Send netdisco-users mailing list submissions to
[email protected]
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/netdisco-users
or, via email, send a message with subject or body 'help' to
[email protected]
You can reach the person managing the list at
[email protected]
When replying, please edit your Subject line so it is more specific
than "Re: Contents of netdisco-users digest..."
Today's Topics:
1. Re: Active Directory authentication (Michael Butash)
--- Begin Message ---
Thanks for sharing Paul, that's pretty interesting, I was looking into
doing something like that a while back in posts here using oauth2-proxy as
well with entra for a customer, but I wasn't getting anywhere, and customer
wasn't really using Netdisco much to waste much more time on it.
I was annoyed enough that I did spend some time researching with AI the
code to extending the Netdisco login system to do proper group
authorization and role mapping with Claude to run with building it, and
seemed pretty doable, but wasn't sure how folks would receive that (ie. ai
slop-y), seeing I'm not a developer, and really couldn't tell you good from
bad code aside from does it work or not and pass audits.
Since then, I've been working on my own pet code projects getting into
development more with claude-code and codex before I start trying to
contribute upstream patches to established projects, but at some point
might get back to Netdisco as its lack of full aaa has annoyed me for a
decade or two. Claude-Code and more recently Codex has been quite effective
in building me a full distributed client/server mcp setup I use regularly
now, and since have a better idea how oauth functions having integrated my
own services to work to be more useful to apply to ND.
-mb
On Tue, Mar 31, 2026 at 10:13 PM Mackie, Paul <[email protected]> wrote:
> I put netdisco behind Azure Web App Proxy, using 2 groups (netdisco-admins
> and netdisco-operators).
>
> The Azure Web App Proxy handles Entra authentication and conditional
> access policies, then passes the relevant group name to netdisco using the
> X-REMOTE-USER HTTP header. 2 local netdisco users exist which match the
> Entra group names.
>
> No need for netdisco to be aware of individual users this way. Also this
> approach allows you to securely expose netdisco to Internet without any
> port forwarding.
>
> Maybe this helps you, it works well for us but I would also prefer
> something that didn't abuse using roles as usernames ideally.
>
> Best regards,
>
> *Paul Mackie*
>
>
>
>
>
>
>
>
>
> GEA INTERNAL
> ------------------------------
> *From:* Michael Butash <[email protected]>
> *Sent:* Wednesday, April 1, 2026 1:10:05 am
> *To:* Johnnie Adams <[email protected]>
> *Cc:* [email protected] <
> [email protected]>
> *Subject:* Re: [Netdisco] Active Directory authentication
>
> Something to note as a common gotcha, a username needs to exist and
> created still inside netdisco FIRST with netdisco role permission set and
> set to external auth. It won't simply pass the username entered blindly to
> AD for authentication if it doesn't exist first as there is no group
> authorization to map users to netdisco role, and will fail if the user is
> not present with group set. One might assume like many of us do it would
> pass the user/pass along anyways, but I personally have been wrong assume
> that.
>
> -mb
>
> On Tue, Mar 31, 2026 at 3:14 PM Johnnie Adams <[email protected]> wrote:
>
> Hi, folks,
>
> I'm trying to use Active Directory authentication on a new
> installation of NetDisco I'm building. I've put the authentication
> information into deployment.yml. Now, when I try to log in with an AD
> account, I get Incorrect username or password, please try again. Local
> accounts work fine. There are no errors in the logs.
>
> Here's what's in deployment.yml:
>
> ldap:
>
> servers:
>
> - 'ad.example.com'
>
> base_dn: 'dc=ad,dc=example,dc=com'
>
> proxy_user: '[email protected]'
>
> proxy_pass: 'redacted'
>
> user_query: '(&(objectClass=user)(sAMAccountName=%u))'
>
> attributes:
>
> fullname: 'displayName'
>
> username: 'sAMAccountName'
>
> email: 'mail'
>
> autoregister: true
>
> opts:
>
> referrals: 0
>
> debug: 1
>
> I'm puzzled. Your thoughts?
>
> Thanks,
>
> John A
> _______________________________________________
> Netdisco mailing list
> [email protected]
> https://sourceforge.net/p/netdisco/mailman/netdisco-users/
>
>
>
--- End Message ---
_______________________________________________
Netdisco mailing list - Digest Mode
[email protected]
https://lists.sourceforge.net/lists/listinfo/netdisco-users
