NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-08-24 00:15:17 -06:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

11508 review changes - flexible config params

Browse Source
This commit is contained in:
Arthur 2023-08-17 09:12:21 -07:00
parent 3cb5ba7fa9
commit 08348c617f
2 changed files with 32 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/administration/authentication/microsoft-azure-ad.md
View File

@ -84,16 +84,34 @@ SOCIAL_AUTH_PIPELINE = (
# Define special user types using groups. Exercise great caution when assigning superuser status.
SOCIAL_AUTH_PIPELINE_CONFIG = {
'AZUREAD_USER_FLAGS_BY_GROUP': {
"is_staff": ['{AZURE_GROUP_ID}',],
"is_superuser": ['{AZURE_GROUP_ID}',]
"is_staff": ['{AZURE_GROUP_ID1}','{AZURE_GROUP_ID2}'],
"is_superuser": ['{AZURE_GROUP_ID1}','{AZURE_GROUP_ID2}']
},
'AZUREAD_GROUP_MAP': {
'{AZURE_GROUP_ID}': '{NETBOX_GROUP}',
'{AZURE_GROUP_ID1}': '{NETBOX_GROUP1}',
'{AZURE_GROUP_ID2}': '{NETBOX_GROUP2}',
}
}
```
For example, here is a config that maps a single Azure AD group (the token '1a36bed9-3bdc-4970-ab66-faf9704e0af4' shown here is the ID of the group within the Azure dashboard) to be both is_staff and is_superuser status as well as assign it to the group 'tgroup' within NetBox:
```
SOCIAL_AUTH_PIPELINE_CONFIG = {
# Define special user types using groups. Exercise great caution when assigning superuser status.
'AZUREAD_USER_FLAGS_BY_GROUP': {
'is_staff': ['1a36bed9-3bdc-4970-ab66-faf9704e0af4',],
'is_superuser': ['1a36bed9-3bdc-4970-ab66-faf9704e0af4',]
},
'AZUREAD_GROUP_MAP': {
'1a36bed9-3bdc-4970-ab66-faf9704e0af4': 'tgroup',
}
}
```
**AZUREAD_USER_FLAGS_BY_GROUP.is_staff**: users who are in any of the Azure AD group-ids in the array will have staff permission assigned to them.
**AZUREAD_USER_FLAGS_BY_GROUP.is_superuser**: users who are in any of the Azure AD group-ids in the array will have superuser permission assigned to them.

19
netbox/netbox/authentication.py
View File

@ -403,18 +403,21 @@ def azuread_map_groups(response, user, backend, *args, **kwargs):
)
config = getattr(settings, "SOCIAL_AUTH_PIPELINE_CONFIG")
if "AZUREAD_USER_FLAGS_BY_GROUP" not in config:
if "AZUREAD_USER_FLAGS_BY_GROUP" not in config and "AZUREAD_GROUP_MAP" not in config:
raise ImproperlyConfigured(
"Azure AD group mapping has been configured, but AZUREAD_USER_FLAGS_BY_GROUP is not defined."
"Azure AD group mapping has been configured, but AZUREAD_USER_FLAGS_BY_GROUP or AZUREAD_GROUP_MAP is not defined."
)
if "AZUREAD_GROUP_MAP" not in config:
flags_by_group = config.get("AZUREAD_USER_FLAGS_BY_GROUP", {'is_superuser': [], 'is_staff': []})
group_mapping = config.get("AZUREAD_GROUP_MAP", {})
if 'is_staff' not in flags_by_group and 'is_superuser' not in flags_by_group:
raise ImproperlyConfigured(
"Azure AD group mapping has been configured, but AZUREAD_GROUP_MAP is not defined."
"Azure AD group mapping AZUREAD_USER_FLAGS_BY_GROUP is defined but does not contain either is_staff or is_superuser."
)
flags_by_group = config["AZUREAD_USER_FLAGS_BY_GROUP"]
group_mapping = config["AZUREAD_GROUP_MAP"]
superuser_map = flags_by_group.get('is_superuser', [])
staff_map = flags_by_group.get('is_staff', [])
access_token = response.get('access_token')
headers = {
@ -455,11 +458,11 @@ def azuread_map_groups(response, user, backend, *args, **kwargs):
if value.get('@odata.type', None) == '#microsoft.graph.group':
group_id = value.get('id', None)
if group_id in flags_by_group['is_superuser']:
if group_id in superuser_map:
logger.info(f"Azure AD group mapping - setting superuser status for: {user}.")
is_superuser = True
if group_id in flags_by_group['is_staff']:
if group_id in staff_map:
logger.info(f"Azure AD group mapping - setting staff status for: {user}.")
is_staff = True