Azure AD Python Social Auth

[Foozer]

Hello.

I'm loving netbox-docker, lots of great information out there. However, setting up NetBox to run with Azure AD using Python Social Auth seems to be a bit of a mystery.
I'm running the latest version but all the docs I have found seem to be confusing.
I have the following guide for Python Social Auth:
https://python-social-auth.readthedocs.io/en/latest/backends/azuread.html
But I really don't know where to put the details in when I have them in netbox-docker. configuration.py says it doesn't recommend editing it. So do I put details into the NetBox front end on the admin panel?

If someone has got this working it would be really useful to have a guide on how to do this while using netbox-docker.

Please help.

[Foozer]

I have actually made some progress on this but have another problem.
To get to where AzureAD is actually setup I followed the following guide:
https://docs.netbox.dev/en/develop/administration/authentication/microsoft-azure-ad/
However, I had to change the the Netbox Configuration part 1 because we are running it in docker, you shouldn't touch the configuration.py file. Instead you have to add the configuration into the docker-compose.overide.yml file. You will need to replace the = with a : to make it work though, as the yaml file will not accept the python format from the document.

Once this was complete I restarted docker to make the configuration changes live. And success, well sort of. The option to login with Azure AD is now listed and I click it and get to the next hurdle:

Here the Client ID is listed as None and the URL paints the same picture:

https://login.microsoftonline.com/common/oauth2/authorize?client_id=None&redirect****************************etc

Now I can copy and paste the client ID obtained from Azure and replace None and it actually works. So the question is why isn't Netbox sending the client ID in its request?

[Foozer]

OK, I think I have this working now. You can't use the docker-compose.override.yml file for this you need to go into the configurations directory and add it to the extras.py file as per the guide and this does send out the client_ID in the URL.

Having a different issue with certificates at the moment so can't do a full test to confirm all is working. Will feedback when I have completed the testing

[Dark-DK]

Hi

I've also been having some difficulties getting it to work, but I've gotten it work just fine now.

You do not have to edit any of the existing files within the configuration/ directory.
*.py will get parsed and sent to the container on startup - you can therefore just create your own "my-extra-settings.py" file and put the relevant info in that file:

LOGIN_REQUIRED=True
REMOTE_AUTH_ENABLED=True
REMOTE_AUTH_AUTO_CREATE_USER=True
REMOTE_AUTH_BACKEND='social_core.backends.azuread.AzureADOAuth2'
SOCIAL_AUTH_AZUREAD_OAUTH2_KEY='yzx'
SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET='xyz'
SOCIAL_AUTH_REDIRECT_IS_HTTPS=True

That should do the trick.

[Foozer]

That's great that you found out how to sort it out. I've actually moved way from running it in docker due to how difficult it was to admin in comparison to running natively. I also found the performance better when not containerized running on exactly the same VM.

I do hope the answer helps others that do stick with the docker version though.