How can I get user's AAD group when I login?

[alicechiou]

Hi sirs,
I successfully logged into Nautobot using SSO with AAD, but how can I retrieve the user's group from AAD? I have reviewed the documentation, but our user does not have any roles assigned in Azure. I only need to retrieve the user's group. How can I set this up?

document: https://docs.nautobot.com/projects/core/en/stable/configuration/authentication/sso/
I also checked the code: https://github.com/nautobot/nautobot/blob/main/examples/azure_ad/group_sync.py
But I don't have any ideas what need to set in here:
SOCIAL_AUTH_AZUREAD_OAUTH2_RESOURCE = ""
and in the code:
ROLES_GROUP_NAME = "roles"
SUPERUSER_GROUPS = ["Admin"]
STAFF_GROUPS = ["Admin"]
if user and response and response.get(ROLES_GROUP_NAME, False):

if my user not be assigned any roles in AAD, I just want retrieve the user's group, May I update ROLES_GROUP_NAME to "groups"
and set the group name to SUPERUSER_GROUPS and STAFF_GROUPS??
Thanks

[jdrew82]

The group_sync.py file handles the group assignment and parsing from Azure. If you look at the script, you can see that once the user authenticates to AzureAD a user entitlement grant response is sent to Nautobot. The group_sync method takes that response and evaluates it for how to handle the user's groups in Nautobot. Suppose it finds that the user is included in one of the groups specified by the SUPERUSER_GROUPS or STAFF_GROUPS lists then the user account will be given admin or root-level permissions to Nautobot accordingly. They will also be placed in the groups that are returned. If that group doesn't already exist it will be created with no permissions so it's important to have those groups made ahead of time so users are given the correct permissions immediately.

[alicechiou]

Hi Justin,
My question is I can use AAD log in to nautobot now, but in Azure portal, my account has no roles be assigned, I only want to get my groups info.
As below:

And I have set the groups on Nautobot

But what value I need to set for SOCIAL_AUTH_AZUREAD_OAUTH2_RESOURCE in nautobot_config.py?

And this is my code

I can not get any groups from AAD

[jdrew82]

I'd suggest re-evaluating your code compared to the example. You made some changes that are affecting your login. The biggest issue that I see is that you have the group_ids.append happening if no groups are defined. That's not how the example has it. You shouldn't need to modify the example script outside of defining the names of the groups used for defining the superuser and staff roles.

[alicechiou]

Hi Justin,
Actually I have tried the example code before, it doesn't work and it will carete a new group "Admin" by the code and add user to the group, but we just want get the AAD group.

[jdrew82]

@alicechiou If it created the Admin group then it's because you had an old version of the script installed and it used that. It uses the name of the groups that are passed when creating them and appends them to the group_ids list that is then set on the user. I can assure you that the example script works as I've used it with many clients. You should simply need to update the STAFF and SUPERUSER_GROUPS lists to have the names of the Groups from AzureAD that you wish to correspond to those roles. The example uses Admin and will put the user in that group If you're wanting to see the group memberships for the user, they're printed in debug output in the example with the group_memberships list.