Entra ID auto mapping users in groups

[JeanKean-art]

Hi,

Here is my netbox configuration :

REMOTE_AUTH_BACKEND = 'social_core.backends.azuread.AzureADOAuth2'
SOCIAL_AUTH_AZUREAD_OAUTH2_KEY = 'xxxxxxxx'
SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET = 'xxxxxxxxxx'
REMOTE_AUTH_DEFAULT_GROUPS = []
REMOTE_AUTH_DEFAULT_PERMISSIONS = 'YYY'

REMOTE_AUTH_ENABLED: True
REMOTE_AUTH_GROUP_SYNC_ENABLED: True
REMOTE_AUTH_AUTO_CREATE_USER: True
REMOTE_AUTH_GROUP_HEADER = 'HTTP_OIDC_CLAIM_ROLES'
REMOTE_AUTH_GROUP_SEPARATOR = ','


SOCIAL_AUTH_AZUREAD_OAUTH2_RESOURCE = 'https://graph.microsoft.com/'
SOCIAL_AUTH_PIPELINE = (
    'social_core.pipeline.social_auth.social_details',
    'social_core.pipeline.social_auth.social_uid',
    'social_core.pipeline.social_auth.social_user',
    'social_core.pipeline.user.get_username',
    'social_core.pipeline.social_auth.associate_by_email',
    'social_core.pipeline.user.create_user',
    'social_core.pipeline.social_auth.associate_user',
    'netbox.authentication.user_default_groups_handler',
    'social_core.pipeline.social_auth.load_extra_data',
    'social_core.pipeline.user.user_details',
    'social_core.pipeline.social_auth.auth_allowed',
)


# Define special user types using groups. Exercise great caution when assigning superuser status.
SOCIAL_AUTH_PIPELINE_CONFIG = {
    'AZUREAD_USER_FLAGS_BY_GROUP': {
        "is_staff": ['xxxxxxxx']
    },
    'AZUREAD_GROUP_MAP': {
        'xxxxxxxx': 'YYY'
    }
}

SSO authentication is working fine because my Entra ID user can log in to netbox, user is created as expected.
But this user (in xxxxxxxx entra id group, is not mapped to netbox YYY group (netbox group name = entra id group name)

Did I miss something?

[clangerman]

I have the same question -
My user, firsname, lastname, email gets imported and created in users with Entra SSO but I've yet to figure how to get AD groups imported so I can set permissions or roles against them and have them match AD user membership in a group
example:
AD has groups networkeng and corpuser
my AD account is member of both
I would like those groups to be imported to netbox groups when I login with sso and then I can go in as admin and set networkeng to superuser and corpuser to view only

If you solved this can you share how you did it?
thank you!