Merge 1815408e73 into 8387b4d0f6

* feat: add SSO environment variable support for OKTA and Google OAuth2

Add native support for SSO configuration through environment variables
and Docker secrets, eliminating the need to modify configuration.py
for common SSO providers.

Changes:
- Add OKTA OpenID Connect configuration variables:
  - SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY (env var)
  - SOCIAL_AUTH_OKTA_OPENIDCONNECT_SECRET (env var + Docker secret: okta_openidconnect_secret)
  - SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL (env var)

- Add Google OAuth2 configuration variables:
  - SOCIAL_AUTH_GOOGLE_OAUTH2_KEY (env var)
  - SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET (env var + Docker secret: google_oauth2_secret)

Follows existing patterns with _read_secret() for sensitive data and
environ.get() for non-sensitive configuration.

Resolves: netbox-community/netbox-docker#1139

* Secrets example

* fix: add newline at end of file

---------

Co-authored-by: skyefugate <skyefugate@users.noreply.github.com>

build.sh

@@ -105,6 +105,9 @@ GH_ACTION   If defined, special 'echo' statements are enabled that set the
 CHECK_ONLY  Only checks if the build is needed and sets the GH Action output.
             ${_GREEN}Default:${_CLEAR} undefined
             
+NO_CACHE    Disables Docker Build Cache.
+            ${_GREEN}Default:${_CLEAR} undefined
+
 ${_BOLD}Examples:${_CLEAR}
 
 ${0} main
@@ -409,7 +412,9 @@ fi
 if [ -n "${NO_PROXY}" ]; then
   DOCKER_BUILD_ARGS+=(--build-arg "no_proxy=${NO_PROXY}")
 fi
-
+if [ -n "${NO_CACHE}" ]; then
+  DOCKER_BUILD_ARGS+=(--no-cache)
+fi
 DOCKER_BUILD_ARGS+=(--platform "${BUILDX_PLATFORM-linux/amd64}")
 if [ "${2}" == "--push" ]; then
   # output type=docker does not work with pushing

configuration/configuration.py

@@ -310,6 +310,12 @@ REMOTE_AUTH_SUPERUSER_GROUPS = _environ_get_and_map('REMOTE_AUTH_SUPERUSER_GROUP
 REMOTE_AUTH_SUPERUSERS = _environ_get_and_map('REMOTE_AUTH_SUPERUSERS', '', _AS_LIST)
 REMOTE_AUTH_STAFF_GROUPS = _environ_get_and_map('REMOTE_AUTH_STAFF_GROUPS', '', _AS_LIST)
 REMOTE_AUTH_STAFF_USERS = _environ_get_and_map('REMOTE_AUTH_STAFF_USERS', '', _AS_LIST)
+# SSO Configuration
+SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY = environ.get('SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY')
+SOCIAL_AUTH_OKTA_OPENIDCONNECT_SECRET = _read_secret('okta_openidconnect_secret', environ.get('SOCIAL_AUTH_OKTA_OPENIDCONNECT_SECRET', ''))
+SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL = environ.get('SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL')
+SOCIAL_AUTH_GOOGLE_OAUTH2_KEY = environ.get('SOCIAL_AUTH_GOOGLE_OAUTH2_KEY')
+SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET = _read_secret('google_oauth2_secret', environ.get('SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET', ''))
 
 # This repository is used to check whether there is a new release of NetBox available. Set to None to disable the
 # version check or use the URL below to check for release in the official NetBox repository.

configuration/extra.py

@@ -33,13 +33,20 @@
 
 
 ## By default uploaded media is stored on the local filesystem. Using Django-storages is also supported. Provide the
-## class path of the storage driver in STORAGE_BACKEND and any configuration options in STORAGE_CONFIG. For example:
+## class path of the storage driver and any configuration options in STORAGES. For example:
-# STORAGE_BACKEND = 'storages.backends.s3boto3.S3Boto3Storage'
+# STORAGES = {
-# STORAGE_CONFIG = {
+#     'default': {
-#     'AWS_ACCESS_KEY_ID': 'Key ID',
+#         'BACKEND': 'storages.backends.s3boto3.S3Boto3Storage',
-#     'AWS_SECRET_ACCESS_KEY': 'Secret',
+#         'OPTIONS': {
-#     'AWS_STORAGE_BUCKET_NAME': 'netbox',
+#             'access_key': 'Key ID',
-#     'AWS_S3_REGION_NAME': 'eu-west-1',
+#             'secret_key': 'Secret',
+#             'bucket_name': 'netbox',
+#             'region_name': 'us-west-1',
+#         }
+#     },
+#     'staticfiles': {
+#         'BACKEND': 'django.contrib.staticfiles.storage.StaticFilesStorage',
+#     }
 # }
 
 

docker-compose.override.yml.example

@@ -16,3 +16,18 @@ services:
       # SUPERUSER_EMAIL: ""
       # SUPERUSER_NAME: ""
       # SUPERUSER_PASSWORD: ""
+      # SSO Configuration
+      # SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY: "your_okta_client_id"
+      # SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL: "https://your-domain.okta.com"
+      # SOCIAL_AUTH_GOOGLE_OAUTH2_KEY: "your_google_client_id"
+    # secrets:
+      # - okta_openidconnect_secret
+      # - google_oauth2_secret
+
+# Uncomment to use Docker secrets for SSO credentials
+# secrets:
+#   okta_openidconnect_secret:
+#     file: ./secrets/okta_secret.txt
+#   google_oauth2_secret:
+#     file: ./secrets/google_secret.txt
+

env/netbox.env

@@ -33,4 +33,12 @@ REDIS_SSL=false
 RELEASE_CHECK_URL=https://api.github.com/repos/netbox-community/netbox/releases
 SECRET_KEY='r(m)9nLGnz$(_q3N4z1k(EFsMCjjjzx08x9VhNVcfd%6RF#r!6DE@+V5Zk2X'
 SKIP_SUPERUSER=true
+# SSO Configuration (uncomment and configure as needed)
+# OKTA OpenID Connect
+# SOCIAL_AUTH_OKTA_OPENIDCONNECT_KEY=your_okta_client_id
+# SOCIAL_AUTH_OKTA_OPENIDCONNECT_SECRET=your_okta_client_secret
+# SOCIAL_AUTH_OKTA_OPENIDCONNECT_API_URL=https://your-domain.okta.com
+# Google OAuth2
+# SOCIAL_AUTH_GOOGLE_OAUTH2_KEY=your_google_client_id
+# SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET=your_google_client_secret
 WEBHOOKS_ENABLED=true