Send netdisco-users mailing list submissions to
[email protected]
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/netdisco-users
or, via email, send a message with subject or body 'help' to
[email protected]
You can reach the person managing the list at
[email protected]
When replying, please edit your Subject line so it is more specific
than "Re: Contents of netdisco-users digest..."
Today's Topics:
1. Re: Active Directory authentication (Mackie, Paul)
--- Begin Message ---
I put netdisco behind Azure Web App Proxy, using 2 groups (netdisco-admins and
netdisco-operators).
The Azure Web App Proxy handles Entra authentication and conditional access
policies, then passes the relevant group name to netdisco using the
X-REMOTE-USER HTTP header. 2 local netdisco users exist which match the Entra
group names.
No need for netdisco to be aware of individual users this way. Also this
approach allows you to securely expose netdisco to Internet without any port
forwarding.
Maybe this helps you, it works well for us but I would also prefer something
that didn't abuse using roles as usernames ideally.
Best regards,
Paul Mackie
GEA INTERNAL
________________________________
From: Michael Butash <[email protected]>
Sent: Wednesday, April 1, 2026 1:10:05 am
To: Johnnie Adams <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Netdisco] Active Directory authentication
Something to note as a common gotcha, a username needs to exist and created
still inside netdisco FIRST with netdisco role permission set and set to
external auth. It won't simply pass the username entered blindly to AD for
authentication if it doesn't exist first as there is no group authorization to
map users to netdisco role, and will fail if the user is not present with group
set. One might assume like many of us do it would pass the user/pass along
anyways, but I personally have been wrong assume that.
-mb
On Tue, Mar 31, 2026 at 3:14 PM Johnnie Adams
<[email protected]<mailto:[email protected]>> wrote:
Hi, folks,
I'm trying to use Active Directory authentication on a new installation of
NetDisco I'm building. I've put the authentication information into
deployment.yml. Now, when I try to log in with an AD account, I get Incorrect
username or password, please try again. Local accounts work fine. There are no
errors in the logs.
Here's what's in deployment.yml:
ldap:
servers:
- 'ad.example.com<http://ad.example.com/>'
base_dn: 'dc=ad,dc=example,dc=com'
proxy_user: '[email protected]<mailto:[email protected]>'
proxy_pass: 'redacted'
user_query: '(&(objectClass=user)(sAMAccountName=%u))'
attributes:
fullname: 'displayName'
username: 'sAMAccountName'
email: 'mail'
autoregister: true
opts:
referrals: 0
debug: 1
I'm puzzled. Your thoughts?
Thanks,
John A
_______________________________________________
Netdisco mailing list
[email protected]<mailto:[email protected]>
https://sourceforge.net/p/netdisco/mailman/netdisco-users/
--- End Message ---
_______________________________________________
Netdisco mailing list - Digest Mode
[email protected]
https://lists.sourceforge.net/lists/listinfo/netdisco-users
