGroupQuery


# Baseline configuration.
AUTH_LDAP_SERVER_URI = "ldap://freeipa.lab.local"

AUTH_LDAP_BIND_DN = "uid=admin,cn=users,cn=accounts,dc=lab,dc=local"
AUTH_LDAP_BIND_PASSWORD = "*****"
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "cn=users,cn=accounts,dc=lab,dc=local", ldap.SCOPE_SUBTREE, "(uid=%(user)s)"
)
# Or:
# AUTH_LDAP_USER_DN_TEMPLATE = 'uid=%(user)s,ou=users,dc=example,dc=com'

# Set up the basic group parameters.
AUTH_LDAP_GROUP_BASE = "cn=groups,cn=accounts,dc=lab,dc=local"
AUTH_LDAP_GROUP_FILTER = "(objectClass=groupOfNames)"
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(AUTH_LDAP_GROUP_BASE,
                                    ldap.SCOPE_SUBTREE, AUTH_LDAP_GROUP_FILTER)
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType(name_attr="cn")


# Simple group restrictions
#AUTH_LDAP_REQUIRE_GROUP = "cn=netbox_users,cn=groups,cn=accounts,dc=lab,dc=local"
#AUTH_LDAP_DENY_GROUP = "cn=netbox_disable,cn=groups,cn=compat,dc=lab,dc=local"

# Populate the Django user from the LDAP directory.
AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail",
}

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "CN=active,CN=groups,CN=accounts,dc=lab,dc=local",
    "is_staff": "CN=staff,CN=groups,CN=accounts,dc=lab,dc=local",
    "is_superuser": "CN=superuser,CN=groups,CN=accounts,dc=lab,dc=local",
}

# This is the default, but I like to be explicit.
AUTH_LDAP_ALWAYS_UPDATE_USER = True

# Use LDAP group membership to calculate group permissions.
AUTH_LDAP_FIND_GROUP_PERMS = True

# Cache distinguished names and group memberships for an hour to minimize
# LDAP traffic.
#AUTH_LDAP_CACHE_TIMEOUT = 3600

# Keep ModelBackend around for per-user permissions and maybe a local
# superuser.
AUTHENTICATION_BACKENDS = (
    "django_auth_ldap.backend.LDAPBackend",
    "django.contrib.auth.backends.ModelBackend",
)


# Mirror LDAP group assignments.
#AUTH_LDAP_MIRROR_GROUPS = True 

[idelac3]

I got the following error when using FreeIPA LDAP auth. as backend:

'list' object has no attribute 'lower' while authenticating idelac

Binding as uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu
Binding as UID=netbox,CN=users,CN=accounts,DC=int,DC=matison,DC=eu
uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu is a member of cn=admins,cn=groups,cn=accounts,dc=int,dc=matison,dc=eu
Invoking search_s('uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu', 0, '(objectClass=*)')
search_s('uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu', 0, '(objectClass=*)') returned 1 objects: uid=idelac,cn=users,cn=accounts,dc=int,dc=matison,dc=eu
'list' object has no attribute 'lower' while authenticating idelac

Here's my configuration of ldap_config.py:

import ldap
import logging, logging.handlers
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType, NestedGroupOfNamesType

# Server URI
AUTH_LDAP_SERVER_URI = "ldap://ipa1.int.matison.eu, ldap://ipa2.int.matison.eu"

## The following may be needed if you are binding to Active Directory.
#AUTH_LDAP_CONNECTION_OPTIONS = {
#    ldap.OPT_REFERRALS: 0
#}

## Set the DN variables, where all the groups and user accounts are located.
AUTH_LDAP_BASE = "CN=accounts,DC=int,DC=matison,DC=eu"
AUTH_LDAP_USER_BASE = "cn=users," + AUTH_LDAP_BASE
AUTH_LDAP_GROUP_BASE = "cn=groups," + AUTH_LDAP_BASE

## Set the DN and password for the NetBox service account.
AUTH_LDAP_BIND_DN = "UID=netbox,CN=users,CN=accounts,DC=int,DC=matison,DC=eu"
AUTH_LDAP_BIND_PASSWORD = "xxxxxxx"

## Instead of a BIND Search Account, using authenticated user to search
#AUTH_LDAP_BIND_AS_AUTHENTICATING_USER = True
 
#
## Include this setting if you want to ignore certificate errors. This might be needed to accept a self-signed cert.
## Note that this is a NetBox-specific setting which sets:
##     ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
#LDAP_IGNORE_CERT_ERRORS = False
#
## Include this setting if you want to validate the LDAP server certificates against a CA certificate directory on your server
## Note that this is a NetBox-specific setting which sets:
##     ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, LDAP_CA_CERT_DIR)
#LDAP_CA_CERT_DIR = '/etc/ssl/certs'
#
## Include this setting if you want to validate the LDAP server certificates against your own CA.
## Note that this is a NetBox-specific setting which sets:
##     ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, LDAP_CA_CERT_FILE)
#LDAP_CA_CERT_FILE = '/path/to/example-CA.crt'

# This search matches users with the sAMAccountName equal to the provided username. This is required if the user's
# username is not in their DN (Active Directory).
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    AUTH_LDAP_USER_BASE,
    ldap.SCOPE_SUBTREE,
    "(uid=%(user)s)"
)

# If a user's DN is producible from their username, we don't need to search.
AUTH_LDAP_USER_DN_TEMPLATE = "uid=%(user)s," + AUTH_LDAP_USER_BASE

# You can map user attributes to Django attributes as so.
AUTH_LDAP_USER_ATTR_MAP = {
    "username": ["uid","userid","sAMAccountName"],
    "email": ["mail","email","userPrincipalName"],
    "name": "cn",
    "first_name": "givenName",
    "last_name": "sn",
}

AUTH_LDAP_USER_QUERY_FIELD = "username"

# This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
# hierarchy.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    AUTH_LDAP_GROUP_BASE,
    ldap.SCOPE_SUBTREE,
    "(objectClass=groupOfNames)"
)
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType(name_attr="cn")

# Define a group required to login.
AUTH_LDAP_REQUIRE_GROUP = "cn=admins," + AUTH_LDAP_GROUP_BASE

# Mirror LDAP group assignments.
AUTH_LDAP_MIRROR_GROUPS = True

# Define special user types using groups. Exercise great caution when assigning superuser status.
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "CN=admins," + AUTH_LDAP_GROUP_BASE,
    "is_staff": "CN=admins," + AUTH_LDAP_GROUP_BASE,
    "is_superuser": "CN=admins," + AUTH_LDAP_GROUP_BASE
}

# For more granular permissions, we can map LDAP groups to Django groups.
AUTH_LDAP_FIND_GROUP_PERMS = True

# Cache groups for one hour to reduce LDAP traffic
AUTH_LDAP_CACHE_TIMEOUT = 3600
AUTH_LDAP_ALWAYS_UPDATE_USER = True

Any idea what's wrong here ?

[idelac3]

SOLVED

I've changed the ldap_config.py file:

The previous/old file had this part:

# You can map user attributes to Django attributes as so.
AUTH_LDAP_USER_ATTR_MAP = {
    "username": ["uid","userid","sAMAccountName"],
    "email": ["mail","email","userPrincipalName"],
    "name": "cn",
    "first_name": "givenName",
    "last_name": "sn",
}

and I've changed into:

AUTH_LDAP_USER_ATTR_MAP = {
    "username": "uid", # ["uid","userid","sAMAccountName"],
    "email": "mail", # ["mail","email","userPrincipalName"],
    "name": "cn",
    "first_name": "givenName",
    "last_name": "sn",
}

This is the debug log for the django_ldap_auth part of netbox:

root@ops-vlu-netbox:~# cat /opt/netbox/local/logs/django-ldap-debug.log
Binding as uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu
Binding as UID=netbox,CN=users,CN=accounts,DC=int,DC=matison,DC=eu
uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu is a member of cn=admins,cn=groups,cn=accounts,dc=int,dc=matison,dc=eu
Invoking search_s('uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu', 0, '(objectClass=*)')
search_s('uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu', 0, '(objectClass=*)') returned 1 objects: uid=idelac,cn=users,cn=accounts,dc=int,dc=matison,dc=eu
Populating Django user idelac
uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu is a member of cn=admins,cn=groups,cn=accounts,dc=int,dc=matison,dc=eu
uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu is a member of cn=admins,cn=groups,cn=accounts,dc=int,dc=matison,dc=eu
uid=idelac,cn=users,CN=accounts,DC=int,DC=matison,DC=eu is a member of cn=admins,cn=groups,cn=accounts,dc=int,dc=matison,dc=eu
root@ops-vlu-netbox:~#

The log file is under: /opt/netbox/local/logs/django-ldap-debug.log