I dont getting configure LDAP on my netbox-chart

[sergivaldofilho]

Hi guys, I dont getting to configure the LDAP on Netbox. I need help to understand what do to deploy the application. My code in values.yaml:

remoteAuth:
  enabled: True
  backends:
    - netbox.authentication.LDAPBackend
    - netbox.authentication.RemoteUserBackend
  header: HTTP_REMOTE_USER
  userFirstName: HTTP_REMOTE_USER_FIRST_NAME
  userLastName: HTTP_REMOTE_USER_LAST_NAME
  userEmail: HTTP_REMOTE_USER_EMAIL
  autoCreateUser: false
  autoCreateGroups: false
  defaultGroups: []
  defaultPermissions: {}
  groupSyncEnabled: false
  groupHeader: HTTP_REMOTE_USER_GROUP
  superuserGroups: []
  superusers: []
  staffGroups: []
  staffUsers: []
  groupSeparator: "|"
  # The following options are specific for backend "netbox.authentication.LDAPBackend"
  # you can use an existing netbox secret with "ldap_bind_password" instead of "bindPassword"
  # see https://django-auth-ldap.readthedocs.io/
  ldap:
    serverUri: "ldap://sfz-adds-001.sefaz.al.gov.br"
    startTls: false
    ignoreCertErrors: true
    caCertData: ""
    bindDn: CN=Netbox Admin,OU=Sistemas,OU=Estrutura Organizacional - Usuarios,DC=xxxxx,DC=xx,DC=xxx,DC=xx
    bindPassword: XXXXXXXX
    userDnTemplate: "None"
    userSearchBaseDn: OU=Estrutura Organizacional - Usuarios,DC=xxxxx,DC=xx,DC=xxx,DC=xx
    userSearchAttr: sAMAccountName
    groupSearchBaseDn: OU=Estrutura Organizacional - Grupos,DC=xxxxx,DC=xx,DC=xxx,DC=xx
    groupSearchClass: group
    groupType: ActiveDirectoryGroupType
    requireGroupDn:
      - CN=Network Configuration Operators,CN=Builtin,DC=xxxxx,DC=xx,DC=xxx,DC=xx
      - CN=G_NETBOX_ADMIN,OU=Grupos,OU=Estrutura Organizacional - Grupos,DC=xxxxx,DC=xx,DC=xxx,DC=xx
    isAdminDn:
      - CN=G_NETBOX_ADMIN,OU=Grupos,OU=Estrutura Organizacional - Grupos,DC=xxxxx,DC=xx,DC=xxx,DC=xx
    isSuperUserDn:
      - CN=G_NETBOX_ADMIN,OU=Grupos,OU=Estrutura Organizacional - Grupos,DC=xxxxx,DC=xx,DC=xxx,DC=xx
    findGroupPerms: true
    mirrorGroups: true
    mirrorGroupsExcept: None
    cacheTimeout: 3600
    attrFirstName: givenName
    attrLastName: sn
    attrMail: mail

Can you help me to understand what to do? With these configs, when I try logon, shows the messages below:

"Errors
Please enter the correct username and password. Pay attention to upper and lower case letters."

In summary, I can deploy the application normally. However, I can only log in using the local admin user. When attempting to log in with LDAP (AD) users, the message above is displayed. I’ve already tried deploying with just the LDAP backend, but that didn’t work either.

I’m not sure if it makes any difference, but whether using one or two remote backends—with their respective configurations—in the application pod logs, there’s no indication of loading files from the /etc/netbox/config/ldap/ directory, such as ldap_config.py, which I imagine should be loaded.

Below is a snippet from the log that loads all files from the /etc/netbox/config/ directory, except for the ldap/ subdirectory:

[candlerb]

Aside: I can't help you with your helm chart, but I can show you how to stop your YAML getting mangled by github. Edit your post, and add three backticks (```), on a line of their own, before and after the YAML. Then somebody might be able to look at it.

Then in any case you need to describe the actual behaviour or problem you're seeing. Does helm reject your chart? Does Netbox deploy, but crash? Does Netbox deploy, but only let you login using local usernames and passwords? Are LDAP logins accepted, but the wrong groups assigned? Some other problem?

Also, are you sure you really need both the LDAPBackend and RemoteUserBackend? RemoteUserBackend means that the front-end HTTP proxy is doing the authentication, and it seems unlikely that both would coexist nicely. I would suggest you use either LDAPBackend or RemoteUserBackend.

[sergivaldofilho]

Thank you for your support, my friend.

In summary, I can deploy the application normally. However, I can only log in using the local admin user. When attempting to log in with LDAP (AD) users, the message above is displayed. I’ve already tried deploying with just the LDAP backend, but that didn’t work either. However, your point about maintaining only one remote backend makes sense. I can remove it from the values file on the next attempt. I’ve added more information to provide greater technical context, which might help them guide me on what steps to take.