Caught LDAPError while authenticating: INSUFFICIENT_ACCESS

[arnaudvre]

Hey, so as far as I can tell (of course) I've got LDAP configured correctly, I know ldap is working as it's used to authenticate elsewhere without issues. It seems that django is complaining about a lack of privileges that the read-only account has but it's not telling anything more specific. I don't think it's complaining about a lack of access the user I'm trying to login with has because it's part of the netbox_admins group in ldap.

The django-ldap-debug.log:

Binding as cn=xxx,ou=users,dc=xxx,dc=xxx,dc=xxx,dc=com
Binding as cn=xxx,dc=xxx,dc=xxx,dc=xxx,dc=com
Caught LDAPError while authenticating: INSUFFICIENT_ACCESS({'msgtype': 111, 'msgid': 3, 'result': 50, 'desc': 'Insufficient access', 'ctrls': []})

The relevant section of ldap_config.py:

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "cn=netbox_users,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com",
    "is_staff": "cn=netbox_staff,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com",
    "is_superuser": "cn=netbox_admins,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com"
}

Let me know if you need the full dap_config.py

Thanks!

[arnaudvre]

I've tried adding the ldap read-only service account to the "is_active" ldap group which is the same group I'm using for AUTH_LDAP_REQUIRE_GROUP. Does the service account need to be in the same OU as the normal users by any chance?

[ahmzaa]

Looks like you may be missing the ou for the netbox_bind user if it exists in one in your ldap. I assume it would also be ou=users

Binding as cn=xxx,dc=xxx,dc=xxx,dc=xxx,dc=com

try adding ou to

AUTH_LDAP_BIND_DN

Although I may be wrong as its not complaining about user not found or password wrong.

[arnaudvre]

You're correct, the ldap read-only service account is not in the ou with all the other users and service accounts, it's at the root of the dit. As mentioned, this does not cause any problem elsewhere where the same service account is used as part of authenticating users.

[arnaudvre]

We are using an openldap backend (port389) using posix accounts and groups, this is our configuration, any help appreciated:

import ldap

# Server URI
AUTH_LDAP_SERVER_URI = "ldaps://xxx.xxx.xxx.xxx.com"

# Set the DN and password for the NetBox service account.
AUTH_LDAP_BIND_DN = "cn=ldap_ro_svc_acc,dc=xxx,dc=xxx,dc=xxx,dc=com"
AUTH_LDAP_BIND_PASSWORD = "xxxxxxxxxxxxxxxxx"

# Include this setting if you want to ignore certificate errors. This might be needed to accept a self-signed cert.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
# LDAP_IGNORE_CERT_ERRORS = True

# Include this setting if you want to validate the LDAP server certificates against a CA certificate directory on your server
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, LDAP_CA_CERT_DIR)
LDAP_CA_CERT_DIR = '/etc/openldap/certs'

# Include this setting if you want to validate the LDAP server certificates against your own CA.
# Note that this is a NetBox-specific setting which sets:
#     ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, LDAP_CA_CERT_FILE)
#LDAP_CA_CERT_FILE = '/path/to/example-CA.crt'

from django_auth_ldap.config import LDAPSearch

# This search matches users with the sAMAccountName equal to the provided username. This is required if the user's
# username is not in their DN (Active Directory).
# AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=users,dc=xxx,dc=xxx,dc=xxx,dc=com", ldap.SCOPE_SUBTREE)

AUTH_LDAP_USER_DN_TEMPLATE = "cn=%(user)s,ou=users,dc=xxx,dc=xxx,dc=xxx,dc=com"
                                    
from django_auth_ldap.config import LDAPSearch, GroupOfNamesType

# This search ought to return all groups to which the user belongs. django_auth_ldap uses this to determine group
# hierarchy.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch("ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com", ldap.SCOPE_SUBTREE,
                                    "(objectClass=groupOfNames)")
AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()

# Define a group required to login.
AUTH_LDAP_REQUIRE_GROUP = "cn=netbox_login,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com"

# Mirror LDAP group assignments.
AUTH_LDAP_MIRROR_GROUPS = True

# Define special user types using groups. Exercise great caution when assigning superuser status.
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
    "is_active": "cn=netbox_users,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com",
    "is_staff": "cn=netbox_staff,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com",
    "is_superuser": "cn=netbox_admins,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com"
}

# For more granular permissions, we can map LDAP groups to Django groups.
# AUTH_LDAP_FIND_GROUP_PERMS = True

# Cache groups for one hour to reduce LDAP traffic
AUTH_LDAP_CACHE_TIMEOUT = 3600

[arnaudvre]

Everything seems happy at the access log level when I try to login:

[23/Oct/2025:10:50:53.014249645 +0100] conn=17541 op=1 BIND dn="cn=xxx,dc=xxx,dc=xxx,dc=xxx,dc=com" method=128 version=3
[23/Oct/2025:10:50:53.075637303 +0100] conn=17541 op=1 RESULT err=0 tag=97 nentries=0 wtime=0.000060530 optime=0.061402344 etime=0.061461469 dn="cn=xxx,dc=xxx,dc=xxx,dc=xxx,dc=com"
[23/Oct/2025:10:50:53.076669246 +0100] conn=17541 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domaincontrollerfunctionality defaultnamingcontext lastusn highestcommittedusn aci"
[23/Oct/2025:10:50:53.077131535 +0100] conn=17541 op=2 RESULT err=0 tag=101 nentries=1 wtime=0.000170316 optime=0.000464402 etime=0.000633860
[23/Oct/2025:10:50:53.078279278 +0100] conn=17541 op=3 SRCH base="dc=xxx,dc=xxx,dc=xxx,dc=com" scope=2 filter="(&(objectClass=posixAccount)(uid=*)(uidNumber=*)(gidNumber=*)(modifyTimestamp>=20251010170408Z)(!(modifyTimestamp=20251010170408Z)))" attrs="objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbprincipalname cn memberOf modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krblastpwdchange krbpasswordexpiration pwdattribute authorizedService accountexpires useraccountcontrol nsAccountLock host rhost logindisabled loginexpirationtime loginallowedtimemap sshpublickey usercertificate;binary mail passkey"
[23/Oct/2025:10:50:53.078503184 +0100] conn=17541 op=3 RESULT err=0 tag=101 nentries=0 wtime=0.000215517 optime=0.000225372 etime=0.000439632 notes=U,P details="Partially Unindexed Filter,Paged Search" pr_idx=0 pr_cookie=-1
[23/Oct/2025:10:50:53.079261324 +0100] conn=17541 op=4 SRCH base="dc=xxx,dc=xxx,dc=xxx,dc=com" scope=2 filter="(&(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0)))(modifyTimestamp>=20251023080534Z)(!(modifyTimestamp=20251023080534Z)))" attrs="objectClass cn userPassword gidNumber member modifyTimestamp modifyTimestamp"
[23/Oct/2025:10:50:53.079509444 +0100] conn=17541 op=4 RESULT err=0 tag=101 nentries=0 wtime=0.000076168 optime=0.000249242 etime=0.000324021 notes=U,P details="Partially Unindexed Filter,Paged Search" pr_idx=0 pr_cookie=-1
[23/Oct/2025:10:50:53.080292428 +0100] conn=17541 op=5 SRCH base="dc=xxx,dc=xxx,dc=xxx,dc=com" scope=2 filter="(&(objectClass=ipService)(cn=*)(ipServicePort=*)(ipServiceProtocol=*))" attrs="objectClass cn ipServicePort ipServiceProtocol modifyTimestamp"
[23/Oct/2025:10:50:53.080380378 +0100] conn=17541 op=5 RESULT err=0 tag=101 nentries=0 wtime=0.000200279 optime=0.000089577 etime=0.000288689 notes=P details="Paged Search" pr_idx=0 pr_cookie=-1
[23/Oct/2025:10:50:54.005177938 +0100] conn=17515

Trying another login but looking at security log I find an error:

{ "date": "[23\/Oct\/2025:11:08:34.734080046 +0100] ", "utc_time": "1761214114.734080046", "event": "AUTHZ_ERROR", "dn": "cn=ldap_ro_service_account,dc=xxx,dc=xxx,dc=xxx,dc=com", "bind_method": "SIMPLE", "root_dn": false, "client_ip": "xxx.xxx.xxx.xxx", "server_ip": "xxx.xxx.xxx.xxx", "ldap_version": 3, "conn_id": 17572, "op_id": 2, "msg": "target_dn=(cn=netbox_login,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com)" }

I can view this group using the same credentials via ldapsearch however:

ldapsearch -x -b cn=netbox_login,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com -H ldaps://xxx.xxx.xxx.xxx.com -D "cn=ldap_ro_service_account,dc=xxx,dc=xxx,dc=xxx,dc=com" -W "objectclass=posixGroup"
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <cn=netbox_login,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com> with scope subtree
# filter: objectclass=posixGroup
# requesting: cn gidNumber 
#

# netbox_login, groups, xxx.xxx.xxx.com
dn: cn=netbox_login,ou=groups,dc=xxx,dc=xxx,dc=xxx,dc=com
cn: netbox_login
gidNumber: xxx

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

[arnaudvre]

For troubleshooting I've created a service account in the same ou as the standard users and given the same read-only access to the DIT that the previous service account has, the netbox ldap debug error is the same "INSUFFICIENT ACCESS" with it's corresponding "AUTHZ_ERROR" in the ldap security log, I've tried ldap trace logging but so far haven't been able to figure out what netbox is trying that it's being denied access to.

[arnaudvre]

Finally found the issue, the service account (the original one I was using) simply needed to be given the ldap "compare" rights, not just "read" and "search". A useful thing to enhance your documentation with I reckon or perhaps even add to debug logging?