starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Support for multiple remote auth backends #7757

New Issue
Closed
opened 2025-12-29 20:27:52 +01:00 by adam · 6 comments
adam commented 2025-12-29 20:27:52 +01:00
Owner
Copy Link

Originally created by @decoupca on GitHub (Mar 14, 2023).

Originally assigned to: @decoupca on GitHub.

NetBox version

v3.4.6

Feature type

New functionality

Proposed functionality

Currently, REMOTE_AUTH_BACKEND only supports a single auth backend. Modify REMOTE_AUTH_BACKEND to accept an iterable, which may reference one or more Django authentication backends. Backends would then be attempted in sequence when authenticating a user.

Use case

Valid NetBox users may not all exist in the same authentication directory or service, e.g. multiple AD forests. Note: For multiple AD domains within a single forest, point AUTH_LDAP_SERVER_URI to the AD Global Catalog port 3269 as described in the docs.

As Django supports multiple auth backends, extending this functionality to NetBox seems feasible.

This has come up several times in discussion:

Database changes

None

External dependencies

None

Originally created by @decoupca on GitHub (Mar 14, 2023). Originally assigned to: @decoupca on GitHub. ### NetBox version v3.4.6 ### Feature type New functionality ### Proposed functionality Currently, [REMOTE_AUTH_BACKEND](https://docs.netbox.dev/en/stable/configuration/remote-authentication/#remote_auth_backend) only supports a single auth backend. Modify REMOTE_AUTH_BACKEND to accept an iterable, which may reference one or more Django authentication backends. Backends would then be attempted in sequence when authenticating a user. ### Use case Valid NetBox users may not all exist in the same authentication directory or service, e.g. multiple AD forests. **Note**: For multiple AD domains within a single forest, point `AUTH_LDAP_SERVER_URI` to the AD Global Catalog port 3269 as described in the [docs](https://docs.netbox.dev/en/stable/installation/6-ldap/#general-server-configuration). As Django [supports multiple auth backends](https://django-auth-ldap.readthedocs.io/en/latest/multiconfig.html), extending this functionality to NetBox seems feasible. This has come up several times in discussion: - [Multiple Authentication methods at the same time, meaning Ldap OR SSO possible?](https://github.com/netbox-community/netbox/discussions/10733) - [Multiple LDAP sources Docker](https://github.com/netbox-community/netbox/discussions/5457) - [Multiple remote auth backends](https://github.com/netbox-community/netbox/discussions/9479) - [Multiple LDAP error](https://github.com/netbox-community/netbox/discussions/9360) ### Database changes None ### External dependencies None
adam added the status: acceptedtype: feature labels 2025-12-29 20:27:52 +01:00
adam closed this issue 2025-12-29 20:27:52 +01:00
adam commented 2025-12-29 20:27:52 +01:00
Author
Owner
Copy Link

@decoupca commented on GitHub (Mar 16, 2023):

The use case that motivated this FR (authenticating users from multiple domains in a single forest) was resolved by pointing AUTH_LDAP_SERVER_URI to the Global Catalog port 3269 as described in the docs. However, this FR would still be useful in the case of separate AD forests, or any other case requiring multiple authentication backends.

@decoupca commented on GitHub (Mar 16, 2023): The use case that motivated this FR (authenticating users from multiple domains in a single forest) was resolved by pointing `AUTH_LDAP_SERVER_URI` to the Global Catalog port 3269 as described in the [docs](https://docs.netbox.dev/en/stable/installation/6-ldap/#general-server-configuration). However, this FR would still be useful in the case of separate AD forests, or any other case requiring multiple authentication backends.
adam commented 2025-12-29 20:27:53 +01:00
Author
Owner
Copy Link

@decoupca commented on GitHub (Mar 18, 2023):

Can I take a swing at this one?

@decoupca commented on GitHub (Mar 18, 2023): Can I take a swing at this one?
adam commented 2025-12-29 20:27:53 +01:00
Author
Owner
Copy Link

@decoupca commented on GitHub (Mar 20, 2023):

Would it be appropriate or helpful to include an example for how to leverage this? I have working PoC code for how to use this for multiple AD forests, but I'm not sure it belongs in the docs

@decoupca commented on GitHub (Mar 20, 2023): Would it be appropriate or helpful to include an example for how to leverage this? I have working PoC code for how to use this for multiple AD forests, but I'm not sure it belongs in the docs
adam commented 2025-12-29 20:27:53 +01:00
Author
Owner
Copy Link

@AnythingOverIP commented on GitHub (Mar 24, 2023):

This could help also to add redundancy, even for a single domain. Pointing the requests to multiple servers of a same domain instead of a single one. If it was to be unavailable, other servers would still authenticate the users.

for multiple domains, can it support providing the domain name (DOMAIN\User)? Currently, I was not able to do it, and should it support multiple AD Forest, many of my users would have the same username defined in different domains.

@AnythingOverIP commented on GitHub (Mar 24, 2023): This could help also to add redundancy, even for a single domain. Pointing the requests to multiple servers of a same domain instead of a single one. If it was to be unavailable, other servers would still authenticate the users. for multiple domains, can it support providing the domain name (DOMAIN\User)? Currently, I was not able to do it, and should it support multiple AD Forest, many of my users would have the same username defined in different domains.
adam commented 2025-12-29 20:27:53 +01:00
Author
Owner
Copy Link

@decoupca commented on GitHub (Mar 24, 2023):

for multiple domains, can it support providing the domain name (DOMAIN\User)? Currently, I was not able to do it, and should it support multiple AD Forest, many of my users would have the same username defined in different domains.

I wondered the same thing. Don't know for sure, may require a custom backend, which is the only way I see to be able to parse a username and take conditional actions based on it.

@decoupca commented on GitHub (Mar 24, 2023): > for multiple domains, can it support providing the domain name (DOMAIN\User)? Currently, I was not able to do it, and should it support multiple AD Forest, many of my users would have the same username defined in different domains. I wondered the same thing. Don't know for sure, may require a [custom backend](https://django-auth-ldap.readthedocs.io/en/latest/custombehavior.html#subclassing-ldapbackend), which is the only way I see to be able to parse a username and take conditional actions based on it.
adam commented 2025-12-29 20:27:53 +01:00
Author
Owner
Copy Link

@AnythingOverIP commented on GitHub (Mar 25, 2023):

If it's too complicated to parse, a drop-down menu on the login page that list the available domains might be easier to implement. Selecting a domain would then refer to a domain specific config that has one or more LDAP server.

@AnythingOverIP commented on GitHub (Mar 25, 2023): If it's too complicated to parse, a drop-down menu on the login page that list the available domains might be easier to implement. Selecting a domain would then refer to a domain specific config that has one or more LDAP server.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#7757
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?