Problem With LDAP Authentication

[carlosercf]

Hi,

I was able to get the LDAP Authentication to work between our netbox (running 4.1.3) and our Active Directory.
Everything works fine but whenever I login django-ldap creates all of the groups I'm part of in its "Groups" tabs (domain users, domain admin and so on). I did set the appropriate OU as a BASEDN so I don't know why django-ldap is creating all of the groups I'm part of in the Groups tab, from what I understand it should only be creating the groups bellow de BASEDN, right?
Our AD structure is as follows:

DC=company,DC=local
---OU=All Accounts
------OU=Employees
---------userA (is a member of NETBOX_SUPERUSER)
---------userB (is a member of NETBOX_STAFF)
---OU=Groups
------OU=access
---------OU=netbox access
------------CN=netbox_allow
------------CN=netbox_staff
------------CN=netbox_superuser

I'm logging in as "userA" with netbox_superuser mapped out. Below is how my ldap_config.py looks like:

import ldap
from django_auth_ldap.config import LDAPSearch, NestedGroupOfNamesType

# Server URI
AUTH_LDAP_SERVER_URI = "ldap://company.local"

# The following may be needed if you are binding to Active Directory.
AUTH_LDAP_CONNECTION_OPTIONS = {
    ldap.OPT_REFERRALS: 0
}

# Set the DN and password for the NetBox service account.
#AUTH_LDAP_BIND_DN = "CN=NETBOXSA,OU=Service Accounts,DC=example,DC=com"
AUTH_LDAP_BIND_DN = "CN=Service Ldap Netbox,OU=Service Accounts,OU=All Accounts,DC=company,DC=local"
AUTH_LDAP_BIND_PASSWORD = "xyz"

# Include this setting if you want to ignore certificate errors. This might be needed to accept a self-signed cert.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
LDAP_IGNORE_CERT_ERRORS = False

# Include this setting if you want to validate the LDAP server certificates against a CA certificate directory on your server
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, LDAP_CA_CERT_DIR)
#LDAP_CA_CERT_DIR = '/etc/ssl/certs'

# Include this setting if you want to validate the LDAP server certificates against your own CA.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, LDAP_CA_CERT_FILE)
#LDAP_CA_CERT_FILE = '/path/to/example-CA.crt'

# This search matches users with the sAMAccountName equal to the provided username. This is required if the user's
# username is not in their DN (Active Directory).
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "OU=Employees,OU=All Accounts,DC=company,DC=local",
    ldap.SCOPE_SUBTREE,
    "(|(userPrincipalName=%(user)s)(sAMAccountName=%(user)s))"
)

# If a user's DN is producible from their username, we don't need to search.
AUTH_LDAP_USER_DN_TEMPLATE = None

# You can map user attributes to Django attributes as so.
AUTH_LDAP_USER_ATTR_MAP = {
    "username": "sAMAccountName",
    "email": "mail",
    "first_name": "givenName",
    "last_name": "sn",
}

AUTH_LDAP_USER_QUERY_FIELD = "username"

# This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
# hierarchy.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    "OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local",
    ldap.SCOPE_SUBTREE,
    "(objectClass=group)"
)
AUTH_LDAP_GROUP_TYPE = NestedGroupOfNamesType()

# Define a group required to login.
#AUTH_LDAP_REQUIRE_GROUP = "CN=NETBOX_USERS,DC=example,DC=com"
AUTH_LDAP_REQUIRE_GROUP = "CN=netbox_allow,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local"

# Mirror LDAP group assignments.
AUTH_LDAP_MIRROR_GROUPS = True

# Define special user types using groups. Exercise great caution when assigning superuser status.
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "CN=netbox_allow,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local",
    "is_staff": "CN=NETBOX_STAFF,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local",
    "is_superuser": "CN=NETBOX_SUPERUSER,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local"
}

# For more granular permissions, we can map LDAP groups to Django groups.
AUTH_LDAP_FIND_GROUP_PERMS = True

# Cache groups for one hour to reduce LDAP traffic
AUTH_LDAP_CACHE_TIMEOUT = 3600
AUTH_LDAP_ALWAYS_UPDATE_USER = True```

[zmaster7]

According to the django-auth-ldap documentation, it looks as though it mirrors all groups associated with the user. You can specify a list of groups there you would like it to mirror instead of a boolean.

AUTH_LDAP_GROUP_SEARCH is used in the case of determining groups for the purpose of authentication, not for the mirroring of groups.

[carlosercf]

Thanks for the reply zmaster7.
So the line with "AUTH_LDAP_MIRROR_GROUPS" would have the groups django-auth-ldap would extract from the user and create on the netbox groups page?
Is this syntax correct:

AUTH_LDAP_MIRROR_GROUPS = LDAPSearch(
    "netbox_allow,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=locall") | LDAPSearch(
    "CN=NETBOX_STAFF,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local") | LDAPSearch(
    "CN=NETBOX_SUPERUSER,OU=Netbox Access,OU=Access,OU=Groups,DC=company,DC=local") 

[zmaster7]

The documentation doesn't seem entirely clear on that. It may simply be a list of the groups names, rather than an LDAPSearch.

e.g.
AUTH_LDAP_MIRROR_GROUPS = [ "netbox_allow", "netbox_staff" ]

[zmaster7]

I've confirmed in my test environment that it is looking for an array of group names only.

[carlosercf]

I've configured a list as you said and everything seems to be working. I deleted some users and asked to login again and did not see all their groups, only the ones that are on the list so far.
Thanks for your help!