How do i configure Azure SSO in my Helm Chart with the external secrets? #18214

Cyborg190 · 2024-12-12T07:54:44Z

Cyborg190
Dec 12, 2024

I have deployed Netbox in Kubernetes with the Helm Chart 5.0.0-beta.141 and now i would like to add the Azure SSO configuration to my values.yaml. The SOCIAL_AUTH_AZUREAD_OAUTH2_KEY and SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET are stored in Azure Key Vault and managed with External Secrets Operator (ESO).

How do i configure Azure SSO in my Helm Chart with the external secrets?

When i try to login with SSO login i get the following response.

AADSTS700016: Application with identifier 'None' was not found in the directory '********'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

pulling the secret from Azure Key Vault
netbox-sso.yaml

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret  #gitleaks:allow
metadata:
  name: netbox-sso
  namespace: netbox
spec:
  data:
  - remoteRef:
      key: netbox-uat-sso-auth-key
      conversionStrategy: Default
      decodingStrategy: None
      metadataPolicy: None
    secretKey: SOCIAL_AUTH_AZUREAD_OAUTH2_KEY
  - remoteRef:
      key: netbox-uat-sso-auth-secret
      conversionStrategy: Default
      decodingStrategy: None
      metadataPolicy: None
    secretKey: SOCIAL_AUTH_AZUREAD_OAUTH2_SECRET

  secretStoreRef:
    kind: SecretStore
    name: secret-store-kv-netsec
 
  target:
    name: netbox-sso
    creationPolicy: Owner
    deletionPolicy: Retain

values.yaml

remoteAuth:
  enabled: true
  backends:
    - social_core.backends.azuread.AzureADOAuth2

extraConfig:
  - secret:
      secretName: netbox-sso
  - values:
      SOCIAL_AUTH_PIPELINE: 
        [
          "social_core.pipeline.social_auth.social_details",
          "social_core.pipeline.social_auth.social_uid",
          "social_core.pipeline.social_auth.social_user",
          "social_core.pipeline.user.get_username",
          "social_core.pipeline.social_auth.associate_by_email",
          "social_core.pipeline.user.create_user",
          "social_core.pipeline.social_auth.associate_user",
          "netbox.authentication.user_default_groups_handler",
          "social_core.pipeline.social_auth.load_extra_data",
          "social_core.pipeline.user.user_details",
          "netbox.sso_pipeline_roles.set_role",
        ]
extraVolumes:
  - name: sso-pipeline-roles
    configMap:
      name: sso-pipeline-roles
extraVolumeMounts:
  - name: sso-pipeline-roles
    mountPath: /opt/netbox/netbox/netbox/sso_pipeline_roles.py
    subPath: sso_pipeline_roles.py
    readOnly: true