Add the ability to Sync netbox user Groups and special Privileges with an Remote (HTTP) Auth Backend

[MaxRink]

Environment

• Python version: 3.8.x
• NetBox version: 2.10.4
  altough both n/a

Proposed Functionality

Adding Group sync functionality to the Remote (HTTP) Auth Backend
I have a working implementation under https://github.com/MaxRink/netbox/tree/remote_groups

Use Case

Unlike the LDAP Backend, the RemoteUserBackend wasnt able to Sync Group memberships form the auth Provider.
This brings it up to parity, as the new Settings give you the Option to setup an automatic Group Sync (and revocation) on each User login.
This has been tested with oauth2-proxy
The old behaviopur of just Syncing Users and then manually managing Groups should be unaffected.

Database Changes

No

External Dependencies

No, all Django-internal

[DanSheps]

@MaxRink Are you willing to take ownership of this code (including future bug fixes)?

[MaxRink]

Yes, as we are already relying on it for our internal Instance.
@Cellebyte (one of my teamcollegues) would also be willing to take ownership, so thats its not just one person.

[Cellebyte]

@MaxRink should we also add an example oauth2-proxy configuration?

Here the example configuration for a Kubernetes Installation of oauth2-proxy.

# The ingress configuration for the netbox
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    meta.helm.sh/release-name: netbox
    meta.helm.sh/release-namespace: netbox
    nginx.ingress.kubernetes.io/auth-response-headers: Authorization,x-auth-request-user,x-auth-request-email,x-auth-request-groups
    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
    nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
    nginx.ingress.kubernetes.io/configuration-snippet: |
      auth_request_set $name_upstream_1 $upstream_cookie__oauth2_proxy_1;
      access_by_lua_block {
        if ngx.var.name_upstream_1 ~= "" then
          ngx.header["Set-Cookie"] = "_oauth2_proxy_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")
        end
      }
  labels:
    app.kubernetes.io/instance: netbox
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: netbox
    app.kubernetes.io/version: v2.9.3
    helm.sh/chart: netbox-2.3.0
  name: netbox
  namespace: netbox
spec:
  rules:
  - host: netbox.local
    http:
      paths:
      - backend:
          serviceName: netbox
          servicePort: http
        path: /
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - netbox.local
    secretName: netbox-tls

## cat oauth2-proxy-netbox.yaml 
## Full deployment of the oauth2-proxy
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: oauth2-proxy
    app.kubernetes.io/instance: oauth2-proxy
    app.kubernetes.io/name: oauth2-proxy
  name: oauth2-proxy
  namespace: netbox
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: oauth2-proxy
      app.kubernetes.io/instance: oauth2-proxy
      app.kubernetes.io/name: oauth2-proxy
  template:
    metadata:
      labels:
        app.kubernetes.io/component: oauth2-proxy
        app.kubernetes.io/instance: oauth2-proxy
        app.kubernetes.io/name: oauth2-proxy
    spec:
      containers:
      - args:
        - --provider=oidc
        - --client-id=netbox
        - --email-domain=example.com
        - --oidc-issuer-url=https://keycloak.example.com/auth/realms/master
        - --http-address=0.0.0.0:4180
        - --keycloak-group=netbox-admin
        - --keycloak-group=netbox-user
        - --keycloak-group=netbox-editor
        - --prefer-email-to-user   # optional
        - --set-xauthrequest=true
        - --skip-provider-button  # optional
        # Register a new application
        # https://github.com/settings/applications/new
        image: quay.io/oauth2-proxy/oauth2-proxy:v7.0.0
        imagePullPolicy: Always
        name: oauth2-proxy
        ports:
        - containerPort: 4180
          protocol: TCP
        env:
        - name: OAUTH2_PROXY_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-secret
              key: client-secret
        - name: OAUTH2_PROXY_COOKIE_SECRET
          valueFrom:
            secretKeyRef:
              name: oauth2-secret
              key: cookie-secret
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: oauth2-proxy
    app.kubernetes.io/instance: oauth2-proxy
    app.kubernetes.io/name: oauth2-proxy
  name: oauth2-proxy
  namespace: netbox
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    app.kubernetes.io/component: oauth2-proxy
    app.kubernetes.io/instance: oauth2-proxy
    app.kubernetes.io/name: oauth2-proxy
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oauth2-proxy
  namespace: netbox
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffer-size: 256k
    nginx.ingress.kubernetes.io/proxy-buffers-number: "8"
spec:
  rules:
  - host: netbox.local
    http:
      paths:
      - path: /oauth2
        pathType: ImplementationSpecific
        backend:
          service:
            name: oauth2-proxy
            port:
              number: 4180
      - path: /admin
        pathType: ImplementationSpecific
        backend:
          service:
            name: netbox
            port:
              number: 80
      - path: /api
        pathType: ImplementationSpecific
        backend:
          service:
            name: netbox
            port:
              number: 80
  tls:
  - hosts:
    - netbox.local
    secretName: netbox-tls

[devon-mar]

@Cellebyte
How are you handling API access with oauth2-proxy?
Are you bypassing auth_request for /api?

[Cellebyte]

@devon-mar yep

[MaxRink]

Just to reiterate, we arte still willing to maintain this code :D

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

[davama]

Is there a PR for this?

[MaxRink]

there was, and i can reopen it
#5771