Enable Logs for Azure SSO

[sabinayakc]

Hello,

I am trying to integrate Azure AD. So far everything works except group assignments.

I followed the instructions here https://github.com/nautobot/nautobot/blob/main/examples/azure_ad/README.md

How do I enable logging for SSO troubleshooting?

[jdrew82]

@sabinayakc I'd suggest modifying your group_sync function to print out the information you need for troubleshooting. That's always worked for me and you can see the exact response you get from your IDP once authenticated. Can you please clarify what issues you're having with group assignments though? It's fairly basic and easy to setup. Based upon the groups that the user is assigned you can define the groups that you wish to use to assign as admin or superuser roles with the STAFF_GROUPS and SUPERUSER_GROUPS. There's also the option for logging as described here in the README you linked.

[sabinayakc]

For some context, I am using helm chart deployment in a K8s cluster. With the following env variables.

    - name: "NAUTOBOT_SSO_CLAIMS_GROUP"
      value: "groups"
    - name: "NAUTOBOT_SSO_ENABLE_GROUP_SYNC"
      value: "true"
    - name: "NAUTOBOT_SSO_SUPERUSER_GROUPS"
      value: "Group Name in Azure"
    - name: "NAUTOBOT_SSO_STAFF_GROUPS"
      value: "Group Name in Azure"

And config

AUTHENTICATION_BACKENDS = [
"social_core.backends.azuread_tenant.AzureADTenantOAuth2",
"nautobot.core.authentication.ObjectPermissionBackend",
]
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = os.getenv("SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY", "")
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = os.getenv("SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET", "")
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = os.getenv("SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID", "")

[jdrew82]

@sabinayakc What about your group_sync function and the configuration for SOCIAL_AUTH_PIPELINE?

[sabinayakc]

I'm getting this error. @glennmatthews

[glennmatthews]

Hm. I'll admit I haven't actually used that since it was added. :-) Try "nautobot.extras.group_sync.group_sync" instead?

[sabinayakc]

That worked.

We possibly need a PR to fix that in the core settings?

[glennmatthews]

Yes, perhaps it can be addressed as a part of #6623?

[sabinayakc]

@glennmatthews created a PR. #6624

[jdrew82]

@sabinayakc A few things:

• There appears to be a typo in the docs. That should be:

"my_custom_module": {"handlers": ["console", "file"], "level": "DEBUG"}

• You seem to misunderstand how the group_sync() function is intended to be added into the environment. It is a Python function that must be part of a Python module that you install into the environment. That is where the my_custom_module bit comes in for the logging. That is actually just an example name for whatever you wish to call the module you create, ie my_group_sync_module or whatever it is. Once you've created that and installed it into the environment, you need to update your SOCIAL_AUTH_PIPELINE to point to that module, ie it isn't in nautobot, it'd be my_group_sync_module.group_sync.group_sync assuming you're using the same structure as in the example. It basically needs to be able to be imported in the Python REPL on that path that you give it.

[sabinayakc]

As @glennmatthews mentioned, I prefer not passing my own function and use the default one. Looks I need to use the latest helm chart that was deployed last week that uses v2.4.1

https://github.com/nautobot/helm-charts/releases/tag/v2.4.1

I will try that. Thank you for your prompt response.

[jdrew82]

I wasn't aware of the addition of group_sync into core Nautobot so I'd definitely go that route if you can be on 2.3.12.

[sabinayakc]

With this release, how would I enable logging? What would the handler and logger config look like? Like the module name.

[sabinayakc]

I found it. Thanks again.
"nautobot.extras.group_sync": {"handlers": ["normal_console"], "level": "DEBUG"}