Repository: netbox-community/netbox

Issue:
Support for multiple remote auth backends
### NetBox version

v3.4.6

### Feature type

New functionality

### Proposed functionality

Currently, [REMOTE_AUTH_BACKEND](https://docs.netbox.dev/en/stable/configuration/remote-authentication/#remote_auth_backend) only supports a single auth backend. Modify REMOTE_AUTH_BACKEND to accept an iterable, which may reference one or more Django authentication backends. Backends would then be attempted in sequence when authenticating a user.

### Use case

Valid NetBox users may not all exist in the same authentication directory or service, e.g. multiple AD forests. **Note**: For multiple AD domains within a single forest, point `AUTH_LDAP_SERVER_URI` to the AD Global Catalog port 3269 as described in the [docs](https://docs.netbox.dev/en/stable/installation/6-ldap/#general-server-configuration).

As Django [supports multiple auth backends](https://django-auth-ldap.readthedocs.io/en/latest/multiconfig.html), extending this functionality to NetBox seems feasible.

This has come up several times in discussion:

- [Multiple Authentication methods at the same time, meaning Ldap OR SSO possible?](https://github.com/netbox-community/netbox/discussions/10733)
- [Multiple LDAP sources Docker](https://github.com/netbox-community/netbox/discussions/5457)
- [Multiple remote auth backends](https://github.com/netbox-community/netbox/discussions/9479)
- [Multiple LDAP error](https://github.com/netbox-community/netbox/discussions/9360)

### Database changes

None

### External dependencies

None
Support for multiple remote auth backends
### NetBox version

v3.4.6

### Feature type

New functionality

### Proposed functionality

Currently, [REMOTE_AUTH_BACKEND](https://docs.netbox.dev/en/stable/configuration/remote-authentication/#remote_auth_backend) only supports a single auth backend. Modify REMOTE_AUTH_BACKEND to accept an iterable, which may reference one or more Django authentication backends. Backends would then be attempted in sequence when authenticating a user.

### Use case

Valid NetBox users may not all exist in the same authentication directory or service, e.g. multiple AD forests. **Note**: For multiple AD domains within a single forest, point `AUTH_LDAP_SERVER_URI` to the AD Global Catalog port 3269 as described in the [docs](https://docs.netbox.dev/en/stable/installation/6-ldap/#general-server-configuration).

As Django [supports multiple auth backends](https://django-auth-ldap.readthedocs.io/en/latest/multiconfig.html), extending this functionality to NetBox seems feasible.

This has come up several times in discussion:

- [Multiple Authentication methods at the same time, meaning Ldap OR SSO possible?](https://github.com/netbox-community/netbox/discussions/10733)
- [Multiple LDAP sources Docker](https://github.com/netbox-community/netbox/discussions/5457)
- [Multiple remote auth backends](https://github.com/netbox-community/netbox/discussions/9479)
- [Multiple LDAP error](https://github.com/netbox-community/netbox/discussions/9360)

### Database changes

None

### External dependencies

None


Discussion:
The use case that motivated this FR (authenticating users from multiple domains in a single forest) was resolved by pointing `AUTH_LDAP_SERVER_URI` to the Global Catalog port 3269 as described in the [docs](https://docs.netbox.dev/en/stable/installation/6-ldap/#general-server-configuration). However, this FR would still be useful in the case of separate AD forests, or any other case requiring multiple authentication backends.
Can I take a swing at this one?
The use case that motivated this FR (authenticating users from multiple domains in a single forest) was resolved by pointing `AUTH_LDAP_SERVER_URI` to the Global Catalog port 3269 as described in the [docs](https://docs.netbox.dev/en/stable/installation/6-ldap/#general-server-configuration). However, this FR would still be useful in the case of separate AD forests, or any other case requiring multiple authentication backends.
Can I take a swing at this one?

Resolving patch:
diff --git a/netbox/netbox/settings.py b/netbox/netbox/settings.py
--- a/netbox/netbox/settings.py
+++ b/netbox/netbox/settings.py
@@ -396,8 +396,10 @@ def _setting(name, default=None):
 ]
 
 # Set up authentication backends
+if type(REMOTE_AUTH_BACKEND) not in (list, tuple):
+    REMOTE_AUTH_BACKEND = [REMOTE_AUTH_BACKEND]
 AUTHENTICATION_BACKENDS = [
-    REMOTE_AUTH_BACKEND,
+    *REMOTE_AUTH_BACKEND,
     'netbox.authentication.ObjectPermissionBackend',
 ]
 


Test patch: