Remote groups via HTTP Headers

[MaxRink]

Fixes: #5775

Unlike the LDAP Backend, the RemoteUserBackend wasnt able to Sync Group memberships form the auth Provider.
This brings it up to parity, as the new Settings give you the Option to setup an automatic Group Sync (and revocation) on each User login.
This has been tested with oauth2-proxy
The old behaviopur of just Syncing Users and then manually managing Groups should be unaffected.
ToDo:

• Tests for new Settings

[jeremystretch]

Thank you for your interest in contributing to NetBox, however it appears there is no accepted issue that correlates to this pull request. Before pull requests are opened, we require an accepted issue as per our contributing guide. Please first open an issue and wait for it to be accepted before further work is done on this pull request.

[MaxRink]

@jeremystretch there is :D
#5775 (comment)

[jeremystretch]

Ok, I see that. For future, please be sure to retain the ### Fixes: #ISSUENUMBER header from the PR template. This ensures that issues are correctly correlated with PRs and automatically closed when a PR is merged. It makes my job a lot easier. 🙂

[jeremystretch]

Can we get some remote authentication users to test this and weigh in here?

[mackaybe]

Successfully tested with oauth2-proxy and keycloak

[davama]

Just noticed this

will test with http header auth
Will update tomorrow 👍👍
Thank you!

[sol1-matt]

I've patched the 3.0.2 release tag with this diff on our dev box and SSO login continues to work.
No problems found in the upgrade.

I say continues as we patched the previous version (2.11) as well, not sure if that previous patch was the same as this one or different as the person who did it said it was 'based on it'.

upstream auth is Okta

[jeremystretch]

@davama were you able to test this? Can you share your findings?

[davama]

@jeremystretch @mackaybe
applied this patch to my v3.0.0 instance ... i would assume it would also work on v3.0.2 as @sol1-matt mentioned

works good 👍
using these settings.
HTTP_REMOTE_GROUPS syncs with netbox.

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_REMOTE_USER'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_DEFAULT_GROUPS = ['netbox']
REMOTE_AUTH_DEFAULT_PERMISSIONS =  { "is_superuser" }
REMOTE_AUTH_GROUP_SYNC_ENABLED = True
REMOTE_AUTH_GROUP_HEADER = 'HTTP_REMOTE_GROUPS'
REMOTE_AUTH_SUPERUSER_GROUPS = ['netbox'] 
REMOTE_AUTH_STAFF_GROUPS = ['netbox']
REMOTE_AUTH_GROUP_SEPARATOR = ','

Would be awesome if email , first_name , last_name would sync too... but outside this PR