- Nav-users - lister.unit.no

REMOTE_USER / Shibboleth SSO login silently fails to pass forward parameters right
by Kejvan Redjamand 02 Sep '26

02 Sep '26

Hi, We have a problem in authentication with shibboleth (SSO) and nav, which we would like to know if there is any resolution for. The authenticated user is seen in Apache variables but not passed to nav. This is not a Shibboleth, Apache, or `webfront.conf` configuration problem. It is a code defect probably introduced in 5.17.0 and probably still present, unchanged, in 5.19.0 (latest at time of writing). It might be a known bug (resolved?) but still present. It seems to be some shortcomings in the code in file (`/opt/venvs/nav/lib/python3.13/site-packages/nav/web/auth/backends.py`) ... import logging from django.contrib.auth.backends import RemoteUserBackend from nav.auditlog.models import LogEntry from nav.web.auth import remote_user _logger = logging.getLogger(__name__) class NAVRemoteUserBackend(RemoteUserBackend): "An adaptation of Django's RemoteUserBackend that is configurable the NAV way" def __init__(self): self.create_unknown_user = remote_user.CONFIG.will_autocreate_user() def authenticate(self, request, user): if not remote_user.CONFIG.is_remote_user_enabled(): return None user = super().authenticate(request, user) return user With DEBUG logging enabled for `nav.web.auth, we see that web-server side is fully functional. ... request.META["REMOTE_USER"]: "user(a)xxx.yyy" [INFO] nav.web.auth.signals] failed login: None REMOTE_USER: "default" from "/navlets/get-user-navlet/12?mode=VIEW" ... `REMOTE_USER` is present and correct in `request.META`, confirming the web-server side is fully functional. The subsequent `failed login: None` and fallback to the `default` (anonymous) account confirm the failure occurs entirely inside NAV's Django authentication backend dispatch. Auto creating accounts does not work, since the remote_user is not passed along right. ## Steps to reproduce 1. Deploy NAV 5.19.0 behind Apache + Shibboleth SP, with `webfront.conf`: ... [remote-user] enabled = yes varname = REMOTE_USER autocreate = yes 2. Log in via the IdP. Shibboleth authenticates successfully and Apache passes `REMOTE_USER` correctly (verified independently via `LogFormat "... REMOTE_USER=%u" ...` / `%{REMOTE_USER}e` in Apache access logs — confirms the header reaches Apache/mod_wsgi). 3. NAV does not log the user in; the session remains bound to the anonymous/`default` account. Is there any suggested solution? Kejvan Redjamand www.chalmers.se<http://www.chalmers.se/>

3 5

Announcement: NAV 5.19.0 released
by Morten Brekkevold 06 Jul '26

06 Jul '26

The first feature release of the 5.19 series of NAV is now out! The source code is available for download at GitHub [1]. New packages for Debian 12 (Bookworm) and 13 (Trixie) are available in our APT repository [2]. ## Removed - Stopped supporting Python versions older than 3.11 (#3994) - Removed tomli dependency (#3996) ## Added - The ipdevpoll cam plugin can now optionally log CAM records for switch ports connected to _unmanaged_ neighbors, so that Machine Tracker can locate both the unmanaged device itself and any end hosts behind it. For now, this must be explicitly enabled: See the [cam] section in the ipdevpoll reference docs for details. (#2915) - navtopology --l2 now logs a per-run summary line to navtopology.log with phase timings, per-source resolved-link counts, and database write counts. Per-edge DEBUG lines from the reducer are also tagged with the heuristic that produced each resolution. (#4067) - The interface details page now shows the full aggregate and stacking hierarchy as a tree, surfacing the derived layer-2 topology (including per-member MLAG neighbours) even when the link is recorded on a lower- layer member port rather than the aggregate itself. (#4081) - Collect Juniper DOM threshold values as sensors (#2340) - Added API endpoint for getting, creating and deleting maintenance tasks (#2927) - Room aliases are now shown as tooltips in IP device info (#3881) - Added new column to user admin tool user list to show which users have enabled 2-factor authentication (#4005) - Added navdashboard CLI tool for listing, exporting and importing dashboards (#4028) - Added REST API endpoint for organizations at api/organization/ - Added read-only REST API endpoint for router port information at api/gwportprefix/ ## Changed #### User-visible changes - Upgraded Django from 4.2 to 5.2. Remove unused pytz dependency. Changed minimum required PostgreSQL version to 14. (#3958) - Upgraded Sphinx version to 9.0.4 (#3950) - Excluded JavaScript test files from installed package. (#3916) - Improved the usability of the two-factor authentication pages with status indicators, clearer warnings, guided setup steps, and copy-to- clipboard support for recovery codes and TOTP secrets. (#3961) - Improved docs for configuring allauth social auth providers, sans OIDC. (#5075) - Updated "Installing NAV on Debian" guide to Debian Trixie (#2886) - Added PostgreSQL rule to never allow the default user to be active (#4027) - Hide map for rooms/locations without coordinates (#4008) - Hide empty lines in room detail view (#3893) #### Refactorings (developer-centric) - Replaced TOML config parser with Pydantic models for authentication config. (#4025) - Migrated gauge and linear_gauge from D3 v3 to D3 v7. (#3907) - Migrated IPAM prefix visualizations from D3 v3 to D3 v7. (#3965) - Migrated the netmap force-directed graph from D3 v3 to D3 v7. (#3966) - Replace deprecated USE_L10N = False setting with a custom FORMAT_MODULE_PATH to preserve ISO date formatting for Django 5.0 compatibility. - Refactored the Watchdog page to fetch its statistics via HTMX instead of a custom RequireJS/jQuery module. (#4054) - Refactored the sensor-details page to fetch its current on/off state via HTMX instead of a custom RequireJS/jQuery module. (#4056) - Improve Devex when using docker compose for development. (#4036) ## Fixed - Restored audit-log and application-log recording of user logins, which stopped when the login flow moved to django-allauth in 5.18.0. (#4106) - Fixed topology detector assigning the wrong neighbor to aggregate (LAG) interfaces, such as Juniper ae interfaces, whose members are discovered through one or more layers of stacked interfaces. (#4029) - Fixed VLAN topology detection dropping detected VLANs from aggregated (LAG) uplinks, e.g. Juniper ae interfaces, where the layer-2 topology resolves on the physical member ports while the 802.1q configuration lives on the aggregate above them. (#1687) - Made 'My stuff' dropdown behave consistently (#3799) - Fixed a crash in the Room/Location Status navlets when an alert lacks an associated SMS message record. (#3899) - Fixed a race condition crash in asyncdns ForwardResolver where a DNS error on one record type (A/AAAA) could cause an AttributeError when the other record type resolved successfully. (#3902) - Fixed pipe characters in management profile names or netbox data breaking bulk dump/import (#3960) - Fixed the broken "approximate database size" indicator on the Watchdog page. (#4052) - Fixed ipdevpoll crashing shortly after startup on systems that forbid writable-and-executable memory. (#4066) - pping no longer misclassifies hosts whose ICMP echo reply round-trip time measures as exactly 0s (a logic error that would only occur during system clock adjustments) (#4071) - Fixed outdated list of available API endpoints in the documentation (#4085) - Stopped the room image views from returning spurious server errors (and emailing admins) when deleting already-deleted images or on malformed requests. (#4103) - Stopped allowing the navuser unlock and passwd commands to work for the default user - AuthorizationMiddleware now raises an error if HtmxMiddleware has not run before it (#3713) ## Release notes We always advise you to have a look at NAV's accompanying release notes [3] before upgrading. Happy NAVing everyone! ## Links [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-19 -- Best regards Morten Brekkevold Senior engineer, PA Campus networks Phone: (+47) 735 57 802 Sikt – Norwegian Agency for Shared Services in Education and Research www.sikt.no

1 0

Announcement: NAV 5.18.1 released
by Morten Brekkevold 13 Mai '26

13 Mai '26

The first maintenance release of the 5.18 series of NAV is now out! The source code is available for download at GitHub [1]. New packages for Debian 11 (Bullseye), 12 (Bookworm) and 13 (Trixie) are available in our APT repository [2]. **NB!** This will be the LAST package we publish for Debian 11 (Bullseye). ## Fixed - Fixed post-login redirect not returning users to the page they originally requested (#3954) - Fix unclickable edit button for widget titles on the dashboard. (#3980) - Fixed removal of all aliases from rooms/locations in SeedDB not being persisted on save. (#4002) - Fixed LDAP authentication unconditionally rehashing the password on every login, which invalidated the Django session auth hash and broke MFA/TOTP setup for LDAP users. (#4003) ## Release notes We always advise you to have a look at NAV's accompanying release notes [3] before upgrading. Happy NAVing everyone! ## Links [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-18 -- Best regards Morten Brekkevold Senior engineer, The Data and Infrastructure Division Phone: (+47) 735 57 802 Sikt – Norwegian Agency for Shared Services in Education and Research www.sikt.no

1 0

NAV behind haproxy
by Einar Bjarni Halldórsson 14 Apr '26

14 Apr '26

Hi, We got NAV deployed behind haproxy and since CSRF was enabled forms don't work, including the login form. The haproxy frontend is TLS while the connection to the NAV backend is http (it's on the same host for reasons). I've tried various suggestions for django csrf behind a reverse-proxy, including adding "http-request set-header X-Forwarded-Proto https" to haproxy frontend without success. There are various django config options that are suggested, but those are not exposed through the nav.conf file. .einar

2 2

Cam Records, Multicast Packets, Broadcast Packets not populating from Cisco Catalyst 1300
by Corey Thompson 09 Apr '26

09 Apr '26

I've been using NAV for well over a decade with very few issues... Recently, we've integrated a few Cisco Catalyst 1300 series switches to our network and I do not get cam data from them, nor do I get Multicast or Broadcast packet metrics Looking at ipdevpoll log only see theses warnings: [WARNING zen.pynetsnmp.agentproxy] Packet for x.x.x.x has error: Unknown oid. OIDS: [OID('.1.3.6.1.4.1.9.9.117.1.1.2.1.2.67109505')] [WARNING nav.mibs.power_ethernet_mib.powerethernetmib] [statuscheck 192.168.3.20] device response has bad table index .17.2.99 in POWER-ETHERNET-MIB::pethPsePortTable, ignoring Which seemingly shouldn't cause the issues I'm seeing, but maybe.. Nearly 500 devices on our NAV, and I've never had to do this deep of troubleshooting with it, wondering where to start, and if anyone else has Cisco Catalyst 1300s in their NAV? Corey Thompson

2 1

Cisco Catalyst 1300 issues
by Corey Thompson 30 Mar '26

30 Mar '26

I've been using NAV for well over a decade with very few issues... Recently, we've integrated a few Cisco Catalyst 1300 series switches to our network and I do not get cam data from them, nor do I get Multicast or Broadcast packet metrics Looking at ipdevpoll log only see theses warnings: [WARNING zen.pynetsnmp.agentproxy] Packet for x.x.x.x has error: Unknown oid. OIDS: [OID('.1.3.6.1.4.1.9.9.117.1.1.2.1.2.67109505')] [WARNING nav.mibs.power_ethernet_mib.powerethernetmib] [statuscheck 192.168.3.20] device response has bad table index .17.2.99 in POWER-ETHERNET-MIB::pethPsePortTable, ignoring Which seemingly shouldn't cause the issues I'm seeing, but maybe.. Nearly 500 devices on our NAV, and I've never had to do this deep of troubleshooting with it, wondering where to start, and if anyone else has Cisco Catalyst 1300s in their NAV? Corey Thompson

1 0

Announcement: NAV 5.18.0 released
by Morten Brekkevold 30 Mar '26

30 Mar '26

The first feature release of the 5.18 series of NAV is now out! The source code is available for download at GitHub [1]. New packages for 11 (Bullseye), Debian 12 (Bookworm) and 13 (Trixie) are available in our APT repository [2]. ## Security - The CSRF cookie is now marked as secure when needs_tls is enabled in webfront.conf, matching the existing behavior of the session cookie. (#3829) - Passwords are no longer leaked in cleartext in Django error emails when LDAP authentication crashes. (#3870) ## Removed (developer-centric) - Removed obsolete Docker-based test environment. Replaced by test suite changes that can run in 'normal' development environments. (#3849) ## Added - Rooms and locations can now have multiple names (aliases). Aliases are searchable throughout NAV -- in the navbar, global search, device history, maintenance, netmap, network explorer, status widgets, and the REST API. Aliases can be managed in *SeedDB* and via bulk import/export. They are displayed on room/location detail pages, in search results, and in SeedDB list views. (#3314, #3315, #3815, #3818, #3819, #3820, #3821, #3822, #3823, #3836, #3840, #3841, #3844, #3851, #3852, #3868, #3880, #3895) - Added support for two-factor authentication (TOTP), OAuth2, OIDC, and SAML login via django-allauth. Authentication can be configured through the new TOML config file webfront/authentication.toml. (#3622, #3676, #3834, #3862, #3873, #3889, #3934, #3936) - Added a report of devices without a known uplink in the topology. - Debug log runtimes of individual NAVbar search providers. ## Changed - Auditlog entries can now be sorted by individual columns. Hyperlinks to more details are now provided for actors, objects and targets that still exist in the NAV database. (#3776) - Updated markdown dependency to 3.8.1. (#3812) - Downgraded spammy WARNING log about alerts referencing deleted objects to DEBUG level. (#3927) ## Changed (developer-centric) - Standardize vendored JavaScript library management. Vendored JS files now follow a consistent <name>-<version>.min.js naming convention and are tracked as npm dependencies for easier version management. A vendor.py tool is included to automate installing and copying vendored files. (#2470) - Tox environments and GitHub workflows switched over to uv for dependency management. (#3859) ## Fixed - Fix network explorer search not working after the first search per page load. (#3853) - Fixed l2trace crash when tracing through a netbox with no associated prefix. (#3866) - LDAP login no longer crashes with a 500 error when a user cannot be found during group membership verification. (#3871) - Fix report column tooltips ($explain_) not showing when the column also has a $name_ override. (#3876) - Fixed a crash in SeedDB bulk import when IP addresses contain trailing whitespace. (#3884) ## Release notes We always advise you to have a look at NAV's accompanying release notes [3] before upgrading. Happy NAVing everyone! ## Links [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-18 -- Best regards Morten Brekkevold Senior engineer, The Data and Infrastructure Division Phone: (+47) 735 57 802 Sikt – Norwegian Agency for Shared Services in Education and Research www.sikt.no

1 0

Announcement: NAV 5.17.1 released
by Morten Brekkevold 27 Feb '26

27 Feb '26

The first maintenance release of the 5.17 series of NAV is now out! The source code is available for download at GitHub [1]. New packages for Debian 12 (Bookworm), 11 (Bullseye) and 13 (Trixie) are available in our APT repository [2]. ## Fixed - Fix collapsed multiselects in status tool filters (#3797) - Event engine now yields to overdue scheduler callbacks between processing queued events, preventing long event batches from blocking time-critical tasks. (#3798) - Added missing index on netboxentity.deviceid to speed up lookups by device. (#3794) - Fix crash when rendering navlet error responses due to missing navlet ID (#3802) - Fixed a session crash (UpdateError) on the login page that could leak cleartext passwords in Django error emails. (#3803) - Fix chart widget failing to load images from URLs without query parameters (#3805) - Fixed sc.05.16.0001.sql migration failure on PostgreSQL 14 caused by ambiguous || operator when concatenating an integer without an explicit ::TEXT cast. (#3806) - Fixed a crash in Netmap when the topology graph exceeds memcached's max item size. The graph is now returned successfully even when it cannot be cached. (#3795) - Improved active IP collector query performance (~10x) by utilizing partial database indexes on the arp table more effectively. (#3793) - PortAdmin's "commit configuration" endpoint now returns 503 instead of 500 when the device is unreachable or does not support configuration commits, and no longer triggers spurious admin error emails for these expected operational failures. (#3801) - Turned support for REMOTE_USER back on. Regression caused by the new auth-system and its complicated route to the finish line. ## Release notes We always advise you to have a look at NAV's accompanying release notes [3] before upgrading. Happy NAVing everyone! ## Links [1] https://github.com/Uninett/nav/releases [2] https://nav.uninett.no/install-instructions/#debian [3] https://nav.readthedocs.io/en/latest/release-notes.html#nav-5-17 -- Sincerely, Morten Brekkevold Sikt – Norwegian Agency for Shared Services in Education and Research

1 0

Upgrade to NAV 5.16.1, navsyncdb throws error
by Ingeborg Hellemo 27 Feb '26

27 Feb '26

While trying to upgrade to NAV 5.16.1, navsyncdb throws this error: sql/changes/sc.05.16.0001.sql: operator is not unique: unknown || integer LINE 1: new_token_str := 'token #' || token_rec.id || ' (' || trunca... ^ HINT: Could not choose a best candidate operator. You might need to add explicit type casts. QUERY: new_token_str := 'token #' || token_rec.id || ' (' || truncated_comment || ')' CONTEXT: PL/pgSQL function inline_code_block line 22 at assignment PostgreSQL version 14.21 (both client and server) on FreeBSD The solution is to explicitly cast the two places where it is missing: 28c28 < new_token_str := 'token #' || token_rec.id || ' (' || truncated_comment || ')'; --- > new_token_str := 'token #' || token_rec.id::TEXT || ' (' || truncated_comment || ')'; 30c30 < new_token_str := 'token #' || token_rec.id; --- > new_token_str := 'token #' || token_rec.id::TEXT; --Ingeborg -- Ingeborg Østrem Hellemo -- ingeborg.hellemo(a)uit.no Dep. of Information Technology --- Univ. of Tromsø

2 1

Nav 5.17.0, regression in Chart widget
by Ingeborg Hellemo 27 Feb '26

27 Feb '26

Upgraded to NAV 5.17.1 and the Chart widget did not work as in previuos versions. Example: "URL to image" = http://weather.cs.uit.no/cam/cam_south.jpg gives "Error loading image" --Ingeborg -- Ingeborg Østrem Hellemo -- ingeborg.hellemo(a)uit.no Dep. of Information Technology --- Univ. of Tromsø

2 1