I made Netbox work with LDAPS. It was a pain in the ass, but when you get it working, life in Netbox get so much more easier.

Here is how I made LDAPS work in Netbox: https://netbox.readthedocs.io/en/stable/installation/6-ldap/

LDAP configuration — https://netbox.readthedocs.io/en/stable/installation/6-ldap/

dnf install -y openldap-devel

cd /opt/netbox/

source venv/bin/activate

(venv) # pip install --upgrade pip (venv) # pip3 install django-auth-ldap (venv) # echo django-auth-ldap >> local_requirements.txt

vim /opt/netbox/netbox/netbox/configuration.py:

REMOTE_AUTH_ENABLED = True TIME_ZONE = 'Asia/Bagdad' SHORT_DATE_FORMAT = 'd-N-Y' SHORT_DATETIME_FORMAT = 'd-N-Y H:i' NAPALM_USERNAME = 'username' NAPALM_PASSWORD = 'xxxxx'

vim /opt/netbox/netbox/netbox/ldap_config.py:

import ldap from django_auth_ldap.config import LDAPSearch from django_auth_ldap.config import LDAPSearch, GroupOfNamesType AUTH_LDAP_SERVER_URI = "ldaps://ldap.example.com/" AUTH_LDAP_CONNECTION_OPTIONS = { ldap.OPT_REFERRALS: 0 } AUTH_LDAP_BIND_DN = "CN=netbox,CN=Users,DC=example,DC=com" AUTH_LDAP_BIND_PASSWORD = "password" LDAP_IGNORE_CERT_ERRORS = True AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=Users,dc=staff,dc=example,dc=com", ldap.SCOPE_SUBTREE, "(sAMAccountName=%(user)s)") AUTH_LDAP_USER_ATTR_MAP = { "first_name": "givenName", "last_name": "sn", "email": "mail" } AUTH_LDAP_GROUP_SEARCH = LDAPSearch("ou=Groups,dc=staff,dc=example,dc=com", ldap.SCOPE_SUBTREE, "(objectClass=group)") AUTH_LDAP_GROUP_TYPE = GroupOfNamesType() AUTH_LDAP_REQUIRE_GROUP = "CN=net,ou=Groups,dc=staff,dc=example,dc=com" AUTH_LDAP_MIRROR_GROUPS = True AUTH_LDAP_USER_FLAGS_BY_GROUP = { "is_active": "CN=net,ou=Groups,dc=staff,dc=example,dc=com", "is_staff": "CN=net,ou=Groups,dc=staff,dc=example,dc=com", "is_superuser": "CN=net,ou=Groups,dc=staff,dc=example,dc=com" } AUTH_LDAP_FIND_GROUP_PERMS = True AUTH_LDAP_CACHE_TIMEOUT = 3600

systemctl restart netbox

tail -f /var/log/messages

The secrets functionality was moved out of NetBox core in v3.0 per the release notes. It wasn't a very popular feature, and frankly a subpar implementation compared to something Hashicorp Vault, which is what I'd recommend to replace it.

At some point I'd like to work on more closely integrating Vault with NetBox, as that seems like the ideal setup.