Redirect Loop on successful authentication #9
Comments
|
@LordBonzi can you share your nginx config for NetBox? |
server {
listen ip:80;
# CHANGE THIS TO YOUR SERVER'S NAME
server_name netboxd.testing;
client_max_body_size 25m;
location /static/ {
alias /opt/netbox/netbox/static/;
}
location / {
proxy_pass http://127.0.0.1:8001;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
}
location /login/ {
proxy_pass http://127.0.0.1:8001/api/plugins/sso/login/;
}
location /sso/ {
proxy_pass http://127.0.0.1:8001/api/plugins/sso/; # Must have a trailing slash to strip the original path
}
}
(venv) root@MemeMachine:/opt/netbox/netbox# |
|
And what URL did you configure as Destination/Redirection URL on keycloak side for the app? |
|
|
|
Those are correct as well, not sure what else could be causing this. May be try not using |
|
Even with the |
|
Hi @LordBonzi - apologize for the delay responding @LordBonzi - I could not tell from your screenshots if you had configured your KeyCloak system to provide the specific SAML attributes the code is looking for in that backend. Specifically:
The KeyCloak system needs to provide the Another approach is to change your plugin config to use the other backend: In which case only the email-address attribute is used. Hope this helps! |
|
Hi @jeremyschulman, Here is a list of all attributes sent to the SP.
SAML2DottedEmailUserBackend does not work for our use case as we do not use first_name.last_name as our email schema. However, our usernames do match the beginning of our email. e.g. Here is a full dump of the SAML attributes returned to NetBox: ...
<saml:AttributeStatement>
<saml:Attribute FriendlyName="nb-sso email" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">bonzi@netboxd.testing</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="email" Name="urn:oid:1.2.840.113549.1.9.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">bonzi@netboxd.testing</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="nb-sso last-name" Name="last_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Foster</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="nb-saml2 first_name" Name="first_name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Alfie</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="surname" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Foster</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Alfie</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
...My SSO server returns Email, First name and Lastname, both in standard SAML terms (using This can create accounts, as witnessed when disabling SSO and entering the admin panel manually. See below image. the I hope this helps. |
|
I am starting to think that it might be related to the fact that configuration.py probably has two different backends. You are defining plugin one directly in How about you define:
and then in PLUGIN_CONFIG below just call that variable:
I suspect even though plugin is creating user profile as per plugin_config but NetBox app itself is looking to verify user against: |
|
OK, apparently that worked like a charm! Now my only gripe is the lack of an email user as username backend as then I'd be able to log in to my existing accounts I'd most certainly used that exact conf before, so something else must be at play but I won't try to fix what's not technically broken. Thanks for your help, I shall open another issue/pr to add an email user as username backend. |
|
Perfect! And email as username? Isnt that already there, the first backend available in this plugin backend called: Also, FYI the one that you are currently using has a small caveat which i explained here: |
|
For example, an email of |
|
closing issue as I believe it is resolved. we can re-open if not. |
When logging in to NetBox with this SAML2 plugin, it causes an infinite loop of authentication requests to my IDP (Keycloak), See the attached image and console output for an example of the redirection loop
Keycloak reports that my client has successfully authenticated and has sent the correct assertion to NetBox.
My config looks like this:
The text was updated successfully, but these errors were encountered: