Package: netbox-plugin-auth-saml2
Netbox Plugin for SSO using SAML2Netbox 2.8 provides enhancements to support remote user authentication uses specific
variables defined in the configuration.py file, as described here:https://netbox.readthedocs.io/en/stable/configuration/optional-settings/This repository provides a Netbox plugin that can be used to integrate with a SAML SSO system,
such as Okta.NOTE: This approach uses a reverse-proxy URL rewrite so that the standard Netbox Login will redirect
the User to the SSO system.  Please refer to the examplenginx.conffile.*NOTE: Netbox plugin for SSO, v2.0+, supports Netbox 2.8, 2.9, 2.10, 2.11, 3.0.System RequirementsYou will need to install thedjango3-auth-saml2into your Netbox environment.Netbox ConfigurationIn theconfiguration.pyyou will need to enable and configure theseREMOTE_AUTH_xxxoptions at a minimum:REMOTE_AUTH_ENABLED=TrueREMOTE_AUTH_BACKEND='utilities.auth_backends.RemoteUserBackend'# For v2.8+:# REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'# For backends included with this plugin:# REMOTE_AUTH_BACKEND = 'django3_saml2_nbplugin.backends.<Backend>'REMOTE_AUTH_AUTO_CREATE_USER=TrueYou can also create the other optionsREMOTE_AUTH_DEFAULT_GROUPSandREMOTE_AUTH_DEFAULT_PERMISSIONSas described in the online docs.Next you will need to configure this plugin, provding your specific
configuraiton values as described indjango3-okta-saml2repo, for example:PLUGINS=['django3_saml2_nbplugin']PLUGINS_CONFIG={'django3_saml2_nbplugin':{# Use the Netbox default remote backend'AUTHENTICATION_BACKEND':REMOTE_AUTH_BACKEND,# Custom URL to validate incoming SAML requests against'ASSERTION_URL':'https://netbox.company.com',# Populates the Issuer element in authn reques e.g defined as "Audience URI (SP Entity ID)" in SSO'ENTITY_ID':'https://netbox.conpany.com/',# Metadata is required, choose either remote url'METADATA_AUTO_CONF_URL':"https://mycorp.okta.com/app/sadjfalkdsflkads/sso/saml/metadata",# or local file path'METADATA_LOCAL_FILE_PATH':'/opt/netbox/saml2.xml',# Settings for SAML2CustomAttrUserBackend. Optional.'CUSTOM_ATTR_BACKEND':{# Attribute containing the username. Optional.'USERNAME_ATTR':'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',# Attribute containing the user's email. Optional.'MAIL_ATTR':'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',# Attribute containing the user's first name. Optional.'FIRST_NAME_ATTR':'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',# Attribute containing the user's last name. Optional.'LAST_NAME_ATTR':'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',# Set to True to always update the user on logon# from SAML attributes on logon. Defaults to False.'ALWAYS_UPDATE_USER':False,# Attribute that contains groups. Optional.'GROUP_ATTR':'http://schemas.microsoft.com/ws/2008/06/identity/claims/groups',# Dict of user flags to groups.# If the user is in the group then the flag will be set to True. Optional.'FLAGS_BY_GROUP':{'is_staff':'saml-group1','is_superuser':'saml-group2'},# Dict of SAML groups to NetBox groups. Optional.# Groups must be created beforehand in NetBox.'GROUP_MAPPINGS':{'saml-group3':'netbox-group'}}}}Please note thatMETADATA_AUTO_CONF_URLandMETADATA_LOCAL_FILE_PATHare
mutually exclusive. Don't use both settings at the same time.New Plugin URLsThis plugin will provide two new URLs to Netbox:/plugins/sso/login/This URLs redirects the User login to the SSO system (Okta) for authentication.  This is the URL that needs
to be used in the reverse-proxy redirect, for examlple seenginx.conf./sso/acs/This URLs should be configured into your SSO system as the route to use to single-sign-on/redirection URL the User into Netbox
after the User has authenticated with the SSO system.Customizing on Create New User ConfigurationIf you want to customize the way a User is created, beyond what is provided by the
Netbox REMOTE_AUTH variables, you can create a custom RemoteBackend class.  See
the samples inbackends.py.Using A Reverse Proxy RedirectThe use of this plugin requires a reverse-proxy URL redirect to override the default Netbox/login/URL.  There
are two notes in this process:You MAY need to disable port in redirect depending on your Netbox installation.  If your Netbox server URL
doesnotinclude a port, then youmustdisable port redirect.  For example seenginx.conf.You MUST add the ULR rewrite for the/login/URL to use/plugins/sso/login/, for examplenginx.conf.Adding a SSO Login ButtonInstead of using a reverse proxy redirect, you can add a SSO login button above
the NetBox login form. This has the added benefit of allowing both local
and SAML login options.Add the following to your configuration.py:BANNER_LOGIN='<a href="/api/plugins/sso/login" class="btn btn-primary btn-block">Login with SSO</a>'