mirror of
https://github.com/netbox-community/netbox.git
synced 2026-01-11 21:10:29 +01:00
problem with groups after read from LDAP #1999
Closed
opened 2025-12-29 17:21:20 +01:00 by adam
·
9 comments
No Branch/Tag Specified
main
update-changelog-comments-docs
feature-removal-issue-type
20911-dropdown
20239-plugin-menu-classes-mutable-state
21097-graphql-id-lookups
feature
fix_module_substitution
20923-dcim-templates
20044-elevation-stuck-lightmode
feature-ip-prefix-link
v4.5-beta1-release
20068-import-moduletype-attrs
20766-fix-german-translation-code-literals
20378-del-script
7604-filter-modifiers-v3
circuit-swap
12318-case-insensitive-uniqueness
20637-improve-device-q-filter
20660-script-load
19724-graphql
20614-update-ruff
14884-script
02496-max-page
19720-macaddress-interface-generic-relation
19408-circuit-terminations-export-templates
20203-openapi-check
fix-19669-api-image-download
7604-filter-modifiers
19275-fixes-interface-bulk-edit
fix-17794-get_field_value_return_list
11507-show-aggregate-and-rir-on-api
9583-add_column_specific_search_field_to_tables
v4.5.0
v4.4.10
v4.4.9
v4.5.0-beta1
v4.4.8
v4.4.7
v4.4.6
v4.4.5
v4.4.4
v4.4.3
v4.4.2
v4.4.1
v4.4.0
v4.3.7
v4.4.0-beta1
v4.3.6
v4.3.5
v4.3.4
v4.3.3
v4.3.2
v4.3.1
v4.3.0
v4.2.9
v4.3.0-beta2
v4.2.8
v4.3.0-beta1
v4.2.7
v4.2.6
v4.2.5
v4.2.4
v4.2.3
v4.2.2
v4.2.1
v4.2.0
v4.1.11
v4.1.10
v4.1.9
v4.1.8
v4.2-beta1
v4.1.7
v4.1.6
v4.1.5
v4.1.4
v4.1.3
v4.1.2
v4.1.1
v4.1.0
v4.0.11
v4.0.10
v4.0.9
v4.1-beta1
v4.0.8
v4.0.7
v4.0.6
v4.0.5
v4.0.3
v4.0.2
v4.0.1
v4.0.0
v3.7.8
v3.7.7
v4.0-beta2
v3.7.6
v3.7.5
v4.0-beta1
v3.7.4
v3.7.3
v3.7.2
v3.7.1
v3.7.0
v3.6.9
v3.6.8
v3.6.7
v3.7-beta1
v3.6.6
v3.6.5
v3.6.4
v3.6.3
v3.6.2
v3.6.1
v3.6.0
v3.5.9
v3.6-beta2
v3.5.8
v3.6-beta1
v3.5.7
v3.5.6
v3.5.5
v3.5.4
v3.5.3
v3.5.2
v3.5.1
v3.5.0
v3.4.10
v3.4.9
v3.5-beta2
v3.4.8
v3.5-beta1
v3.4.7
v3.4.6
v3.4.5
v3.4.4
v3.4.3
v3.4.2
v3.4.1
v3.4.0
v3.3.10
v3.3.9
v3.4-beta1
v3.3.8
v3.3.7
v3.3.6
v3.3.5
v3.3.4
v3.3.3
v3.3.2
v3.3.1
v3.3.0
v3.2.9
v3.2.8
v3.3-beta2
v3.2.7
v3.3-beta1
v3.2.6
v3.2.5
v3.2.4
v3.2.3
v3.2.2
v3.2.1
v3.2.0
v3.1.11
v3.1.10
v3.2-beta2
v3.1.9
v3.2-beta1
v3.1.8
v3.1.7
v3.1.6
v3.1.5
v3.1.4
v3.1.3
v3.1.2
v3.1.1
v3.1.0
v3.0.12
v3.0.11
v3.0.10
v3.1-beta1
v3.0.9
v3.0.8
v3.0.7
v3.0.6
v3.0.5
v3.0.4
v3.0.3
v3.0.2
v3.0.1
v3.0.0
v2.11.12
v3.0-beta2
v2.11.11
v2.11.10
v3.0-beta1
v2.11.9
v2.11.8
v2.11.7
v2.11.6
v2.11.5
v2.11.4
v2.11.3
v2.11.2
v2.11.1
v2.11.0
v2.10.10
v2.10.9
v2.11-beta1
v2.10.8
v2.10.7
v2.10.6
v2.10.5
v2.10.4
v2.10.3
v2.10.2
v2.10.1
v2.10.0
v2.9.11
v2.10-beta2
v2.9.10
v2.10-beta1
v2.9.9
v2.9.8
v2.9.7
v2.9.6
v2.9.5
v2.9.4
v2.9.3
v2.9.2
v2.9.1
v2.9.0
v2.9-beta2
v2.8.9
v2.9-beta1
v2.8.8
v2.8.7
v2.8.6
v2.8.5
v2.8.4
v2.8.3
v2.8.2
v2.8.1
v2.8.0
v2.7.12
v2.7.11
v2.7.10
v2.7.9
v2.7.8
v2.7.7
v2.7.6
v2.7.5
v2.7.4
v2.7.3
v2.7.2
v2.7.1
v2.7.0
v2.6.12
v2.6.11
v2.6.10
v2.6.9
v2.7-beta1
Solcon-2020-01-06
v2.6.8
v2.6.7
v2.6.6
v2.6.5
v2.6.4
v2.6.3
v2.6.2
v2.6.1
v2.6.0
v2.5.13
v2.5.12
v2.6-beta1
v2.5.11
v2.5.10
v2.5.9
v2.5.8
v2.5.7
v2.5.6
v2.5.5
v2.5.4
v2.5.3
v2.5.2
v2.5.1
v2.5.0
v2.4.9
v2.5-beta2
v2.4.8
v2.5-beta1
v2.4.7
v2.4.6
v2.4.5
v2.4.4
v2.4.3
v2.4.2
v2.4.1
v2.4.0
v2.3.7
v2.4-beta1
v2.3.6
v2.3.5
v2.3.4
v2.3.3
v2.3.2
v2.3.1
v2.3.0
v2.2.10
v2.3-beta2
v2.2.9
v2.3-beta1
v2.2.8
v2.2.7
v2.2.6
v2.2.5
v2.2.4
v2.2.3
v2.2.2
v2.2.1
v2.2.0
v2.1.6
v2.2-beta2
v2.1.5
v2.2-beta1
v2.1.4
v2.1.3
v2.1.2
v2.1.1
v2.1.0
v2.0.10
v2.1-beta1
v2.0.9
v2.0.8
v2.0.7
v2.0.6
v2.0.5
v2.0.4
v2.0.3
v2.0.2
v2.0.1
v2.0.0
v2.0-beta3
v1.9.6
v1.9.5
v2.0-beta2
v1.9.4-r1
v1.9.3
v2.0-beta1
v1.9.2
v1.9.1
v1.9.0-r1
v1.8.4
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.7.3
v1.7.2-r1
v1.7.1
v1.7.0
v1.6.3
v1.6.2-r1
v1.6.1-r1
1.6.1
v1.6.0
v1.5.2
v1.5.1
v1.5.0
v1.4.2
v1.4.1
v1.4.0
v1.3.2
v1.3.1
v1.3.0
v1.2.2
v1.2.1
v1.2.0
v1.1.0
v1.0.7-r1
v1.0.7
v1.0.6
v1.0.5
v1.0.4
v1.0.3-r1
v1.0.3
1.0.0
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/netbox#1999
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @FrantisekLee on GitHub (Sep 12, 2018).
Environment
Steps to Reproduce
When i connected to my netbox to LDAP.
In LDAP i have more groups for netbox.
When I change to TRUE "AUTH_LDAP_MIRROR_GROUPS" in config "ldap_config.py"
AUTH_LDAP_CACHE_GROUPS = False
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 1
AUTH_LDAP_MIRROR_GROUPS = True
after loging to website i have error and web not work..
start LOG
DEBUG 2018-09-12 12:12:43,745 utils 25700 140622045402880 (0.004)
SELECT c.relname, c.relkind
FROM pg_catalog.pg_class c
LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
WHERE c.relkind IN ('r', 'v')
AND n.nspname NOT IN ('pg_catalog', 'pg_toast')
AND pg_catalog.pg_table_is_visible(c.oid); args=None
DEBUG 2018-09-12 12:12:43,748 utils 25700 140622045402880 (0.001) SELECT "django_migrations"."app", "django_migrations"."name" FROM "django_migrations"; args=()
DEBUG 2018-09-12 12:12:59,285 utils 25733 140625345287936 (0.004)
SELECT c.relname, c.relkind
FROM pg_catalog.pg_class c
LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
WHERE c.relkind IN ('r', 'v')
AND n.nspname NOT IN ('pg_catalog', 'pg_toast')
AND pg_catalog.pg_table_is_visible(c.oid); args=None
DEBUG 2018-09-12 12:12:59,287 utils 25733 140625345287936 (0.001) SELECT "django_migrations"."app", "django_migrations"."name" FROM "django_migrations"; args=()
DEBUG 2018-09-12 12:13:04,868 utils 25733 140625315469056 (0.002) SELECT "django_session"."session_key", "django_session"."session_data", "django_session"."expire_date" FROM "django_session" WHERE ("django_session"."expire_date" > '2018-09-12T12:13:04.860358+00:00'::timestamptz AND "django_session"."session_key" = '96ls8bcc97vlw63eulja4fp4h3ynlykr'); args=(datetime.datetime(2018, 9, 12, 12, 13, 4, 860358, tzinfo=), '96ls8bcc97vlw63eulja4fp4h3ynlykr')
DEBUG 2018-09-12 12:13:04,872 utils 25733 140625315469056 (0.001) SELECT "auth_user"."id", "auth_user"."password", "auth_user"."last_login", "auth_user"."is_superuser", "auth_user"."username", "auth_user"."first_name", "auth_user"."last_name", "auth_user"."email", "auth_user"."is_staff", "auth_user"."is_active", "auth_user"."date_joined" FROM "auth_user" WHERE "auth_user"."id" = 2; args=(2,)
DEBUG 2018-09-12 12:13:04,917 utils 25733 140625315469056 (0.001) SELECT "django_session"."session_key", "django_session"."session_data", "django_session"."expire_date" FROM "django_session" WHERE "django_session"."session_key" = '96ls8bcc97vlw63eulja4fp4h3ynlykr'; args=('96ls8bcc97vlw63eulja4fp4h3ynlykr',)
DEBUG 2018-09-12 12:13:04,918 utils 25733 140625315469056 (0.001) DELETE FROM "django_session" WHERE "django_session"."session_key" IN ('96ls8bcc97vlw63eulja4fp4h3ynlykr'); args=('96ls8bcc97vlw63eulja4fp4h3ynlykr',)
INFO 2018-09-12 12:13:04,920 basehttp 25733 140625315469056 "GET /logout/ HTTP/1.1" 302 0
INFO 2018-09-12 12:13:04,956 basehttp 25733 140625315469056 "GET / HTTP/1.1" 302 0
INFO 2018-09-12 12:13:05,012 basehttp 25733 140625315469056 "GET /login/?next=/ HTTP/1.1" 200 5645
DEBUG 2018-09-12 12:13:11,776 utils 25733 140625315469056 (0.002) SELECT "auth_user"."id", "auth_user"."password", "auth_user"."last_login", "auth_user"."is_superuser", "auth_user"."username", "auth_user"."first_name", "auth_user"."last_name", "auth_user"."email", "auth_user"."is_staff", "auth_user"."is_active", "auth_user"."date_joined" FROM "auth_user" WHERE UPPER("auth_user"."username"::text) = UPPER('f.drabecky'); args=('MY_LOGIN',)
DEBUG 2018-09-12 12:13:11,782 utils 25733 140625315469056 (0.001) DECLARE "_django_curs_140625315469056_1" NO SCROLL CURSOR WITH HOLD FOR SELECT "auth_group"."name" FROM "auth_group" INNER JOIN "auth_user_groups" ON ("auth_group"."id" = "auth_user_groups"."group_id") WHERE "auth_user_groups"."user_id" = 2; args=(2,)
DEBUG 2018-09-12 12:13:11,784 utils 25733 140625315469056 (0.001) DECLARE "_django_curs_140625315469056_2" NO SCROLL CURSOR WITH HOLD FOR SELECT "auth_group"."id", "auth_group"."name" FROM "auth_group" WHERE "auth_group"."name" IN ('netbox-administrators', 'netbox-users'); args=('netbox-administrators', 'netbox-users')
ERROR 2018-09-12 12:13:11,786 exception 25733 140625315469056 Internal Server Error: /login/
Traceback (most recent call last):
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/core/handlers/exception.py", line 35, in inner
response = get_response(request)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/core/handlers/base.py", line 128, in _get_response
response = self.process_exception_by_middleware(e, request)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/core/handlers/base.py", line 126, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/views/generic/base.py", line 69, in view
return self.dispatch(request, *args, **kwargs)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/views/generic/base.py", line 89, in dispatch
return handler(request, *args, **kwargs)
File "/opt/netbox-2.4.4/users/views.py", line 37, in post
if form.is_valid():
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/forms/forms.py", line 179, in is_valid
return self.is_bound and not self.errors
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/forms/forms.py", line 174, in errors
self.full_clean()
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/forms/forms.py", line 377, in full_clean
self._clean_form()
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/forms/forms.py", line 404, in _clean_form
cleaned_data = self.clean()
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/contrib/auth/forms.py", line 195, in clean
self.user_cache = authenticate(self.request, username=username, password=password)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/contrib/auth/init.py", line 70, in authenticate
user = _authenticate_with_backend(backend, backend_path, request, credentials)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/contrib/auth/init.py", line 116, in _authenticate_with_backend
return backend.authenticate(*args, **credentials)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django_auth_ldap/backend.py", line 172, in authenticate
user = ldap_user.authenticate(password)
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django_auth_ldap/backend.py", line 347, in authenticate
self._get_or_create_user()
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django_auth_ldap/backend.py", line 576, in _get_or_create_user
self._mirror_groups()
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django_auth_ldap/backend.py", line 783, in _mirror_groups
self._user.groups = existing_groups + new_groups
File "/opt/virtualenvs/netbox/lib64/python3.4/site-packages/django/db/models/fields/related_descriptors.py", line 509, in set
% self._get_set_deprecation_msg_params(),
TypeError: Direct assignment to the forward side of a many-to-many set is prohibited. Use groups.set() instead.
ERROR 2018-09-12 12:13:11,869 basehttp 25733 140625315469056 "POST /login/ HTTP/1.1" 500 135776
end LOG
When this parameter is default:
AUTH_LDAP_MIRROR_GROUPS = False, it works but not good.
In Profile in Netbox i don't see my groups.
my config "/opt/netbox/netbox/ldap_config.py":
import ldap
#from django_auth_ldap.config import LDAPSearch
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType, ActiveDirectoryGroupType, NestedActiveDirectoryGroupType, NestedGroupOfNamesType
AUTH_LDAP_SERVER_URI = 'ldaps://server01.mydomain.net'
AUTH_LDAP_CONNECTION_OPTIONS = {
ldap.OPT_REFERRALS: 0
}
AUTH_LDAP_BIND_DN = 'cn=user,dc=mydomain,dc=net'
AUTH_LDAP_BIND_PASSWORD = 'password'
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
LDAP_IGNORE_CERT_ERRORS = True
AUTH_LDAP_USER_SEARCH = LDAPSearch('ou=users,dc=mydomain,dc=net', ldap.SCOPE_SUBTREE, '(uid=%(user)s)')
AUTHENTICATION_BACKENDS = ['django_auth_ldap.backend.LDAPBackend']
AUTH_LDAP_USER_ATTR_MAP = {
'first_name': 'givenName',
'last_name': 'sn',
'email': 'mail'
}
AUTH_LDAP_PROFILE_ATTR_MAP = {"home_directory": "homeDirectory"}
AUTH_LDAP_GROUP_SEARCH = LDAPSearch('ou=netbox,ou=groups,dc=mydomain,dc=net', ldap.SCOPE_SUBTREE, '(objectClass=groupOfNames)')
AUTH_LDAP_GROUP_TYPE = NestedGroupOfNamesType()
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
'is_active': 'cn=netbox-administrators,ou=netbox,ou=groups,dc=mydomain,dc=net',
'is_staff': 'cn=netbox-administrators,ou=netbox,ou=groups,dc=mydomain,dc=net',
'is_superuser': 'cn=netbox-administrators,ou=netbox,ou=groups,dc=mydomain,dc=net'
}
AUTH_LDAP_ALWAYS_UPDATE_USER = True
AUTH_LDAP_FIND_GROUP_PERMS = True
AUTH_LDAP_CACHE_GROUPS = False
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 1
AUTH_LDAP_MIRROR_GROUPS = False
Expected Behavior
Observed Behavior
I found that out, web calls this command to DB.
"SELECT "auth_group"."id", "auth_group"."name" FROM "auth_group" INNER JOIN "auth_user_groups" ON ("auth_group"."id" = "auth_user_groups"."group_id") WHERE "auth_user_groups"."user_id" = 2; args=(2,)"
and this select is empty.
Netbox is right to add groups from LDAP to auth_group table, but not insert data to the auth_user_groups table.
When i did this command manualy to DB
"insert into auth_user_groups (id,user_id,group_id) values (1,2,3)"
everything works... After then i saw in web in Profile my LDAPs group..
@jeremystretch commented on GitHub (Sep 13, 2018):
Thank you for your interest in NetBox. We require that all issues be submitted using one of the templates provided here. This is to ensure that only valid issues are reported and that each issue includes all the information necessary for a developer to act on it. Please update your issue so that it matches the appropriate template (this may require rewriting your issue entirely). This issue will be closed in one week if it has not been updated. Thanks!
@FrantisekLee commented on GitHub (Sep 14, 2018):
I updated it.
@aruhier commented on GitHub (Sep 25, 2018):
Hi,
Try to update
django-auth-ldap. The django ORM might have dropped the possibility to update a list without usingset(), and thedjango-auth-ldapversion in the requirements is quite old.@jeremystretch: could you update the requirements of netbox please? I haven't seen yet any issue with
django-auth-ldap1.7.0 and netbox 2.4.@FrantisekLee commented on GitHub (Sep 26, 2018):
Hi,
thank for tip, my requirements are:
Django>=1.11,<2.1
django-cors-headers==2.4.0
django-debug-toolbar==1.9.1
django-filter==1.1.0
django-mptt==0.9.1
django-tables2==1.21.2
django-taggit==0.22.2
django-taggit-serializer==0.1.7
django-timezone-field==2.1
djangorestframework==3.8.1
drf-yasg[validation]==1.9.2
graphviz==0.8.4
Markdown==2.6.11
natsort==5.3.3
ncclient==0.6.0
netaddr==0.7.19
paramiko==2.4.1
Pillow==5.2.0
psycopg2-binary==2.7.5
py-gfm==0.1.3
pycryptodome==3.6.4
xmltodict==0.11.0
django-auth-ldap<=1.2.13,>=1.2.5
I try update and i give you report.
@jeremystretch commented on GitHub (Sep 26, 2018):
@Anthony25
django-auth-ldapisn't included inrequirements.txtas LDAP authentication is an optional feature.@aruhier commented on GitHub (Sep 26, 2018):
@jeremystretch: oh you're right, sorry I didn't check.
@FrantisekLee commented on GitHub (Oct 3, 2018):
Thanks for tips, but still not work :(
asn1crypto==0.24.0
bcrypt==3.1.4
certifi==2018.8.24
cffi==1.11.5
chardet==3.0.4
click==6.7
coreapi==2.3.3
coreschema==0.0.4
cryptography==2.3.1
Django==2.0.8
django-auth-ldap==1.7.0
django-cors-headers==2.4.0
django-debug-toolbar==1.9.1
django-filter==1.1.0
django-js-asset==1.1.0
django-mptt==0.9.1
django-python3-ldap==0.11.2
django-tables2==1.21.2
django-taggit==0.22.2
django-taggit-serializer==0.1.7
django-timezone-field==2.1
djangorestframework==3.8.1
drf-yasg==1.9.2
flex==6.13.2
future==0.16.0
graphviz==0.8.4
idna==2.7
inflection==0.3.1
itypes==1.1.0
Jinja2==2.10
jsonpointer==1.14
jsonschema==2.6.0
lxml==4.2.4
Markdown==2.6.11
MarkupSafe==1.0
natsort==5.3.3
ncclient==0.6.0
netaddr==0.7.19
openapi-codec==1.3.2
paramiko==2.4.1
Pillow==5.2.0
psycopg2-binary==2.7.5
py-gfm==0.1.3
pyasn1==0.4.4
pyasn1-modules==0.2.2
pycparser==2.18
pycryptodome==3.6.4
pyldap==3.0.0.post1
PyNaCl==1.2.1
python-ldap==3.1.0
pytz==2018.5
PyYAML==3.13
requests==2.19.1
rfc3987==1.3.8
ruamel.yaml==0.15.64
six==1.11.0
sqlparse==0.2.4
strict-rfc3339==0.7
swagger-spec-validator==2.4.0
uritemplate==3.0.0
urllib3==1.23
validate-email==1.3
xmltodict==0.11.0
I updated djago-auth-ldap to v.1.7.0 and python-ldap to 3.1.0.
Still the some problem. Accept login from LDAP but, i don't see my groups..
@ktims commented on GitHub (Oct 17, 2018):
I can confirm that I experienced the same issue, and upgrading to django-auth-ldap 1.7.0 solved it for me, and the new users' groups were imported properly from AD. I am on Python 3.4.3.
@jeremystretch commented on GitHub (Nov 13, 2018):
Closing this out as the fix appears to be upgrading to
django-auth-ldap1.7.0 as @ktims points out.