Nav-users

Download

nav-users@lister.sikt.no

September 2026

1 participants
2 discussions

Announcement: NAV 5.19.1 released
by Morten Brekkevold 24 Sep '26

24 Sep '26

The first maintenance release of the 5.19 series of NAV is now out! The source code is available for download at GitHub [1]. New packages for Debian 12 (Bookworm) and 13 (Trixie) are available in our APT repository [2]. ## Fixed - The browsable REST API no longer loads Bootstrap CSS from an external CDN, so it renders correctly on air-gapped/offline clients. (#4089) - Pinned junos-eznc below 2.8.1 to keep PortAdmin and SeedDB working for IPv6-addressed Juniper devices, until napalm brackets IPv6 hosts. (#4119) - Fixed the shipped OIDC authentication.toml example, which was rejected by config validation; OIDC providers now accept an entry-level scope setting like social providers do. (#4121) - Fixed a UnicodeDecodeError that could prevent ipdevpoll from loading ipdevpoll.conf under a non-UTF-8 locale such as LANG=C. Configuration files read by ipdevpoll and several other subsystems are now decoded as UTF-8 regardless of the system locale. (#4132) - Add test dependency cryptography - snmpsim uses pysnmp which uses cryptography, but only declares it as *development* dependency (#4162) - REMOTE_USER/SSO authentication works again. Since NAV 5.17.0 the configured variable was ignored entirely, and every visitor was silently treated as the anonymous default account. (#4168) - Fixed intermittently broken widget drag-and-drop on dashboards, caused by a race between dashboard loading and JavaScript initialization. (#4180) ## Release notes We always advise you to have a look at NAV's accompanying release notes [3] before upgrading. Happy NAVing everyone! ## Links [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-19 -- Sincerely, Morten Brekkevold Sikt – Norwegian Agency for Shared Services in Education and Research

1 0

REMOTE_USER / Shibboleth SSO login silently fails to pass forward parameters right
by Kejvan Redjamand 02 Sep '26

02 Sep '26

Hi, We have a problem in authentication with shibboleth (SSO) and nav, which we would like to know if there is any resolution for. The authenticated user is seen in Apache variables but not passed to nav. This is not a Shibboleth, Apache, or `webfront.conf` configuration problem. It is a code defect probably introduced in 5.17.0 and probably still present, unchanged, in 5.19.0 (latest at time of writing). It might be a known bug (resolved?) but still present. It seems to be some shortcomings in the code in file (`/opt/venvs/nav/lib/python3.13/site-packages/nav/web/auth/backends.py`) ... import logging from django.contrib.auth.backends import RemoteUserBackend from nav.auditlog.models import LogEntry from nav.web.auth import remote_user _logger = logging.getLogger(__name__) class NAVRemoteUserBackend(RemoteUserBackend): "An adaptation of Django's RemoteUserBackend that is configurable the NAV way" def __init__(self): self.create_unknown_user = remote_user.CONFIG.will_autocreate_user() def authenticate(self, request, user): if not remote_user.CONFIG.is_remote_user_enabled(): return None user = super().authenticate(request, user) return user With DEBUG logging enabled for `nav.web.auth, we see that web-server side is fully functional. ... request.META["REMOTE_USER"]: "user(a)xxx.yyy" [INFO] nav.web.auth.signals] failed login: None REMOTE_USER: "default" from "/navlets/get-user-navlet/12?mode=VIEW" ... `REMOTE_USER` is present and correct in `request.META`, confirming the web-server side is fully functional. The subsequent `failed login: None` and fallback to the `default` (anonymous) account confirm the failure occurs entirely inside NAV's Django authentication backend dispatch. Auto creating accounts does not work, since the remote_user is not passed along right. ## Steps to reproduce 1. Deploy NAV 5.19.0 behind Apache + Shibboleth SP, with `webfront.conf`: ... [remote-user] enabled = yes varname = REMOTE_USER autocreate = yes 2. Log in via the IdP. Shibboleth authenticates successfully and Apache passes `REMOTE_USER` correctly (verified independently via `LogFormat "... REMOTE_USER=%u" ...` / `%{REMOTE_USER}e` in Apache access logs — confirms the header reaches Apache/mod_wsgi). 3. NAV does not log the user in; the session remains bound to the anonymous/`default` account. Is there any suggested solution? Kejvan Redjamand www.chalmers.se<http://www.chalmers.se/>

3 5