OpenIdConnectAuth <class 'TypeError'>, not sure what's actually wrong.

[silmarine]

I get an error when I try to login with openid:

<class 'TypeError'>

unsupported operand type(s) for +: 'NoneType' and 'str'

I am trying to get it to work with Authelia but I cannot find any example configs for it with Netbox and am having to figure it out on my own. Because of that I assume I've made an error in the config somewhere. But this error doesn't tell me anything that helps. Anyone have any ideas?

[candlerb]

Perhaps you could start by showing your config? You can find sample configs for keycloak and vault in the discussion archives.

[silmarine]

sorry, didn't mean to be lacking in info. This error just didn't have anything to go off of and I wasn't sure if it actually was a config issue or what. anyways, yes I used a lot of keycloak and authentik guides to help. I am also not unfamiliar with python so I looked though the OpenIdConnectAuth section.

I'm using the linuxserver docker image, here is my compose file netbox section:

  netbox:
    image: lscr.io/linuxserver/netbox:latest
    container_name: netbox
    restart: unless-stopped
    depends_on:
      - postgres
      - netbox-redis
    networks:
      - proxy
    environment:
      - PUID=1000
      - PGID=996
      - TZ=Europe/Berlin
      - ALLOWED_HOST=netbox.mydomain.tld
      - DB_NAME=netbox
      - DB_USER=netbox
      - DB_PASSWORD=<secret>
      - DB_HOST=postgres
      - DB_PORT=5432
      - REDIS_HOST=netbox-redis
      - REDIS_PORT=6379
      - REDIS_DB_TASK=0
      - REDIS_DB_CACHE=1
      - REMOTE_AUTH_ENABLED=True
      - REMOTE_AUTH_BACKEND=social_core.backends.open_id_connect.OpenIdConnectAuth
      - REMOTE_AUTH_AUTO_CREATE_USER=True
      - SOCIAL_AUTH_OIDC_OIDC_ENDPOINT=https://auth.mydomain.tld
      - SOCIAL_AUTH_OIDC_ID_KEY=netbox
      - SOCIAL_AUTH_OIDC_SECRET=<secret>
      - SOCIAL_AUTH_OIDC_SCOPE=['groups']
      - LOGOUT_REDIRECT_URL=https://auth.mydomain.tld/logout
    volumes:
      - /opt/docker/netbox:/config

and here is my Authelia client config for netbox:

    - client_id: 'netbox'
      client_name: 'Netbox'
      client_secret: <secret>
      public: false
      authorization_policy: 'two_service'
      consent_mode: 'implicit'
      redirect_uris:
        - 'https://netbox.mydomain.tld/login'
      scopes:
        - 'openid'
        - 'email'
        - 'profile'
        - 'groups'
      userinfo_signed_response_alg: 'RS256'

I have not made any changes to the configuriation.py file.

[candlerb]

I don't know anything about Authelia, but:

1. I'm not 100% sure you can use social_core.backends.open_id_connect.OpenIdConnectAuth directly without subclassing it. A while back, I tried to contribute this feature rather than a custom Vault subclass. Full gory history in Add backend for Hashicorp Vault (alternative approach) python-social-auth/social-core#669 but some of it (the group membership part) was reverted in oidc: Remove groups attribute python-social-auth/social-core#692

2. Even if that were to work, I think you've got the wrong redirect_uris:

      redirect_uris:
        - 'https://netbox.mydomain.tld/login'

should be

      redirect_uris:
        - 'https://netbox.mydomain.tld/oauth/complete/oidc'   # See "name = 'oidc'" in PSA source

But having said that, I'd expect Authelia to complain that it's asking to be redirected to a uri which is not in the permitted list, and it should be pretty clear what the correct one is. It sounds like it's not getting that far.

Aside: if you want to make use of groups, I believe you also have to hack the auth pipeline; you can find info on this in past discussions. Personally I abandoned PSA and went back to Apache mod_auth_openidc.

As for the NoneType + str error, you need to get a full backtrace from Netbox. Either set DEBUG=True, or set ADMINS and EMAIL to get all exceptions mailed out to you. I don't run Netbox in Docker so I don't know if those are available as environment variables or you have to set them in extra.py

[silmarine]

Ah okay, that is all much too complicated to be worth it for my little home lab. I think I will just abandon using openid all together and just create local accounts. At least for now until it get better out of the box support, if it ever does. Thanks for the help!

[mongrelion]

I ran into the same issue that you are having. I'm also using docker compose.
The problem is that you would think that the SOCIAL_AUTH_ environment variables would be automatically consumed and passed on to social_core but that is actually not the case.

You have to initialize those variables in your configuration.py as well:

SOCIAL_AUTH_OIDC_OIDC_ENDPOINT=environ.get('SOCIAL_AUTH_OIDC_OIDC_ENDPOINT')
SOCIAL_AUTH_OIDC_ID_KEY=environ.get('SOCIAL_AUTH_OIDC_ID_KEY')
SOCIAL_AUTH_OIDC_SECRET=environ.get('SOCIAL_AUTH_OIDC_SECRET')
SOCIAL_AUTH_OIDC_SCOPE=environ.get('SOCIAL_AUTH_OIDC_SCOPE')

After doing that, I was able to get it off the ground!

Good luck.