NetBox AD Authentication

Question

I need help. Under NetBox, I try to establish an AD authentication. This shouldn't be so hard, does we thinking before...

NetBox delivers a ldap-ad authentication example that I used. It lets me show:

import ldap
from django_auth_ldap.config import LDAPSearch, NestedGroupOfNamesType
 
# Server URI
AUTH_LDAP_SERVER_URI = "ldaps://ip_address:port"
 
# The following may be needed if you are binding to Active Directory.
AUTH_LDAP_CONNECTION_OPTIONS = {
    ldap.OPT_REFERRALS: 0
}
 
# Set the DN and password for the NetBox service account.
AUTH_LDAP_BIND_DN = "CN=NetBoxAdmin,OU=System,OU=Admin,DC=domain,DC=de"
AUTH_LDAP_BIND_PASSWORD = "a secret"
 
# Include this setting if you want to ignore certificate errors. This might be needed to accept a self-signed cert.
# Note that this is a NetBox-specific setting which sets:
#   ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
LDAP_IGNORE_CERT_ERRORS = True
 
# Include this setting if you want to validate the LDAP server certificates against a CA certificate directory on your server
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, LDAP_CA_CERT_DIR)
# LDAP_CA_CERT_DIR = '/etc/ssl/certs'
 
# Include this setting if you want to validate the LDAP server certificates against your own CA.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, LDAP_CA_CERT_FILE)
# LDAP_CA_CERT_FILE = '/path/to/example-CA.crt'
 
# This search matches users with the sAMAccountName equal to the provided username. This is required if the user's
# username is not in their DN (Active Directory).
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "OU=Admin,DC=domäne,DC=de",
    ldap.SCOPE_SUBTREE,
    "(|(userPrincipalName=%(user)s)(sAMAccountName=%(user)s))"
)
 
# If a user's DN is producible from their username, we don't need to search.
AUTH_LDAP_USER_DN_TEMPLATE = None
 
# You can map user attributes to Django attributes as so.
AUTH_LDAP_USER_ATTR_MAP = {
    "username": "sAMAccountName",
    "email": "mail",
    "first_name": "givenName",
    "last_name": "sn",
}
 
AUTH_LDAP_USER_QUERY_FIELD = "username"
 
# This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
# hierarchy.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    "OU=Human,OU=Admin,DC=domain,DC=de",
    ldap.SCOPE_SUBTREE,
    "(objectClass=group)"
)
AUTH_LDAP_GROUP_TYPE = NestedGroupOfNamesType()
 
# Define a group required to login.
AUTH_LDAP_REQUIRE_GROUP = "CN=NetBox,OU=Human,OU=Admin,DC=domain,DC=de"
 
# Mirror LDAP group assignments.
AUTH_LDAP_MIRROR_GROUPS = True
 
# Define special user types using groups. Exercise great caution when assigning superuser status.
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "cn=active,ou=groups,dc=example,dc=com",
    "is_staff": "cn=staff,ou=groups,dc=example,dc=com",
    "is_superuser": "CN=NetBox,OU=Human,OU=Admin,DC=domain,DC=de"
}
 
# For more granular permissions, we can map LDAP groups to Django groups.
AUTH_LDAP_FIND_GROUP_PERMS = True
 
# Cache groups for one hour to reduce LDAP traffic
AUTH_LDAP_CACHE_TIMEOUT = 3600
AUTH_LDAP_ALWAYS_UPDATE_USER = True

The problem is, if i try to login with one of my accounts, i get this message back.

I have also active the error-log from django_auth_ldap. But it is not much, what i get.

Authentication failed for usertest: failed to map the username to a DN.

The LDAP Configuration should be all-right, so I have try it with the same accessdata (URI and BIND-Account) to get a ldaps-regrest over "ldapsearch". This have work perfectlly. The NetBox Server, neither the Nginx-Server have a Self-Signed certificate.

I use the following versions:

• NetBox, v.3.6.5
• Python, v.3.10.12
• Linux, Ubuntu 22.04.4 LTS (Jammy)

Does anyone have an idea how to solve this?

With best regards

Alphabeit