External authentication no longer works #441
Comments
|
To seek help, please use the Github Discussions, or create a proper bug report by completing our bug-report template. |
cimnine
added
awaiting answer
|
Updated the OP. I should note that the netbox itself works fine, what does not is the external authentication. Previous version works fine, and since the major change was replacement of the gunicorn with NGINX Unit I suspect it has something to do with that. |
cimnine
removed
the
invalid-template
|
I couldn't reproduce this problem. Do you have some more information? |
|
NetBox is configured strictly through environment variables. Most of the config is default: REMOTE_AUTH_ENABLED: "true"
REMOTE_AUTH_AUTO_CREATE_USER: "true"I'm using Apache reverse proxy with mod_auth_oidc authenticating users via REMOTE_USER header. |
|
I have noticed the same. I have done a capture within the netbox container and can see the REMOTE_AUTH headers being passed, they are just not honored. Let me know if you need any outputs / testing done. |
|
Can you try to set The corresponding docs say:
This would match your described behaviour. The alternative would be to set |
|
I've tried setting this in the nginx_unit.json and rebuilding. I have also changed my header to be REMOTE-AUTH-HEADER to no avail. In the netbox ENV file I have set - REMOTE_AUTH_HEADER to be both REMOTE-AUTH-HEADER and X-REMOTE-AUTH-HEADER to test. In the netbox docs it says: _REMOTE_AUTH_HEADER When remote user authentication is in use, this is the name of the HTTP header which informs NetBox of the currently authenticated user. For example, to use the request header X-Remote-User it needs to be set to HTTP_X_REMOTE_USER. (Requires REMOTE_AUTH_ENABLED.)_ |
Ah, I did not know that. So that would mean, your authenticating proxy has to send a Since you said you've captured in the container: Can you share such a request with us? |
Can confirm this works. Identical config as before. |
|
@tobiasge Shall we add |
I think this was introduced to prevent the overriding of headers. When we set this to |
|
Would you consider using a toggle for this based on ENVAR value? or in There are not that many ways for a user to properly change this. Overriding the Nginx config file will block any upstream changes, the same goes for overriding the CMD directive. And since Docker will not run arbitrary commands after CMD (despite requests), the only way that is currently reasonable is to (ab)use the HEALTHCHECK directive. |
|
Hi Guys, I'm having trouble getting this to work with google cloud iap which sets the user email as header : For netbox envs I've set: And ran after netbox start: also tried with: but no luck Any idea what else I'm missing? |
|
nvm, working with: (Had to capitalise the |
Current Behavior
After upgrading to current Docker container (2.10.3 > 2.10.4) REMOTE_AUTH no longer works.
Looking at the NGINX Unit docs, it seems the Unit does not support handling REMOTE_USER headers.
Expected Behavior
REMOTE_USER header gets passed to the back-end.
Debug Information
docker-compose version:docker version:The output of
git rev-parse HEAD:XXXXXNot using git.
The command you used to start the project:
docker-compose -f docker-compose.new.yml up --detach --buildThe output of
docker inspect netboxcommunity/netbox:latest --format "{{json .Config.Labels}}":{ "BUILD_REASON": "netbox-docker", "NETBOX_GIT_BRANCH": "HEAD", "NETBOX_GIT_REF": "856d2e317605011e16a17bd87062721737ce3474", "NETBOX_GIT_URL": "https://github.com/netbox-community/netbox.git", "ORIGINAL_TAG": "docker.io/netboxcommunity/netbox:v2.10.4", "org.label-schema.build-date": "2021-02-10T12:16+00:00", "org.label-schema.description": "A container based distribution of NetBox, the free and open IPAM and DCIM solution.", "org.label-schema.name": "NetBox Docker", "org.label-schema.schema-version": "1.0", "org.label-schema.url": "https://github.com/netbox-community/netbox-docker", "org.label-schema.usage": "https://github.com/netbox-community/netbox-docker/wiki", "org.label-schema.vcs-ref": "c80fb19507679938528817ab8a9b03514bd1e8be", "org.label-schema.vcs-url": "https://github.com/netbox-community/netbox-docker.git", "org.label-schema.vendor": "The netbox-docker contributors.", "org.label-schema.version": "1.0.2", "org.opencontainers.image.authors": "The netbox-docker contributors.", "org.opencontainers.image.created": "2021-02-10T12:16+00:00", "org.opencontainers.image.description": "A container based distribution of NetBox, the free and open IPAM and DCIM solution.", "org.opencontainers.image.documentation": "https://github.com/netbox-community/netbox-docker/wiki", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "c80fb19507679938528817ab8a9b03514bd1e8be", "org.opencontainers.image.source": "https://github.com/netbox-community/netbox-docker.git", "org.opencontainers.image.title": "NetBox Docker", "org.opencontainers.image.url": "https://github.com/netbox-community/netbox-docker", "org.opencontainers.image.vendor": "The netbox-docker contributors.", "org.opencontainers.image.version": "1.0.2" }The output of
docker-compose logs netbox:The text was updated successfully, but these errors were encountered: