The user created in Netbox has username sdeckelmann while the user in LDAP has UID sdeckelmann-wmf. As a result the user in Netbox didn't get the wmf group that grants the RO permissions.
I'm not sure how the current user was created in Netbox and marked as active (that should happen only if it belongs to cn=wmf,ou=groups,dc=wikimedia,dc=org). Was the LDAP entry first created with sdeckelmann and then modified to sdeckelmann-wmf?

@SLyngshede-WMF could you have a look?

The account is correctly linked in the social_auth tabel, not sure how though:

>>> u = User.objects.get(username='sdeckelmann')
>>> u.social_auth.all()[0].extra_data
{'id': 'sdeckelmann-wmf', 'id_token': ...

No groups have been synchronized:

>>> u.groups.all()
<RestrictedQuerySet []>

@SDeckelmann-WMF can you try something, not sure if that will work, but I'll like to get a confirmation either way (because if it doesn't work we need to revisit a plugin).

Could you sign out for the SSO i.e. https://idp.wikimedia.org/logout then go to Netbox and sign out there as well: https://netbox.wikimedia.org/logout/
The sign back in to Netbox.

If you're already signed in and have new permissions assigned, then CAS (the software running idp.wikimedia.org) won't fetch the new permissions from LDAP. Meaning that you won't get the permissions sent to Netbox either.

I logged out of both and logged back in, and that fixed it!

I did logout from idp.wikimedia.org (or at least I had to re-authenticate) earlier. Is the netbox / other services logout something that can be centrally triggered, or is this kind of logout procedure required when permissions change going forward?

We are looking into some sort of central sign out, but I can't really say how that would work at this point. The "issue" is Open ID Connect". There is some support for back-channel sign out, that might mostly be "Sign out from Netbox and that will sign you out of idp.wikimedia.org as well". The back-channel feature in CAS (the software running idp.wikimedia.org) has been reported as broken, for a while, but it should finally have been fixed in the current releases. I can't promise that this will provide a central sign out feature, as we haven't looking into exactly how it works.

Right now we do have a patch that updates the text for users when requesting permissions via idm.wikimedia.org, where we inform that a sign out is required.